Cleveland Metroparks Cybersecurity Services

Background
Cleveland Metroparks is a governmental agency in Ohio, comprising over 25,000 acres and various facilities including parks and a zoo. Its mission is to protect nature, connect communities, and inspire conservation. The agency is seeking proposals for Cybersecurity Services to enhance its security posture and meet compliance obligations. The contract will be for three years with an option to renew for one additional year at Cleveland Metroparks' discretion.

Work Details
The selected vendor will provide a comprehensive, fully managed cybersecurity program that includes:

1) Cybersecurity Assessment & Dynamic Roadmap - Conducting assessments and producing a roadmap with milestones;

2) Penetration Testing - Internal and external testing using various techniques;

3) Vulnerability Scanning & Management - Ongoing scanning with risk-based prioritization;

4) Tabletop Exercises - Conducting two annual exercises with actionable reports;

5) Security Awareness Training - Utilizing the KnowBe4 platform for employee training;

6) Compliance Monitoring - Continuous monitoring of controls across core platforms;

7) Incident Response Services - Supporting investigation and recovery efforts during cybersecurity incidents;

8) Reputation & Brand Exposure Monitoring - Monitoring for credential leaks and brand misuse;

9) Program Governance & Playbook Development - Establishing management frameworks and documentation;

10) Aligning with Cyber Insurance Requirements - Maintaining controls mapped to insurance conditions.

Period of Performance
The contract period is three years starting from May 2026, with an option to renew for one additional year.

Place of Performance
Services will primarily be performed at Cleveland Metroparks' main location at 4101 Fulton Parkway, Cleveland, OH, as well as across its 45 physical locations.

Bidder Requirements
Proposers must demonstrate experience in cybersecurity services, including familiarity with NIST standards. They should provide evidence of financial stability, relevant certifications (such as OSCP or CISSP), and a commitment to diversity and sustainability initiatives. Additionally, vendors must have the capability to work with CJIS certified personnel due to the presence of the Cleveland Metroparks Police Department.