RFP # 6000003326 - REQUEST FOR PROPOSALS FOR THE PERFORMANCE OF EXPERT PROFESSIONAL OPERATIONAL TECHNOLOGY (OT) CYBER SECURITY CONSULTING SERVICES DURING 2026 THROUGH 2029

The Port Authority of New York and New Jersey is soliciting expert professional operational technology (OT) cybersecurity consulting services under RFP #6000003326 for a performance period spanning 2026 through 2029, with potential for two additional one-year extensions at the Agency’s discretion. Services will be delivered on a call-in basis via task orders and encompass penetration testing of OT infrastructure, building an internal OT security team, program reviews, tabletop exercises, and threat and risk assessments. Work may be performed remotely or on-site at Port Authority facilities in New York, with strict adherence to NIST and IEC 62443 standards, as well as the Port Authority Information Security Handbook. All personnel must hold active OT/ICS certifications such as GICSP, GRID, or ISA/IEC 62443, possess at least six years of experience in critical infrastructure cybersecurity, and demonstrate two verifiable client references and $3 million in annual OT cybersecurity revenue over the past three fiscal years. Access to secure areas requires completion of the Secure Worker Access Consortium (S.W.A.C.) verification process, including biometric screening and two forms of government-issued ID, and prohibits photography, digital imaging, and unauthorized data transmission without prior written consent. Proposal submissions must be submitted exclusively through the Bonfire platform by 2:00 p.m. Eastern Time on August 4, 2026, and must include six mandatory attachments: Agreement on Terms of Discussion, Company Profile with EIN and affiliate details, Proposer Requirements demonstrating full compliance (no subconsultants allowed), MBE/WBE/SDVOB Outreach Goals, a Conflict of Interest Statement and Mitigation Plan, and a Blue Cover Sheet. The evaluation is based on a best-value determination weighing price, quality of the proposed work plan, past experience, and supplier diversity participation, using a trade-off approach rather than lowest price technically acceptable. Contractors must meet outreach goals of 20% MBE, 10% WBE, and 3% SDVOB participation, with all subcontractors required to be Port Authority-certified and perform a commercially useful function; pass-through arrangements are prohibited. The contract imposes strict non-transferability and non-delegation clauses, requires immediate disclosure of conflicts of interest, and mandates compliance with audit rights, integrity monitoring, and record access provisions. Invoicing must be submitted electronically via the Port Authority’s required system, referencing the taxpayer identification number and purchase order, though specific