Incident Response, Recovery, and Cybersecurity Capacity Building Services

Location:	California
Posted:	Oct 26, 2026
Due:	Nov 17, 2026
Agency:	Marina Coast Water District
Type of Government:	State & Local
Category:	C - Architect and Engineering Services - Construction
Publication URL:	To access bid details, please log in.

Attachment Preview

REQUEST FOR PROPOSALS FOR INCIDENT RESPONSE, RECOVERY, AND

CYBERSECURITY CAPACITY BUILDING SERVICES

Marina Coast Water District

RFP No.: MCWD-IRRCA-2026

Issue Date: October 27, 2026

Proposal Due Date: November 17, 2026

Proposal Due Time: 5:00 PM Pacific Time

1. INTRODUCTION

Marina Coast Water District (MCWD or District) is requesting proposals from qualified

cybersecurity consulting firms to provide Incident Response, Recovery, and Cybersecurity

Capacity Building Services.

The primary purpose of this engagement is to develop, validate, and strengthen a practical

Cybersecurity Incident Response and Recovery Plan for MCWD while improving the internal

knowledge and readiness of District personnel.

Capacity building is the central objective of this project.

The District is not seeking a consultant that will simply prepare a plan and submit a final report.

The selected consultant will be expected to work collaboratively with District personnel

throughout the engagement so that staff understand how to recognize, report, escalate,

manage, communicate during, and recover from cybersecurity incidents.

The desired outcome is both:

- A practical and usable Cybersecurity Incident Response and Recovery Plan; and

- District personnel who understand how to use, maintain, test, and improve the plan

after completion of the consulting engagement.

2. BACKGROUND

Marina Coast Water District provides essential water, wastewater, recycled water, and related

public services. Continued availability of information technology, operational technology,

communications, data, and business systems is important to the District's ability to provide

mission-critical services.

Cybersecurity incidents have the potential to affect:

- Administrative operations

- Financial and business systems

Page 1 of 38

- Communications

- Information technology systems

- Operational technology and SCADA

- Data availability, confidentiality, and integrity

- Continuity of District operations

MCWD continues to strengthen its cybersecurity program through several coordinated

initiatives.

At the time of issuance of this RFP, the District has an ongoing cybersecurity audit and

penetration testing engagement intended to identify technical vulnerabilities, security control

gaps, network and system risks, and areas requiring remediation.

This RFP is not intended to duplicate the ongoing cybersecurity audit or penetration testing

activities.

Instead, this engagement will focus on the District's ability to prepare for, respond to, recover

from, and learn from cybersecurity incidents.

When available and appropriate, MCWD may provide relevant findings from the ongoing

cybersecurity audit, penetration testing, prior assessments, or other cybersecurity initiatives to

the selected consultant. Those findings may be used to support:

- Incident response planning

- Recovery planning

- Development of incident playbooks

- Staff training

- Tabletop exercise development

- Corrective action planning

- Identification of future incident response and recovery improvements

The selected consultant shall use existing findings where practical rather than repeating

technical testing already being performed through another District engagement.

3. PROJECT PURPOSE AND OBJECTIVES

The purpose of this engagement is to improve MCWD's cybersecurity incident response and

recovery capability through development of procedures, staff participation, training, exercises,

and knowledge transfer.

The selected consultant shall assist MCWD in:

- Evaluating current incident response readiness.

- Identifying gaps in incident response and recovery capabilities.

- Developing or updating a practical Cybersecurity Incident Response and Recovery Plan.

- Establishing clear incident response roles and responsibilities.

- Establishing incident classification and escalation procedures.

Page 2 of 38

- Developing practical incident response playbooks.

- Improving internal and external cybersecurity incident communications.

- Improving coordination with vendors, insurers, public agencies, and other outside

resources.

- Improving staff understanding of cybersecurity logs, alerts, and incident information.

- Improving recovery procedures associated with cybersecurity incidents.

- Training District personnel on incident response and recovery procedures.

- Conducting a cybersecurity tabletop exercise.

- Documenting lessons learned and corrective actions.

- Incorporating significant tabletop findings into the final plan.

- Transferring sufficient knowledge so District personnel can maintain and improve the

plan following project completion.

