Cybersecurity Assessment, Compliance, & Governance Services

City of Norcross
Information Technology Department
REQUEST FOR PROPOSALS
CYBERSECURITY ASSESSMENT, COMPLIANCE,
& GOVERNANCE SERVICES
RFP 26-10
1

City of Norcross
Information Technology Department
REQUEST FOR PROPOSALS
CYBERSECURITY ASSESSMENT, COMPLIANCE, & GOVERNANCE
SERVICES
RFP IT 26-10
The City of Norcross Information Technology Department is seeking competitive
proposals from qualified cybersecurity consulting firms to assess our current security posture,
develop a comprehensive security and compliance framework, and deliver tailored training to
our personnel. The ideal partner will help us establish a sustainable, self-sufficient cybersecurity
governance structure.
The proposal package should be clearly marked "RFP IT 26-10- CYBERSECURITY ASSESSMENT,
COMPLIANCE, & GOVERNANCE SERVICES" on its face and submitted by 10:00 a.m. (EST) on
July 7, 2026, to the address below. Please submit two printed copies and one electronic copy
(USB) of your RFP package to:
Charlene Marsh
Procurement & Capital Projects Manager
City of Norcross Public Works Department
345 Lively Avenue
Norcross, GA 30071
Both printed and electronic copies must contain the same information. Return address must be
clearly marked on the outside of the proposal packet.
There will be an optional pre-proposal meeting for this solicitation on June 26, 2026, at 10:00
a.m. at Norcross City Hall (65 Lawrenceville Street Norcross, GA 30071).
Please submit questions/requests via e-mail only to procurement@norcrossga.net by 5:00
p.m. (EST) on June 29, 2026. Questions and answers will be posted in an addendum on the
City Website.
No proposal will be received or accepted after the above specified date and time.
Submissions received after the designated date and time will be deemed invalid and
returned unopened to the firm.
No proposal may be withdrawn within thirty (30) days after the proposal deadline. Requests
for withdrawals must be submitted in writing. All proposals shall remain firm for 90 days after
the submission deadline.

1. INTRODUCTION
The City of Norcross is seeking competitive proposals from qualified cybersecurity
consulting firms to assess our current security posture, develop a comprehensive
security and compliance framework, and deliver tailored training to our personnel. The
ideal partner will help us establish a sustainable, self-sufficient cybersecurity
governance structure. The project will ultimately result in the development of federally
compliant cybersecurity policy infrastructure designed for the City of Norcross
cybersecurity goals. Consultants' proposals with verifiable grant-funded security
projects and experience in conjunction with NIST-aligned frameworks in local
municipalities will be given strong consideration. The selected consultant must align
itself with Georgia's state cybersecurity plan, coordinated with the Georgia Technology
Authority (GTA) and State and Local Cybersecurity Grant Program (SLCGP) Objective 1.
2. BACKGROUND
The City of Norcross is home to over 19,000 residents. The city currently employs
approximately 150 full-time and part-time employees across 12 departments, including
E-911 Dispatch and Norcross Police. Norcross Power, the city's utility company,
provides power to approximately 5,500 residential and commercial customers. The City
of Norcross Information Technology Department and Main Distribution Frame (MDF)
are housed in City Hall, connecting the multiple city buildings along with our co-location
via a distributed WAN environment.
3. PROJECT DESCRIPTION
This project will ultimately result in the development of federally compliant
cybersecurity policy infrastructure designed for the City of Norcross cybersecurity goals.
Consultants' proposals with verifiable grant-funded security projects and experience in
conjunction with NIST-aligned frameworks in local municipalities will be given strong
consideration.
The selected consultant must align itself with Georgia's state cybersecurity plan,
coordinated with the Georgia Technology Authority (GTA) and State and Local
Cybersecurity Grant Program (SLCGP) Objective 1.
The proposal must align the City of Norcross with the governance standardization that
incorporates CIS 18 Critical Controls and the NIST Risk Management and Cybersecurity
Frameworks.
The selected consultant must also perform the following tasks:
* Conduct a cybersecurity risk assessment across all City of Norcross departments.
* Develop a comprehensive cybersecurity plan in the identification, protection,
detection, response and recovery of data.
* Present a cybersecurity resiliency roadmap with incorporated deliverables and
milestones towards a security strategy that places prioritization on Norcross's
objectives.

