Cybersecurity Consulting and Assessment Services for the City of Cortland Water and Wastewater Infrastructure

Request for Qualifications (RFQ) – Cybersecurity Consulting and Assessment Services for the City of Cortland Water and Wastewater Infrastructure BACKGROUND & SCOPE OF WORK The City of Cortland is seeking consulting services in connection with funding received through the New York State Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements (SECURE) Grant Program. The grant provides a total award of $50,000.00, with $25,000.00 allocated to each facility. The purpose of this project is to strengthen the cybersecurity posture of the City’s critical water and wastewater infrastructure and assist the City in implementing applicable New York State cybersecurity regulations, minimum standards, and best practices. The selected consultant will be tasked with providing comprehensive services, including: Risk Assessment & Penetration Testing: Evaluating operational technology (OT) and information technology (IT) environments to identify potential security gaps and test system resilience. Network Review & Asset Inventory: Conducting a full audit of network configurations, connected devices, and critical digital infrastructure across both treatment facilities. Compliance Roadmap: Developing a structured plan to ensure ongoing alignment with state and federal cybersecurity guidelines and the NIST framework. RFQ REQUIRED INFORMATION & FORMAT · Firm Summary/Profile: Name, address, primary contact person, and a brief description of the firm. · Relevant Qualifications and Experience: A description of the firm’s experience providing cybersecurity assessment and consulting services, particularly for municipal governments, critical infrastructure, drinking water systems, wastewater systems, IT environments, and OT environments. · Resumes of key staff that will be assigned to work on the project. · Specific deliverables and services to be provided for each facility, with documentation of services or deliverables not included. · Any assumptions or limitations associated with the proposed scope. · Insurance Information: Provide evidence of appropriate professional insurance coverage. · Three (3) client references. · M/WBE certification, if applicable. An electronic copy of the complete RFQ, supporting reference documents, and any issued addenda can be obtained via download from the City of Cortland ’s website: www.cortlandny.gov/Bids M/WBE and Section 3 firms are strongly encouraged to submit proposals. Questions regarding any part of the RFQ must be submitted in writing via e-mail to Randi Mowry, [email protected]. no later than September 10th, 2026, 12:00 PM (Noon) SUBMISSIONS DUE – September 25, 2026, 12:00 PM (Noon) EVALUATION CRITERIA All proposals received will be evaluated and ranked by City staff according to the following criteria: Evaluation Criteria Points Relevant Qualifications & Experience 30 Clearly Defined Description of Deliverables 40 References 20 Interview (if applicable) 10 Total 100 RFQ SUBMISSION REQUIREMENTS All submitted proposals will be carefully evaluated by City staff. The City reserves the right to conduct interviews with consultants selected for further consideration. The staff recommendation will be presented to the Cortland Common Council for final review and approval. Submissions Submit Proposals to: City Clerk’s Office, City Hall, 25 Court St. Cortland, NY 13045 All proposals should be clearly marked "RFQ- City of Cortland Cybersecurity Assessment” on the outside. Submission of one (1) hard copy is required and may be delivered by mail or in person and must be accompanied by an electronic, searchable PDF copy on a USB flash drive. Electronic copies alone will not be accepted. Any proposal received after 12:00 PM (Noon) on September 25, 2026, whether delivered in person or by postal mail, will be disqualified. The City of Cortland reserves the right to reject any or all proposals submitted. Business enterprises awarded an identical or substantially similar procurement contract within the past five years: None