BRS Cybersecurity Services RFP

Background
The Boston Retirement System (BRS) is seeking to procure cybersecurity professional services to enhance its cybersecurity posture. BRS manages approximately $6 billion in assets and has a significant responsibility for the personal identifiable information (PII) of around 100,000 members. The agency aims to improve its incident response capabilities and overall cybersecurity maturity, particularly in light of a recent risk assessment that highlighted gaps in skills and experience.

Work Details
The contract involves two main projects: (1) reviewing and updating the existing written incident response plan (IRP) for BRS, and (2) developing and implementing two Homeland Security Exercise and Evaluation Program (HSEEP) compliant tabletop exercises (TTX). The specific tasks include:

1. Conducting a review of the current IRP documentation and making recommendations for improvements.

2. Designing a realistic tabletop exercise scenario tailored to BRS's technical environment.

3. Delivering the first tabletop exercise with up to 10 active participants, focusing on leadership processes and decision-making.

4. Evaluating the first exercise, preparing a report with findings, and implementing necessary improvements to the IRP.

5. Developing a broader incident scenario for the second tabletop exercise involving key partners.

6. Conducting the second tabletop exercise with critical partners and preparing an After Action Review (AAR) that includes an improvement plan based on feedback collected during both exercises.

Period of Performance
The project is expected to commence with a kickoff on March 10, 2025, and all work must be completed by June 30, 2025.

Place of Performance
The services will be performed at locations designated by the Boston Retirement System.