Managed Security Services Provider (MSSP) D38B6600005

The State of Maryland’s State Board of Elections is seeking a Managed Security Services Provider to establish a centralized, enterprise-wide cybersecurity function designed to eliminate security gaps, improve cyber hygiene, and enforce clear roles and responsibilities across its systems and data. The contract is structured as a Firm Fixed Price with Labor Hours for a two-year base period, with two optional two-year renewal periods, requiring the vendor to deliver a comprehensive program covering seven distinct tasks including 24x7x365 Security Operations Center operations, Zero Trust Architecture implementation, application security, cybersecurity engineering, and ongoing security advisory services. All work must comply with NIST 800-53 Rev 5, NIST SP 800-171, CIS Benchmarks, SOC2 Type 2, and ISO standards, with annual SOC 2 Type 2 audits mandated. The contractor must maintain log data for at least 18 months or longer if required by law, provide detailed weekly performance reports on security events, incident response metrics, and malware trends, and submit all deliverables through a formal Acceptance Form process. Data ownership rests exclusively with the State, and the contractor is required to bear all costs related to breach investigation, notification, and credit monitoring. Eligibility is strictly limited to certified Maryland Small Business Reserve (SBR) firms headquartered in the United States; federal small business certifications do not qualify. Proposals must be submitted in two volumes—Technical and Financial—via eMMA, with the Technical Proposal excluding all pricing information and requiring strict adherence to RFP section numbering. The Financial Proposal must detail fixed pricing per task, including labor rates for the entire contract lifecycle, with hourly costs locked at proposal submission. Minimum qualification requirements include SBR certification verified through the state’s eMMA portal, with MBE participation set at a 10% goal and compliance with the Maryland Healthy Working Families Act. The contract imposes strict indemnification obligations, limiting liability to the greater of the contract value or $1 million per incident, while exposing the contractor to unlimited liability for other claims. Contractors must provide annual insurance certificates, including a $5 million cyber/data breach policy, and are prohibited from placing restrictive markings on state-owned deliverables. The CIO serves as the Contract Manager, with final approval authority over all deliverables, work orders, and invoices, which must include a signed Deliverable Product Acceptance Form and align with COMAR 21.06.09 billing standards to be processed. Transition provisions mandate maximizing retention of personnel during