- Providing concise recommendations for future improvements directly related to

incident response and recovery.

4. CAPACITY-BUILDING REQUIREMENT

Capacity building shall be integrated throughout the engagement and shall not be limited to a

single training session at the end of the project.

The consultant shall perform the work collaboratively and actively involve appropriate District

personnel. Capacity-building activities should include, as appropriate:

- Staff interviews

- Facilitated working sessions

- Scenario discussions

- Review of existing procedures

- Development of roles and responsibilities

- Development of response playbooks

- Demonstrations using existing District systems where appropriate

- Practical staff training

- Tabletop exercises

- After-action discussions

- Final knowledge-transfer activities

The consultant shall explain not only what actions should be taken, but also why those actions

are important.

Throughout the engagement, District personnel should develop a better understanding of:

- How to recognize a potential cybersecurity incident

- How to report an incident

- How incidents should be classified

Page 3 of 38

- When an incident should be escalated

- Who has responsibility for specific actions

- What information should be collected

- How logs and alerts may assist incident response

- When a system may need to be isolated

- How containment decisions are made

- How recovery priorities are established

- When outside technical assistance may be required

- How vendors should be involved

- How management should be notified

- How internal and external communications should be coordinated

- How actions and decisions should be documented

- How lessons learned should be incorporated into future procedures

The project should strengthen MCWD's internal ability to coordinate cybersecurity incidents

while recognizing that specialized outside assistance may still be required for significant or

complex events.

5. RELATIONSHIP TO ONGOING CYBERSECURITY AUDIT AND PENETRATION TESTING

MCWD currently has an ongoing cybersecurity audit and penetration testing engagement. The

selected consultant shall avoid unnecessary duplication of that work.

This RFP does not include:

- Penetration testing

- Red-team testing

- Vulnerability scanning intended to duplicate existing testing

- Exploitation of identified vulnerabilities

- Comprehensive network penetration testing

- Comprehensive application penetration testing

- Reperformance of technical assessments already being completed

- Independent technical audits already being conducted through another District

engagement

Relevant findings from the ongoing audit and penetration testing may be provided to the

selected consultant when appropriate. The consultant shall evaluate relevant findings from an

incident response and recovery perspective. For example, the consultant may consider:

- How MCWD would recognize an incident involving the identified weakness

- Who should be notified

- What procedures should be followed

- What information should be collected

- Whether isolation or containment may be required

Page 4 of 38

- What operational impacts should be considered

- What recovery procedures should be followed

- What staff training may be needed

- What corrective action should be considered

The purpose is to make existing cybersecurity findings actionable from an incident response

and recovery standpoint without repeating the technical testing.

6. TECHNOLOGY IMPLEMENTATION LIMITATION

This engagement is primarily a planning, preparedness, capacity-building, training, exercise, and

knowledge-transfer project.

The selected consultant is not expected to procure or deploy major cybersecurity platforms,

hardware, software, or managed security services as part of this engagement.

Major implementations outside the intended scope include, but are not limited to:

- Deployment of a new Security Information and Event Management platform

- Implementation of a new Managed Detection and Response service

- Deployment of a Security Operations Center

- Major firewall replacement

- Major network redesign

- Major network segmentation implementation

- Enterprise-wide encryption deployment

- Enterprise Data Loss Prevention deployment

- Major endpoint security replacement

- Major SCADA cybersecurity implementation

- Procurement of major cybersecurity appliances

- Long-term managed cybersecurity services

The consultant may provide limited guidance, demonstrations, or hands-on assistance involving

systems the District already owns when directly related to staff training, incident preparedness,

knowledge transfer, validation of procedures, or review of existing capabilities.

Examples may include:

- Demonstrating how to review existing security logs

- Reviewing existing alert information

- Showing staff where cybersecurity information can be found

- Demonstrating how incident information may be collected

- Reviewing existing backup and recovery procedures

- Demonstrating existing security dashboards or tools

Page 5 of 38

This is the opportunity summary page. It provides an overview of this opportunity and a preview of the attached documentation.

Incident Response, Recovery, and Cybersecurity Capacity Building Services

Attachment Preview

See also