RFP OT SCADA and IT Network Cybersecurity Assessment and Improvement Services

City of O'Fallon
OT/SCADA and IT Network Cybersecurity Assessment and Improvement Services
Request for Proposals #26-028
CITY OF O'FALLON, MISSOURI
REQUEST FOR PROPOSALS
RFP NUMBER 26-028
OT/SCADA and IT Network Cybersecurity Assessment and Improvement
Services
April 6, 2026
INCLUDED ARE:
Proposal Instructions
Terms and Conditions
Scope of Work
Proposal Form
RFP #26-028

CITY OF O'FALLON, MISSOURI
PROPOSAL INSTRUCTIONS
PURPOSE
The purpose of this Request for Proposals (RFP) is to identify and select a qualified consultant with
demonstrated expertise in Operational Technology (OT), Supervisory Control and Data Acquisition
(SCADA), and Information Technology (IT) network architecture and cybersecurity. The selected
consultant will assist the City in evaluating the current OT/SCADA and IT environments supporting critical
infrastructure and in developing recommendations to improve security, reliability, visibility, and overall
operational resilience.
This engagement is intended to occur in two phases. In the first phase, the selected vendor will perform a
comprehensive assessment of the existing OT/SCADA and supporting IT network environments, including
architecture, configurations, security controls, asset visibility, and operational dependencies. Based on this
assessment, the vendor will provide detailed findings along with prioritized recommendations, best
practices, and potential remediation strategies aligned with recognized frameworks and industry standards.
In the second phase, the City may elect to engage the selected vendor to implement some or all of the
recommended improvements. The City reserves the right to determine which recommendations will be
pursued and may authorize the vendor to perform the associated implementation work under separate scope
or task-based agreements. This phased approach is intended to ensure that recommendations are tailored to
the City's operational needs while maintaining flexibility in how and when improvements are executed.
GENERAL INFORMATION:
The City operates multiple water and wastewater facilities that rely on SCADA and other operational
technology systems for monitoring and control. The following represents the primary infrastructure
currently connected to or supporting the water and wastewater control systems.
* 1 Water Treatment Plant (WTP)
Primary drinking water treatment facility including associated SCADA control systems.
* 1 Wastewater Treatment Plant (WWTP)
Wastewater treatment and biosolids processing facility including plant-wide control systems and
instrumentation.
* 18 Wastewater Lift Stations
Pump stations used to convey wastewater through the collection system.
(A 19th lift station is scheduled to be added to a new site in the current year.)
* 4 Drinking Water Deep Well Sites
Groundwater production wells supplying the drinking water system.
These sites include a combination of:
o Booster pumping equipment
o Elevated water towers
o Ground storage tanks
o Associated instrumentation and controls.
* 6 Drinking Water Alluvial Well Sites
Shallow groundwater wells used for drinking water supply.
* 2 Drinking Water Distribution Control Vaults
Underground control vaults used for monitoring and managing water distribution system
pressures and flows.
2
RFP #26-028

(A third vault is planned for installation later this year.)
* 1 Stand-Alone Drinking Water Booster Station
Booster pump facility used to maintain distribution system pressure.
* 5 Wastewater Flow Meter Sites
Remote monitoring locations used to measure wastewater flow within the collection system.
(A sixth flow meter site is planned for installation later this year.)
* 1 Stand-Alone Elevated Water Storage Tower
In addition to the facilities listed above, the City's operational technology environment includes
supporting infrastructure such as programmable logic controllers (PLCs), remote terminal units (RTUs),
industrial networking equipment, radio and/or cellular telemetry systems, instrumentation, and SCADA
servers located within City facilities.
SCHEDULE OF ACTIVITIES
Release and advertisement of RFP: April 6, 2026
Mandatory Pre-Bid Meeting: April 24, 2026 at 1:00 P.M. CDT
Proposal submission deadline: May 12, 2026 at 12:00 P.M. CDT
PROPOSAL SUBMISSION
Sealed proposals must be received by the City of O'Fallon, Missouri; Purchasing Office, 100 North
Main Street; O'Fallon, Missouri 63366 prior to May 12, 2026, at 12:00 P.M. (prevailing central
time). Each proposal shall consist of one original (identified as such) and one electronic copy on
flash/thumb drive of the complete proposal. The file submitted on flash/thumb drive shall include
all attachments and signatures, where applicable.
It is the responsibility of the proposer to ensure that their proposal is received in the Purchasing
Office, prior to the deadline. Companies mailing proposals should allow ample mail delivery time
to ensure timely receipt of their proposals. Proposals received after the deadline for receipt of
proposals will not be opened or considered.
Proposals must be clearly identified as a proposal for the City of O'Fallon, Missouri "RFP # 26-
028 OT/SCADA and IT Network Cybersecurity Assessment and Improvement Services" and
shall show such information on the outside of the proposal packet. Proposals will not be accepted
by facsimile or email transmittal. Do not staple or submit bid in any type of binder; binder clips
are acceptable.
QUESTIONS
Questions will only be received and answered at the Mandatory Pre-Bid Meeting on April 24, 2026
at 1:00 P.M. (CDT) at City Hall, 100 North Main Street, O'Fallon, MO 63366.
AMENDMENTS TO RFP
In the event it should be necessary to revise any portion of this RFP, addenda will be provided to
all proposers who received the original RFP from the City of O'Fallon. This does not relieve the
submitting company the responsibility of regularly checking the City website listed below for
updates regarding any addenda associated with this proposal request. Addenda are available on
our website at: www.ofallonmo.gov under Bid Opportunities. If you received this RFP by means
3
RFP #26-028

