NIST Cybersecurity Framework (CSF) 2.0 Adoption & Maturity Advancement

The Greenville-Spartanburg Airport District is soliciting proposals under RFP-2026-0005 for a qualified cybersecurity firm to lead the adoption of the NIST Cybersecurity Framework (CSF) 2.0. The primary objective is to advance the Airport's cybersecurity risk-management maturity from a Partial/Tier 1 state to a Repeatable/Tier 3 state. This engagement covers a complex environment including enterprise IT, operational technology (OT), industrial control systems (ICS), and physical security systems, while ensuring compliance with TSA Cybersecurity Directives. The selected partner will build upon existing measurements from Microsoft Purview Compliance Manager and Arctic Wolf rather than replacing them. The project is structured as a Time and Materials Not-to-Exceed (NTE) contract, with Phase 1 focusing on Foundation and Priority Uplift. Key deliverables include baseline reconciliation, the creation of current and target organizational profiles, a prioritized gap analysis, a multi-year roadmap with cost estimates, and the implementation of a KRI metrics dashboard integrated with Microsoft tooling. Performance will be executed through a hybrid delivery model of remote and onsite work, with specific onsite requirements for facility walkthroughs and executive workshops. Proposals will be evaluated based on a weighted criteria: 50% for technical approach and methodology, 30% for relevant experience in NIST CSF 2.0 and critical infrastructure, 10% for key personnel qualifications, and 10% for price. The submission requires a technical proposal limited to 20 pages, along with mandatory forms certifying debarment status, acknowledgement of addenda, and any exceptions to the RFP. The contract includes strict requirements for insurance, confidentiality, and adherence to civil rights and non-discrimination statutes.