Cybersecurity Risk Assessment — Water and Wastewater Systems

The City of Ogdensburg (“City”) is requesting proposals from qualified firms to perform a comprehensive cybersecurity risk assessment of the City’s municipally owned drinking water system and wastewater (sewer) system (collectively, the “Systems”). This Request for Proposals (“RFP”) is issued in connection with, and is intended to satisfy the deliverable requirements of, the New York State Environmental Facilities Corporation (“EFC”) SECURE Program Assessment Grant awarded to the City for the 2026 SECURE Grants pilot year.

The City intends to engage a single qualified vendor (the “Consultant”) to assess both Systems under one contract.

The selected Consultant shall furnish all labor, supervision, materials, and expertise necessary to perform a cybersecurity risk assessment of the City’s water system and wastewater system, and to prepare the deliverables described below.

• **Task 1 — Project Initiation and Data Collection:** Conduct a kickoff meeting with City staff (City Manager, Director of Public Works, and relevant water/wastewater operations staff) to confirm scope, points of contact, and system access.
• **Task 2 — Current Profile: Risk and Vulnerability Assessment:** Perform an on-site and/or remote technical and administrative assessment of both Systems using NIST CSF 2.0 and CIA Triad methodology across all six core functions (Govern, Identify, Protect, Detect, Respond, Recover).
• **Task 3 — Target Profile and Regulatory Gap Analysis:** Develop a NIST CSF 2.0 “Target Profile” for each System [...] Perform a gap analysis comparing the Current Profile to the Target Profile, with each identified gap cross-referenced to the specific DEC and/or DOH regulatory provision it relates to.
• **Task 4 — Prioritized Remediation and Implementation Roadmap:** Develop a specific, prioritized list of remediation actions necessary to close identified gaps and achieve DEC/DOH regulatory compliance, organized by priority (e.g., immediate/high, near-term, long-term) and by NIST CSF 2.0 function.
• **Task 5 — Deliverables:** Draft Cybersecurity Risk Assessment Report for City review and comment; Executive Summary of cybersecurity needs for each System; Final Cybersecurity Risk Assessment Report and Executive Summary, incorporating City comments, dated after March 1, 2026, in a form acceptable for submission to and acceptance by EFC under the SECURE Assessment Grant; and a verbal or written summary presentation of findings and the prioritized remediation roadmap to the City Manager, Director of Public Works, and City Council (or a council committee), as reasonably requested by the City.

Because the assessment will identify specific cybersecurity vulnerabilities in critical public infrastructure, the Consultant shall treat all assessment work papers, vulnerability details, and system architecture information as confidential and shall not disclose such information to any third party without the City’s prior written consent, except as required by law or as necessary to submit the Executive Summary to EFC.

Proposers must submit one (1) original, three (3) paper copies, and one (1) electronic copy (PDF, on USB drive or by email to the address below) of the complete proposal, in a sealed package clearly marked “RFP No. 2026-SECURE-01 — Cybersecurity Risk Assessment,” no later than **November 20, 2026, 4:00 PM (Eastern)**.

Proposers must submit a firm, all-inclusive, not-to-exceed price. The City will deem non-responsive any proposal with a total price exceeding **$45,000.00**.

| Evaluation Criterion | Weight |
| --- | --- |
| Firm qualifications, relevant experience, and references | 25% |
| Qualifications of key personnel assigned to the project | 15% |
| Technical approach, understanding of NIST CSF 2.0 and DEC/DOH regulatory requirements, and quality of sample deliverable | 30% |
| Proposed schedule and ability to meet City timeline | 10% |
| Cost proposal (value within the not-to-exceed budget) | 20% |

Insurance: The selected Consultant must maintain commercial general liability, professional liability (errors and omissions, including cyber liability/technology E&O), automobile liability, and workers’ compensation insurance in amounts to be specified in the final contract, and must name the City of Ogdensburg as an additional insured where applicable.

A signed cover letter must state that the proposal is valid for at least 90 days from the submission deadline. Interviews (if held): Week of December 7, 2026.