other than the bid system, you must furnish your company name, address, and telephone number
to the Purchasing Agent identified in the Proposal Instructions section in order to receive any
addendum to this RFP. Proposers shall acknowledge receipt of each addendum issued in the space
provided on the RFP form.
END OF PROPOSAL INSTRUCTIONS
4
RFP #26-028

CITY OF O'FALLON, MISSOURI
TERMS AND CONDITIONS
QUALIFICATIONS:
All companies shall be licensed, insured, and bonded and shall furnish satisfactory evidence to the
City that they have previously performed/provided the types of services as specified below.
LAWS AND ORDINANCES, REGULATIONS, LICENSING FEES:
Firm shall conform to all rules, regulations, ordinances, laws, or directives set forth by the City of
O'Fallon and/or the State of Missouri.
LAW GOVERNING:
All State of Missouri and/or Federal Laws shall be hereby specifically made a part of this contract
as set forth herein.
NON-DISCRIMINATING:
The Contractor, its employees, and subcontractors, agree not to commit unlawful discrimination
and agree to comply with applicable provisions of the U.S. Civil Rights Act and Section 504 of the
Federal Rehabilitation Act, and rules applicable to each.
Firm shall comply with Section 285.525 - 285.550 RSMo regarding enrollment in a federal work
authorization program. A signed, notarized affidavit (attached) and supporting documentation
affirming enrollment in a federal work authorization program must be submitted with
proposal. Failure to comply with this provision may result in rejection of proposal.
E-VERIFY:
Company shall be E-Verify compliant and shall provide documentation to support this requirement
within the proposal including the memorandum of understanding (MOU) and the electronic
signature page completed in its entirety.
METHOD OF AWARD / SELECTION:
The proposals will be evaluated by the City. A response summary of proposals will be available
by contacting Christine Grabin, Purchasing Agent. The response summary will only include the
names of the companies that submitted proposals that were delivered by the required RFP submittal
date and time. Until award of the contract, the Responses shall be held in confidence and shall not
be available for public review.
TERMS/CANCELLATION AND DAMAGES:
This contract may be terminated by either or both parties upon thirty (30) days written notice or upon
mutual agreement of both parties.
If the City, because of the Vendor's breach, terminates this Contract, the City shall have the right to
purchase service elsewhere and to charge the Vendor with any additional cost incurred.
Notwithstanding the above, the Vendor shall not be relieved of any liability to the City for damages
sustained by the City by virtue of any breach of this contract by the Vendor and the City may withhold
5
RFP #26-028

