Information Technology Managed Services Addendum 1

Request for Proposals (RFP)
Managed Information
Technology (IT) Services
Costa Mesa Sanitary District
290 Paularino Avenue
Costa Mesa, CA 92626
Release Date: March 24, 2026
Submittals Due: April 21, 2026 by 4:30 p.m.
Note: This RFP is only open to firms pre-qualified through the
Request for Qualifications process that was conducted from
2/24/26-3/23/26.
Protecting public health and the environment for current and future generations.
cmsdca.gov

INTRODUCTION
The Costa Mesa Sanitary District (CMSD) invites proposals from firms prequalified
through the Request for Qualifications (RFQ) process to provide comprehensive
managed IT services. The District intends to enter into a professional services
agreement with one qualified firm to provide remote and onsite IT support, network
administration and monitoring, cybersecurity oversight, strategic IT leadership, and
technology vendor management beginning July 1, 2026.
DISTRICT OVERVIEW
CMSD is an independent special district formed in 1944 and governed by an elected
five-member Board of Directors. It serves approximately 118,000 residents within
Costa Mesa and portions of Newport Beach and unincorporated Orange County. Core
services include residential solid waste collection, recycling, and wastewater
collection. Included in CMSD's operations are 27 employees, 2 sites located in Costa
Mesa, 224 miles of wastewater pipeline, and 20 pump stations.
CURRENT TECHNICAL ENVIRONMENT
The District's environment currently includes:
* 66 endpoints
* 23 servers (cloud/virtual and on-premises)
* Microsoft 365 tenant:
o 100 email accounts
o 41 licensed users
* 158 Active Directory users (106 enabled)
* Zoom as the unified communications platform
Detailed asset inventories and network documentation will be provided to the
selected firm. Firms may request additional information during the question and
answer (Q&A) period; however, CMSD reserves the right to withhold sensitive
information from public disclosure.
SCOPE OF SERVICES
The selected firm shall provide full-service managed IT support, including but not
limited to:
A. Helpdesk & Onsite Technical Support
* 24/7 remote technical support, including monitoring and after-hours
emergency support, and in-person, onsite technical support for a minimum of
two (2) days per week
2

o Technical support includes but is not limited to configuration and
deployment of devices (computers, laptops, tablets, printers, etc.),
software installations, diagnosis and correction of hardware and
application issues, and advanced troubleshooting.
o Weekly onsite support is required on Tuesdays. Thursday is preferred
as the second onsite day. A maximum of 2 individuals will be expected
to fulfill the onsite requirement; however, alternates are acceptable in
the event of staff absence.
o The District's business hours are Monday through Thursday from 7:30
a.m. to 4:30 p.m. and alternating Fridays from 7:30 a.m. to 3:30 p.m. PST
* Clearly defined service level agreements (SLAs) with the following as a
minimum:
o Severity 1 (Critical outage/security incident) - 15-minute response & 2-
hour target resolution
o Severity 2 (Major impairment) - 15-minute response & 4-hour resolution
o Severity 3 (Normal issue/service request) - 30-minute response & 12-
hour resolution
o Severity 4 (Low priority/minor request) - 30-minute response & 24-hour
target resolution
B. Network & Infrastructure Management
* Server administration (cloud/virtual and on-premises)
* Firewall, network device and overall network management, including:
o Implementation of necessary changes, patches, upgrades, and updates
o Routine configuration changes
o Mapping of network resources
o Adjustments to web and email filtering
o Changes to user access rights and global/group security policies
o Minor cabling
* Wireless and VPN management
* Tracking and procurement/renewal of software licensing/subscriptions, and
hardware upgrades/replacements, under CMSD staff's direction
* Endpoint lifecycle management
* Backup administration, following the 3-2-1 rule, and testing
* Internet and connectivity management
C. Cybersecurity Oversight
* Multi-factor authentication (MFA) enforcement and support
* Management of endpoint detection and response (EDR) and Security
Information and Event Management (SIEM) tools
* Minimum annual vulnerability scanning and remediations
* Security awareness training program management
3

* Incident response planning and coordination, including the development and
maintenance of a formal incident response plan
* Disaster recovery planning and testing, including annual emergency exercises
* Support of CMSD engagement in related grants and grant-funded services, such
as Cybersecurity & Infrastructure Security Agency (CISA) cyber hygiene
services upon request
* Maintained alignment with National Institute of Standards and Technology
(NIST) Cybersecurity framework
D. Strategic IT Leadership
* Biennial IT roadmap development, in coordination with CMSD staff
* Biennial operational and project budget development, in coordination with
CMSD staff
* Advisement on technology standardization, compliance, and risk mitigation,
including meetings with CMSD department staff upon request (no more than
quarterly)
* Executive-level reporting and presentations upon request (no more than
quarterly)
E. Vendor Management
* Proactive, courteous, and professional coordination with internet, phone,
security, geographic information system (GIS), audio visual (AV), copier, and
other technology vendors in support of CMSD initiatives
* Project management for IT-related initiatives
F. Communication & Record Keeping
* Professional and timely communication with CMSD staff
* Quarterly strategic planning/budget meetings and monthly project
coordination meetings with CMSD staff
* Retention of records of all support tickets, network mapping and configuration
documentation, action logs, IT asset inventories, and IT-related credentials in
an accessible and non-proprietary format
PROPOSAL REQUIREMENTS
Proposals shall be submitted as a hard copy in a sealed envelope, must be no longer
than 15 pages (excluding cover page and non-required attachments), and must
include:
1. Executive Summary
a. Brief description of proposal, highlighting understanding of CMSD
needs, proposed solutions, and unique selling propositions
4