* Provide Norcross with increased and enhanced cybersecurity controls for
increased visibility and management while strengthening the city's overall
security posture.
* Norcross' primary goal is the establishment of an effective Zero Trust
infrastructure that will align with ever-changing threats to our municipality.
* Integrate and support the following cybersecurity elements including:
Element 1 - Information Systems Management
o
Element 2 - Network Monitoring
o
Element 3 - Continuous Vulnerability Assessment
o
Element 4 - Adoption of Best Security Practices
o
Element 5 - Continuity of Operations
o
Element 6 - Threat Indicator Sharing
o
Element 7- Leverage of CISA services
o
Element 8 - IT/OT Modernization
o
Element 9 - Risk & Threat Strategy
o
4. SCOPE OF SERVICES
Phase 1: Risk Assessment & Gap Analysis
Deliverable: Risk and compliance assessment report
* Evaluate our existing cybersecurity policies, procedures, and controls.
* Assess our current compliance to ensure alignment with relevant frameworks such
as National Institute of Standards and Technology Cybersecurity Framework (NIST
CSF)/ Health Insurance Portability and Accountability Act (HIPAA)/ Criminal Justice
Information Services (CJIS)/ ISO 27001.
* Conduct analysis to identify deficiencies and potential exposure to the network and
databases based upon previous penetration test results provided by the City of
Norcross to the selected contractor upon signed Memorandum of Understanding
(MOU).
* Provide clear guidance and clarification regarding cloud-based platforms in
conjunction with necessary security frameworks.
Phase 2: Policy & Framework Development
Deliverable: Policy recommendations report
Develop comprehensive, tailored cybersecurity policies covering:
* Access control and identity management (including Multi-Factor Authentication).
* Data protection, privacy, and secure cryptographic storage (at rest and in transit).
* Incident Response (IR) and Business Continuity / Disaster Recovery (BC/DR)
planning.
* Vendor and third-party risk management
Phase 3: Training & Implementation Support
Deliverable: Training roadmap and framework mapping chart
* Deliver targeted cybersecurity awareness training for general end-users.
* Provide advanced operational training for IT staff.

* Train-the-Trainer Model: Establish an internal capability by equipping designated
personnel to deliver ongoing cybersecurity education within their respective
departments.
* Deliver an actionable roadmap and framework mapping chart ensuring clear linkage
between policy components and organizational goals
5. SCHEDULE OF EVENTS
Release of RFP June 18, 2026
Optional Pre-Proposal Meeting June 26, 2026 (10:00 a.m. EST)
Deadline for Written Questions June 29, 2026 (5:00 p.m. EST)
Proposals Due July 7, 2026 (10:00 a.m. EST)
Proposal Evaluation July 2026
Contract Award August 2026
6. RESTRICTIONS ON COMMUNICATIONS WITH STAFF
All questions about this RFP should be sent to procurement@norcrossga.net. Please
include the company name and the referenced RFP section in the following format:
Company Name
1. Question
Citation of relevant section of the RFP
2. Question
Citation of relevant section of the RFP
7. SUBMISSION GUIDELINES & INSTRUCTIONS
Firms must submit two paper copies and one USB copy of the proposal. A complete
submission includes the following components:
Cover letter/Executive summary
Proposals should include a cover letter introducing the financial
institution, indicating understanding of the scope of services requested,
and highlighting key aspects of the proposal. Provide an overview of the
firm's operations, management, and customer service philosophies.
Background
* Firm name, address, telephone numbers, and email addresses
* Years in business under present name and names and dates for
previous names (if applicable)
* List of all parent or subsidiary companies
Qualifications
* Describe experience with providing requested services to