any payments to the Vendor until such time as the amount of such damages due the City from the
Vendor shall be determined.
PRICING:
Given the phased nature of this engagement, respondents should clearly distinguish pricing associated with
the initial assessment and recommendation phase from pricing related to implementation or
remediation services. The City intends to first select a qualified vendor to perform the assessment and
provide recommendations. Following the completion of that phase, the City may, at its discretion, authorize
the selected vendor to perform implementation work associated with some or all of the recommended
improvements. Implementation services will be performed only upon approval by the City and may be
issued as separate tasks or scopes of work under the resulting agreement.
RENEWAL & EXTENSION:
The successful bidder will be awarded an agreement for an initial term of up to three (3) years, effective on
the date of award. The City anticipates that portions of the work under this agreement may be completed as
a one-time engagement, while other services may continue on an as-needed basis if the City elects to utilize
the consultant for additional support, implementation, or related services.
At the City's sole option, the agreement may be renewed for up to two (2) additional one (1) year periods.
Under no circumstances shall the total contract term, including renewals, exceed five (5) years.
Pricing for services proposed for the initial assessment and recommendation phase shall remain firm for
the duration of the initial agreement term. If the City elects to renew the agreement for ongoing services,
support, or additional implementation work, price adjustments may be considered at the time of renewal by
mutual agreement. Any proposed increase, including the exact amount or maximum percentage increase,
must be clearly indicated on the price sheet included in the proposal.
Requests for price increases for any renewal period must be submitted to the City at least sixty (60) days
prior to the expiration of the current agreement term. If no request for a price increase is submitted, the
existing pricing shall remain in effect for the renewal period. Price decreases may be offered at any time.
AWARD REQUIREMENTS:
Once the City is prepared to award the contract to the selected company, the company will need to
provide the following documents to the City.
* Signed contract agreement
* Current certificate of insurance
Once all of these items are received and fully executed, then the City will issue the Notice to
Proceed.
It is the desire of the City to award a single contract for the entire scope of services outlined in this
request for proposals. All proposals are subject to staff analysis. The City of O'Fallon reserves the
right to accept or reject any and all proposals received.
6
RFP #26-028

CONTACT WITH CITY OF O'FALLON PERSONNEL:
As specified above, all contact with the City should be channeled through the Purchasing Agent.
No contact with other City employees, officials, or City Council members is to be made by
responding proposers throughout the entire process.
RESPONSE MATERIAL OWNERSHIP:
All proposals become the property of the City of O'Fallon, Missouri upon receipt and will only be
returned to the proposer at the City's option. Selection or rejection of the proposal will not affect
this right. The City shall have the right to use all ideas or adaptations of the ideas contained in any
proposal received in response to this RFP. Disqualification of a proposal does not eliminate this
right.
PROPRIETARY INFORMATION:
All material submitted in response to this RFP will become public record and will be subject to
inspection after an Intent to Award notice is issued. Any material requested to be treated as
proprietary or confidential must be clearly identified and easily separable from the rest of the
proposal. Such request must include justification for the request and approval by the City Clerk.
Neither cost or pricing information nor a total proposal will be considered proprietary.
CONFIDENTIALITY:
The Vendor agrees that it will not permit the disclosure or duplication of any information
received from the City or stored on City systems unless such disclosure or duplication is
specifically authorized in writing by the City, or as required by law.
The City agrees that it will not disclose or duplicate any information designated in advance by the
Vendor as "Confidential/Proprietary" information to any person (other than City personnel who
must have access to such information) unless such duplication, use or disclosure is specifically
authorized in writing by the Vendor or is required by law. The term "Confidential/Proprietary"
does not include ideas, techniques, or concepts that are in the public domain.
EVALUATION RIGHTS:
The City reserves the right to: a) reject any or all proposals, or to make no award, b) require
modifications to initial proposals, c) make partial or multiple awards, or d) further negotiate costs
submitted in proposals. The City reserves the right to award the contract in any manner deemed
in the best interest of its citizens.
REJECTION OF PROPOSALS:
The City of O'Fallon, Missouri reserves the right to reject any or all proposals received in response
to this RFP, or to cancel this RFP if it is in the best interest of the City to do so. Failure to furnish
all information or to follow the proposal format requested in this RFP may disqualify the proposal.
Any exception to the Scope of Work must be identified in the proposal.
7
RFP #26-028

