RFP-171-260000001298-2 | RFP-CIP Enterprise Security Awareness Training

The State of Michigan, through the Department of Technology, Management and Budget (DTMB), is soliciting enterprise security awareness training services under solicitation number RFP-171-260000001298-2, with proposals due by May 26, 2026. The procurement targets vendors to deliver a comprehensive, digital-based security awareness program aligned with state-specific and federal standards including NIST SP 800-53, FISMA, HIPAA, and Michigan’s SOM Digital Standards. Performance is entirely virtual, with all services provided remotely, and all state data involved must be stored within the United States. The evaluation of proposals is weighted heavily toward technical solution quality at 40%, followed by project scope at 30%, staffing at 15%, and company background at 15%, with a strict requirement that all proposals score at least 80 points to be considered for award. The state is evaluating for best value, not lowest price, allowing trade-offs between technical merit and cost. Key deliverables include customized training modules, documentation, and ongoing support services, with performance measured against clearly defined milestones and acceptance testing protocols conducted by the State. All work product is owned exclusively by the State upon delivery. Special requirements impose stringent security, compliance, and operational controls on contractors. All personnel must pass ICHAT screening, drug testing, and Michigan State Police background checks, with annual rechecks mandated for continued access to state data. Immediate reporting is required for any criminal charges, license suspensions, or changes in personnel with access to sensitive information. Contractors are prohibited from assigning the contract or transferring control without state approval, and must disclose any organizational changes within 30 days. A price reduction parity clause ensures the State receives the lowest rate offered to any other entity, with mandatory notification within 15 business days. Invoicing must follow strict state protocols through the SIGMA VSS system, with payments processed via EFT and no reimbursement for overtime or travel. Documentation must be complete, accurate, and enable state personnel to operate systems independently. Security is reinforced through disaster recovery planning, quarterly training, vulnerability scanning, and adherence to federal and state IT policies. Proposals must be submitted via the SIGMA VSS portal in modifiable native file formats, with the pricing schedule submitted as a standalone document, and all attachments—including resumes, business specifications, insurance details, and confidentiality forms—must be fully completed and self-contained within the submission.