IT Policy Assessment & Development

2026-11-03

A . The successful Offeror shall be a company that has proven experience developing Information Technology policy assessment and development , Vulnerability Management policy and procedure and Incident Response Plans ( IRP ) for computing networks that rely on both on - premises and cloud - based components . The final deliverables will contain tailored recommendations that align with industry standards and regulatory compliance for staff policy governing computer - centric infrastructure , protecting the City ’ s computing environment and documentation for preparing for and responding to disruptive incidents when the City ’ s computing network is being threatened or has been compromised . The deliverables must be reviewed with legal department and adopted by Human Resources . The Offeror shall provide Citywide staff training utilizing approved policy documents . The Offeror shall understand vulnerabilities , system intrusion techniques and tools , and methods to prevent or mitigate Cybersecurity incidents . B . The Offeror will demonstrate proper application of the NIST CSF 1 . 0 framework for previous clients . C . Information Technology Policy Assessment and Development i . Establish goals and objectives . ii . Perform comprehensive assessment of existing policies or access to relevant documentation , such as existing IT policies , legal and regulatory requirements , and industry standards . iii . Identify roles and responsibilities . iv . Develop procedures that complement the policy . v . Develop / Refine AI usage policy . D . Vulnerability Management Policy and Procedure i . Establish goals and objectives of the plan . ii . Classify vulnerabilities . iii . Specify ways vulnerabilities are reported . iv . Specify methods to prioritize vulnerabilities to determine cause and mitigate . v . Identify roles and responsibilities . vi . Develop procedure that complements the policy . E . The Incident Response Plan ( IRP ) and Procedure Development shall : i . Establish goals and objectives of the plan . ii . Classify Incidents . iii . Specify ways incidents are identified and reported . iv . Specify methods to prioritize incidents to determine cause and mitigate . v . Address appropriate contact information for resources needed to resolve a given incident . vi . Provide methods to analyze incidents . vii . Address communications with internal departments and external organizations ( e . g . the media , social media , outside agencies and outside organizational contacts ). viii . Address Cyber forensics . ix . Identify roles and responsibilities . x . Identify or establish mechanisms that outside organizations can use to report incidents ...

Maryland

2026-05-02