R27-002 Managed Governance, Risk, Compliance and Cybersecurity Program Management Services

Nassau Community College is soliciting proposals for Managed Governance, Risk, Compliance (GRC), and Cybersecurity Program Management Services under solicitation number 2139496. The selected partner will serve as a strategic extension of the IT organization, providing virtual Chief Information Security Officer (vCISO) leadership and active program management to enhance the college's cybersecurity posture. Key objectives include developing a multi-year strategy roadmap, maintaining regulatory compliance for higher education, and improving maturity across all functions of the NIST Cybersecurity Framework (CSF) 2.0. Primary deliverables include a cybersecurity risk register, quarterly risk trend analysis, an enterprise technology asset inventory, and Plans of Action and Milestones (POA&Ms). The contract features an initial one-year term with the option for four additional one-year extensions, totaling a maximum of five years. Performance is primarily remote, though in-person attendance may be required. Proposers must submit a fixed annual fee for the scope of services and provide hourly rates for additional labor categories. To be considered responsive, firms must meet strict minimum qualifications, including five years of experience in cybersecurity consulting, a history of serving at least five similar institutions (three of which must be public higher education), and a Lead vCISO with at least ten years of experience. Proposals are due by October 27, 2026, and will be evaluated using a point rating system based on the best interest of the college.