municipal governments within past 3 years
* Resumes of proposed account representative and all proposed
personnel assigned to the City of Norcross
Response to Scope of Services
Please provide a summary of your firm's offerings for each of the
services listed in Section 4, Scope of Services.
Implementation Approach and Plan
Please clearly identify each phase, proposed timeline, and proposed roles to be
performed. This section should include:
* Description of implementation approach by phase
* List and description of all implementation deliverables
* Outline of roles and responsibilities of City of Norcross staff during the
implementation
References Form
Submission may be accompanied by a reference form containing at least
4 references (attached in Appendix B) OR a minimum of 3 letters of
reference. References must be for projects of similar size and scope.
Acknowledgement of Addenda
Attached as Appendix D
Certificate of Liability Insurance
Insurance requirements detailed in "General Conditions" section.
E-Verify Contractor & SAVE Affidavits (with required documentation)
Draft Contract Agreement
Cost Proposal
Cost proposal form is attached in Appendix C and must be submitted in
a sealed envelope.
EVALUATION CRITERIA
The proposal evaluation will be made on the following criteria:
Evaluation Criteria Max Score
Experience & Qualifications 20
Proposed Approach & Timeline 20
Training & Capacity Building 20
References 10
Cost Proposal 30
Local Firm Credit (Bonus) 5
Total 105

Experience & Qualifications - Experience and qualifications of the team personnel, as
demonstrated by resumes, organizational chart, and other information provided. Experience of
the firm in executing successful and relevant projects including other city-wide safety action
plans.
Proposed Approach & Timeline - Evidence of thorough understanding of the project scope,
quality and detail of the proposed approaches to the completion of the required tasks.
Evidence of team's capacity and availability to provide the proposed services in a timely
fashion. Evidence of ease of use and security.
References - Quality and relevance of references, as well as responsiveness of references
contacted by City staff.
Local Firm-Businesses with a current and valid City of Norcross Business License shall receive a
'local firm' credit of 5 points added to their technical (pre-cost proposal) score. Businesses with
a valid business license within the boundaries of Gwinnett County or another Gwinnett County
city will receive a credit of 2.5 points.
Cost Proposal- The cost proposal will not factor into the committee's evaluation of the
technical proposal. Scores will be determined by weights assigned based on proposed cost.
The City of Norcross reserves the right to interview top-scoring firms.
GENERAL CONDITIONS
PROPOSERS ARE ADVISED TO THOROUGHLY UNDERSTAND THE GENERAL CONDITIONS AND
SPECIAL PROVISIONS, PRIOR TO SUBMITTING THEIR PROPOSALS.
I. QUALIFICATIONS
A. Proposals will be considered only from experienced and well-
equipped Vendor(s) engaged in work of this type and magnitude.
B. Proposers may be required to submit evidence setting forth
qualifications which entitle their company for consideration as a
responsible Vendor. A list of work of similar character successfully
completed within the last five years may be required, which lists the
location, size, and scope for use on this work. Before accepting any
proposals, the City may require evidence of the Vendor's financial
ability to successfully perform the work to be accomplished under the
contract.
C. Proposers must provide their own materials for this contract.
D. Liability Insurance: During the term of the Agreement, Contractor shall, as its