INCURRING COSTS:
The City of O'Fallon, Missouri shall not be obligated or be liable for any cost incurred by proposers
prior to issuance of a contract. All costs to prepare and submit a response to this solicitation shall
be borne by the proposer.
SUBMISSION OF PROPOSALS AND SUPPLEMENTAL MATERIALS:
Proposals shall be submitted to the Purchasing Office. If supplemental materials are required or
requested, then they must be submitted to the Purchasing Office as part of the proposal. Supplemental
materials will not be accepted after the proposals have been opened, unless requested by the Purchasing
Office. Submission or distribution by the company of unsolicited supplemental materials to City
employees or Officials may result in rejection of the proposal.
DISCRIMINATION POLICY:
The City of O'Fallon advises the public that it does not discriminate against any person on account of
race, color, religion, creed, sex, age, ancestry, or national origin, and that such nondiscrimination is
extended to procurement of materials and/or the provision of municipal services.
WAIVER:
The City reserves the right to waive any variances from the original RFP in cases where the variances
are considered to be in the best interest of the City.
INSURANCE:
The firm or company that is awarded a contract shall maintain during the life of the agreement and
furnish to the City the appropriate Professional Liability, Commercial General Liability, and Workers
Compensation insurance certificates listing the City of O'Fallon as an "Additional Insured" during the
Term of the Agreement, and a copy of such "Additional Insured" endorsement must accompany the
certificate.
INDEMNITY:
The Vendor shall, at all times, fully indemnify, hold harmless, and defend the City and its officers,
members, agents, and employees from and against any and all claims and demands, actions, causes of
action, and cost and fees of any character whatsoever made by anyone whomsoever on account of or
in any way growing out of the performance of this contract by the Vendor and its employees, or
because of any act or omission, neglect or misconduct of the Vendor, its employees and agents or its
subcontractors including, but not limited to, any claims that may be made by the employees
themselves for injuries to their person or property or otherwise.
Such indemnity shall not be limited by reason of the enumeration of any insurance coverage herein
provided.
8
RFP #26-028

Nothing contained herein shall be construed as prohibiting the City, its directors, officers, agents, or its
employees, from defending through the selection and use of their own agents, attorneys and experts,
any claims, actions, or suits brought against them.
The Vendor shall likewise be liable for the cost, fees and expenses incurred in the City's or the Vendor's
defense of any such claims, actions, or suits.
PAYMENT TERMS AND CONDITIONS:
The City's payment terms are Net 30 days. The City is exempt from Missouri sales and use taxes and
will not pay taxes for any product or service. A copy of the City's tax-exempt certificate shall be
presented to the firm or company that is awarded a contract.
Inquiries concerning this Request for Proposals shall be directed to:
Christine Grabin
Purchasing Agent
City of O'Fallon, Missouri
100 North Main Street
O'Fallon, Missouri
Phone: (636) 379-5527
CGrabin@ofallonmo.gov
END OF TERMS AND CONDITIONS
9
RFP #26-028

CITY OF O'FALLON, MISSOURI
RFP NUMBER 26-028
SCOPE OF SERVICES
MANDATORY PRE-BID MEETING:
A mandatory pre-bid meeting will be held at the City Hall 100 Noth Main Street, O'Fallon, MO 63366
on, April 24, 2026, at 1:00 P.M. Questions will only be answered at this mandatory pre-bid meeting. Lack
of attendance at the mandatory pre-bid meeting will disqualify a bidder from being considered for the
award of the project.
OVERALL SCOPE OF PROJECT INCLUDES:
Secure Management of Non-SCADA Devices on the OT Network
* Assess all non-SCADA endpoints (desktops, laptops, engineering workstations, vendor devices)
connected to the OT network.
* Ensure devices are securely configured, hardened, and segmented appropriately.
* Provide recommendations for secure remote management, including access controls, MFA, jump
hosts, and logging.
* Evaluate patch management processes for OT-connected endpoints and recommend a safe,
operationally appropriate patching strategy.
* Identify any unmanaged or non-compliant devices and provide remediation steps.
Firewall, Routing, and Switch Configuration Review
* Perform a detailed review of firewall rulesets, VLAN configurations, ACLs, routing, and switch
configurations across OT and IT boundaries.
* Identify overly permissive rules, unnecessary open ports, flat network segments, and
misconfigurations.
* Provide recommendations for segmentation improvements aligned with ISA/IEC 62443 and NIST
guidance.
* Deliver a prioritized remediation plan with risk ratings.
Comprehensive SCADA Network Documentation
* Develop complete, auditor-ready documentation of the SCADA and OT network architecture.
* Include logical and physical network diagrams showing all connections between IT, OT, field
devices, remote sites, lift stations, wells, and treatment facilities.
* Document data flows, trust boundaries, firewall rule dependencies, remote access paths, and third-
party/vendor connections.
* Ensure documentation is suitable for review by state and federal partners, grant auditors, and
regulatory agencies.
Asset Inventory and Asset Discovery Strategy
* Conduct or recommend a passive OT-safe asset discovery approach to identify all devices
connected to the SCADA network, including PLCs, HMIs, RTUs, historians, servers, and
networking equipment.
* Identify firmware versions, operating systems, and unsupported or end-of-life assets.
* Provide recommendations for implementing continuous asset visibility.
* Recommend and, if feasible, design alerting mechanisms for detection of unauthorized or
unexpected devices connecting to the OT network.
Alignment with the NIST Cybersecurity Framework
10
RFP #26-028