About this opportunity
AI summaryThe Contra Costa County Employees' Retirement Association seeks proposals for cybersecurity governance and risk management services. The selected vendor will deliver an incident response plan covering event definitions, severity levels, notification rules, and external coordination, as well as facilitate a tabletop exercise and develop a risk-based third-party risk management program. Eligible respondents must be professional firms whose primary line of business includes the requested services, possess all required permits and business licenses, and ensure assigned personnel sign confidentiality agreements. Interested organizations may submit proposals for the complete scope or partial items. Questions are due in writing to [email protected] by 5:00 p.m. on November 5, 2026. Final proposals, including an electronic copy submitted via email, are due no later than 5:00 p.m. on December 3, 2026. The evaluation committee will evaluate proposals based on understanding of the required services, background and experience of assigned personnel, and pricing proposals.
Buyer and opportunity details
- Client
- Contra Costa County Employees' Retirement Association
Scope of work
- Development of cybersecurity policies aligned with NIST SP 800-53 Rev. 5 control families, including document map and maintenance schedule
- Formalization of an Incident Response Plan and development of role-based incident response training
- Planning and facilitation of an incident response tabletop exercise and provision of an after-action report
- Development of a risk-based third-party risk management program
- Security assessments of up to six critical vendors
- Optional on-call incident response support during the contract term
How proposals are evaluated
| Criterion | Weight / scoring |
|---|---|
| Understanding of the services required | Not specified |
| Quality, clarity and responsiveness of proposal | Not specified |
| Proposed fees | Not specified |
| Information provided by client references | Not specified |
| Demonstrated competence and professional qualifications necessary for successfully performing the work required | Not specified |
| Background and related experience of the principal individuals to be assigned to provide services | Not specified |
| Interviews, if conducted | Not specified |
Minimum qualifications
- Professional firm whose primary line of business includes providing the specified services
- In existence as a business entity performing such services for a minimum of five (5) years
- Possess all necessary permits and licenses to perform the requested service
- Bonded where applicable
- Assigned personnel must have completed a background check
- Sign a confidentiality agreement before work begins
Documents to include with your response
- Cover letter signed by an authorized officer
- Executive summary
- Description of the respondent firm
- At least three (3) client references
- Copies of pertinent licenses (e.g., Business License)
- Standard professional services contract
- Proposed work plan and timeline with deliverables
- Pricing proposal with billing practices and payment terms
- Explanation of actual or potential conflicts of interest
- Description of past, pending, or threatened litigation and proceedings
Key dates
- Issue Date
- October 22, 2026
- Questions due
- 5:00 p.m. on November 5, 2026
- Answers shared with respondents
- November 12, 2026
- Proposals due
- 5:00 p.m. on December 3, 2026
How to submit
- Method
- Sealed hard copy and email
- Instructions
- Submit three (3) printed copies in a sealed package to CCCERA in Concord, CA, and one electronic copy via email to [email protected].
Contract details
- Term
- One-time engagement, except for any optional incident response support selected
- Insurance and bonding
- The selected firm must be bonded where applicable.