sole expense, secure and maintain in-force policies of insurance of the
following types:
1. Workers' compensation coverage in accordance with the statutory
requirements of the jurisdiction in which Services are to be performed.
2. Employer's liability insurance with a minimum of $250,000.
3. Comprehensive General Liability Insurance, subject to a limit for bodily
injury and property damage combined at least $1,000,000 aggregate.
4. Automobile liability insurance subject to a limit for bodily injury and
property damage combined, of at least $1,000,000 per occurrence.
E. Contractor shall furnish Client Certificates of Insurance evidencing the
insurance coverages required. The certificates shall stipulate that should any of
the above insurance policies be cancelled before the termination of this
agreement, the issuing company will endeavor to mail thirty (30) days' written
notice to Client.
II. AUTHORITY TO SIGN
A. Proposers must ensure that the legal proper name of their firm
and/or corporation is printed or typed as appropriate on all
documents.
III. RIGHTS RESERVED
A. The City of Norcross reserves the right to reject any or all proposals, to waive
informalities or to re-advertise. It is understood that all proposals are made
subject to this agreement, and that City of Norcross reserves the right to
decide which proposal(s) it deems the most qualified. In arriving at this
decision, full consideration will be given to the experience and qualifications
of the Proposer, work of this type successfully completed and past
performance with the City of Norcross.
B. Proposers are advised to examine the site(s) of the proposed work, as are
necessary, to familiarize themselves with location conditions, which may
affect the proposed work. Proposers are also advised to fully inform
themselves regarding conditions under which the work will be performed.
The City of Norcross will not be responsible for the Proposer's errors or
misjudgment, nor for any information on location conditions or general laws
and regulations.
C. Latest Financial Statements, certified audit, if available, prepared by an
independent certified public accountant, or other financial documents or

reporting may be requested by City. If requested, such statements must be
provided within five (5) business days, or the bid proposal will be rejected.
D. Any unauthorized additions, conditions, limitations, or provisions attached to
the Proposal shall render it informal and may be cause for rejection.
IV. AWARD OF CONTRACT
A. The contract will be awarded to the most qualified firm whose proposal will
provide the best value and be the most advantageous to the City,
experience, technical considerations, cost, and other factors considered. The
City is to make the determination.
B. Prior to award of the Contract, the successful Proposer will be
required to submit a schedule to the City, demonstrating the
Proposer's ability to commence and proceed in a timely manner. A
Proposer's failure to demonstrate the ability to proceed as required
may result in contract cancellation.
C. Failure to demonstrate the ability for contract execution and
progression will result in, at the City's discretion, contract
cancellation or re-advertising of any and/or all these contracts.
D. Prior to execution of a Contract, a Utility Coordination Meeting
may be required between Vendor(s), utility agencies and City of
Norcross Public Works to ensure clarity and commitments
concerning inter-related work schedules.
V. PRODUCTION REQUIREMENTS
A. Time is of the utmost importance of this project. The successful Proposer will be
required to commence work within ten (10) calendar days from the receipt of
the Notice to Proceed and must carry on with utmost diligence to complete the
work according to the specifications in the RFP.
VI. LOCATION AND SITE(S)
A. All work is within City limits of the City of Norcross, Georgia.
B. The Vendor shall accept the site(s) in its present condition and carry out all work
in accordance with the requirements of the specifications as indicated in this RFP.
C. The Vendor is responsible for the location of above and below ground utilities
and structures, which may be affected by the work.
VII. NON-COLLUSION

A. Vendor(s), by submitting a proposal, certify that the accompanying
proposal is not the result of, or affected by, any unlawful act of collusion
with any other person or company engaged in the same line of business
or commerce, or any other fraudulent act punishable under Georgia or
United States law.
VIII. MATERIALS
A. Unless otherwise specified in the Contract, Vendor shall provide and
assume full responsibility for all services, materials, equipment, labor, and
all other facilities and incidentals necessary for the completion of the
Work.
B. All materials and equipment incorporated into the work shall be of good
quality, except as otherwise provided in the Contract. All special
warranties and guarantees required by the Specifications shall expressly
run to the benefit of the City.
IX. CONTRACT REQUIREMENTS
The successful Vendor is required to do the following within ten (10) days of Notice:
A. Return to the City contract documents executed by the authorized
representative attested by the corporate secretary treasurer.
B. Provide Insurance Certificates as specified in the RFP
documents.
C. Failure to execute the Contract or furnish satisfactory proof
of carriage of the insurance required within ten days after
the date of Notice of Award of the Contract may be just
cause for the annulment of the award and for the forfeiture
of the RFP guaranty of City of Norcross, not as a penalty, but
as liquidation of damages sustained. At the discretion of the
City, the award may then be made to the next most qualified
Vendor, or the work may be re-advertised or constructed by
City forces.