Cybersecurity and Risk Management Solutions

Background
The Cosumnes Community Services District (District) is seeking proposals from qualified cybersecurity consulting firms to enhance its cybersecurity program. The District aims to strengthen its overall cybersecurity posture by progressing through the CIS Maturity model, specifically completing version 8.1 controls for Implementation Groups 1 and 2 (IG1, IG2). Additionally, the District seeks to develop a roadmap for achieving Implementation Group 3 (IG3). The District serves a population of approximately 210,000 in California's Central Valley, providing fire protection and parks and recreation services.

Work Details
The selected contractor will perform the following tasks:
1. CIS Assessment:
a. Identify all CIS Controls and Safeguards relevant to the District and assess current maturity levels.
b. Identify weaknesses and gaps in achieving IG1, IG2, and IG3 maturity levels, including required resources and costs.

2. Attain IG1 Maturity Level:
a. Identify necessary Controls and Safeguards for IG1 completion.
b. Provide a remediation strategy with due dates for closing identified gaps.
c. Offer mitigating controls for unresolvable gaps.
d. Execute mitigation tasks to achieve IG1 maturity.

3. Attain IG2 Maturity Level:
a-d: Similar tasks as outlined for IG1 but focused on achieving IG2 maturity.

4. Attain IG3 Maturity Level:
a-d: Similar tasks as outlined for IG1 but focused on achieving IG3 maturity.

5. Ad Hoc Services: The District may request additional man-hours as needed beyond the regular scope of work.

Period of Performance
The contract will commence upon award and is expected to be completed by December 15, 2026.

Place of Performance
Services will be performed at the Cosumnes Community Services District located at 8820 Elk Grove Blvd., Elk Grove, CA 95624.

Bidder Requirements
Proposers must demonstrate at least five years of experience in cybersecurity services, including asset discovery, risk assessments, penetration testing, and vulnerability management. They must also provide proof of relevant certifications in cybersecurity and comply with California Executive Order N-6-22 regarding Ukraine/Russia-related sanctions.