b. Confirmation that proposal will remain valid for 60 days and firm is
available to begin work immediately
c. Authorized signature
d. Primary point of contact information
2. Scope of Services Checklist
a. Complete Attachment C titled "Scope of Services Checklist"
3. Transition Plan
a. Describe your firm's 30-day transition plan from CMSD's current
provider in detail, including the following:
i. All anticipated tasks and assignees, including environment
assessment, documentation and information transfer, and
assumption of responsibility
ii. Timeline of task deadlines
4. Staffing Plan
a. Describe the following aspects of your firm's staffing:
i. Helpdesk structure
ii. Staff locations (identify state(s) and country/ies)
iii. Escalation model and/or procedures
iv. Backup coverage plan
5. Reporting & Governance
a. If applicable, provide any guaranteed performance metrics that your
firm offers, such as guaranteed uptime threshold, Recovery Time
Objectives (RTOs) and Recovery Point Objectives (RPOs) for core
devices/services, patch management success rate, critical patch
complete time, backup success rate, customer satisfaction, etc.
b. If applicable, provide any sample security reports covering metrics like
ticket volume, response and resolution times, security alerts,
vulnerability findings and patches, etc. (not counted toward the
maximum submission page count)
6. Pricing Proposal - Provide clear pricing using the following structure:
a. Recurring Monthly Services
i. Per-user or per-device cost and total monthly cost based on the
CMSD's current number of users/devices, or total fixed monthly
cost (if applicable)
1. Monthly cost should include all elements of the scope of
services on pages 2-4; if the firm considers any elements
to be non-recurring projects, clearly identify
inclusions/exclusions in this section
5

b. Project Rates
i. Hourly rates for non-recurring projects per position level/type,
or blended rate (if applicable)
ii. Provide examples of activities defined by the firm as non-
recurring projects
c. One-Time Transition Costs (if applicable)
d. Optional Services (if applicable)
i. List any additional services not included in the scope and
corresponding costs (e.g. security enhancements, advanced
monitoring, additional onsite support, or other specialized
services provided strictly by the firm itself). NOTE: it is not
required to list 3rd party licensing and subscription costs.
7. Cybersecurity Insurance
a. Firm is not required to provide this, but if applicable, include
cybersecurity or any supplemental coverage offered to clients and any
related costs
TRANSITION REQUIREMENTS
If selected, the firm shall:
* Coordinate with outgoing provider to obtain any necessary information,
including required credentials and access management
* Conduct complete environment assessment to validate information provided,
including backups and disaster recovery processes
o Document any areas that are not documented and/or re-document if
necessary
o Recommend disposal of any unused or redundant hardware
* Implement 30-day transition plan after contract execution to ensure business
continuity
Transition period: June 1 - June 30, 2026
Service commencement: July 1, 2026
CONTRACT TERM
The anticipated contract term is five (5) years. The agreement will be subject to
biennial budget appropriations and will be subject to Board approval.
BUSINESS LICENSE
Prior to being awarded the contract, the selected firm must procure a valid business
license from the City of Costa Mesa.
6

EVALUATION CRITERIA
Contract award shall be based on a "best value" evaluation. Criteria used for the
evaluation will include:
* Technical approach and understanding
* Staffing and service model
* Pricing and cost structure
* Public agency experience and references
* Implementation readiness and ability to provide services
While cost is a significant factor during the evaluation process, RFPs will be evaluated
according to all of the listed criteria.
SCHEDULE
Request for Proposals (RFP) Public Release & Start of 3/24/26
Question & Answer (Q&A) Period
Site Visits 4/2/26 - 9 a.m. & 2 p.m.
Q&A Submission Deadline 4/7/26 @ 4:30 p.m.
Q&A Response Deadline 4/14/26
Proposal Submission Deadline 4/21/26 @ 4:30 p.m.
RFP Evaluation Period 4/22/26 - 5/1/26
Notification of Selected Firm & Agreement Preparation 5/4/26 - 5/15/26
Onboarding & Transition Period 6/1/26 - 6/30/26
Start of Contract 7/1/26
SUBMITTAL INSTRUCTIONS
Submit one (1) printed, hard copy proposal in a sealed envelope to the address below.
The envelope must clearly display the firm's name and return address.
Costa Mesa Sanitary District
290 Paularino Avenue
Costa Mesa, CA 92626
Attention: Gina Terraneo
Additionally, e-mail a PDF copy to gterraneo@cmsdca.gov.
Submittals must be received by CMSD on or before 4:30 p.m. on April 21, 2026. Late
submissions will not be accepted.
7

COMMUNICATIONS/QUESTIONS/ADDENDA
All communications regarding this RFQ must be submitted in writing to CMSD's
designated contact:
Gina Terraneo, Senior Management Analyst
Email: gterraneo@cmsdca.gov
Questions related to this RFP must be received no later than April 14, 2026. CMSD may
respond to questions at its sole discretion. Questions received after the deadline may
not be answered.
Addenda
If CMSD determines that a change to the RFP is necessary, CMSD will issue a written
addendum. Only written addenda issued by CMSD are binding. Oral communications,
interpretations, or informal responses by any CMSD representative are not binding
and shall not be relied upon by respondents.
No-Contact Requirement
Respondents and their representatives shall not contact CMSD Board Members, staff,
consultants, or agents regarding this RFP, except through CMSD's designated contact
listed above. Violation of this requirement may result in disqualification of the
respondent at CMSD's sole discretion.
DISTRICT RIGHTS
CMSD reserves the right to:
* Reject any or all proposals
* Waive minor irregularities
* Request clarifications
* Negotiate terms
* Cancel the RFP at any time
ATTACHMENTS
* A - District Insurance Requirements
* B - Sample Agreement
* C - Scope of Services Checklist
8