RFQ 25-03351 for Cybersecurity Health Checks

Background
The Commonwealth of Massachusetts, through the Executive Office of Technology Services and Security (EOTSS), is issuing this Request for Quotation (RFQ) to solicit bids from qualified ITS78 Vendors for participation in the Cybersecurity Health Check program.

The program aims to assist local government agencies in assessing their cybersecurity posture and enhancing their data protection measures. The EOTSS oversees IT policy development and implementation for over 125 state agencies, providing essential digital and security services.

Work Details
Vendors are invited to provide various cybersecurity health check services at no cost to the Commonwealth. The services include:
1. **Vulnerability Scans & Assessments**:
- AD Hygiene Assessment & Asset Report Card: Identify security defects in Active Directory configurations.
- Cloud Security Assessment: Review configurations for Microsoft 365 or other SaaS platforms.
- Data Breach & PII Liability Assessment: Summarize data breach liabilities.
- Firewall Configuration Assessment: Ensure firewall compliance with best practices.
- External Vulnerability Scan: Identify vulnerabilities from an external perspective.

2. **Process, Policy & Procedural Assessments**:
- Data Loss Prevention Assessment: Evaluate DLP software effectiveness.
- Disaster Recovery Plan Creation: Develop procedures for disaster recovery.
- IT Asset Inventory: Assist in creating an IT asset inventory template.

3. **General Services**:
- G-Suite Security Assessment: Review G-Suite security settings.
- Vendor Risk Management: Assess cloud vendor risks through external scans.

Period of Performance
The contract will commence upon award and run through June 30, 2028, with potential extensions based on mutual agreement.

Place of Performance
Services will be performed primarily within the Commonwealth of Massachusetts, specifically targeting local government agencies participating in the Cybersecurity Health Check program.

Bidder Requirements
Bidders must be current vendors on the ITS78 Statewide Contract. They are required to provide a minimum of 10 individual services throughout the program duration and adhere to privacy and data retention policies as specified by the Commonwealth.