Request for Proposal (RFP) for Privileged Access Management

Request for Proposal (RFP) for Privileged Access
Management
RFP # 27-1101
City of Durham
Sep 28, 2026
27-1101 RFP for Privileged Access Management Page 1

Table of Contents
General Information
10. Date of RFP.
20. Project Manager and Contact with City; Questions about this RFP.
Description of Project and Nature of RFP
30. Project.
40. Scope of Work.
50. Compensation Amount and Schedule.
60. Definitions in this RFP.
70. Contract.
80. Trade Secrets and Confidentiality.
90. Bonds.
100. Insurance.
110. Discretion of the City.
Schedule
120. Schedule.
130. Keeping Proposals Open.
140. Deadline to Submit Proposals.
150. Questions.
160. Pre-submittal conferences, meetings, and site visits.
Getting More Information on the Project and RFP Process
170. Updates and revisions to RFP.
Evaluation Criteria
180. Evaluation Criteria.
190. Understanding the Project.
200. Methodology Used for the Project.
210. Management Plan for the Project.
220. Experience and Qualifications
230. Contract Cost.
Contents of Proposal
240. Contents of Proposal.
250. Cover letter.
260. Addendums.
How to submit a proposal
270. How to submit a proposal.
280. Format.
290. Alternative Proposals.
300. Candidate to Bear Expense; No Claims against City.
310. State Treasurer's lists regarding Iran and Boycott of Israel.
320. Notice Under the Americans with Disabilities Act (ADA).
330. Values of City of Durham regarding Treatment of Employees of Contractors
Attachments
Exhibit A - Model Services Contract
27-1101 RFP for Privileged Access Management Page 2

Request for Proposal (RFP) for Privileged Access Management
10. Date of RFP: Sep 28, 2026
20. Project Manager and Contact with City; Questions about this RFP. Direct questions and concerns to
Attn: Prasanna Ramamoorthy
Technology Solutions, City of Durham
101 City Hall Plaza
DURHAM NC 27701-3329
Email: Prasanna.Ramamoorthy@durhamnc.gov
If you have concerns about this RFP that you believe are not being addressed by the project manager, please
contact
Mitch Smith
Technology Solutions, City of Durham
101 City Hall Plaza
DURHAM NC 27701-3329
Email: mitch.smith@durhamnc.gov
DESCRIPTION OF PROJECT AND NATURE OF RFP
30. Project.
The City of Durham (hereinafter "City") manages a complex IT environment with many systems requiring privileged access
for staff, vendors, contractors, and automated services. Vendor access is currently requested through an online form and
approved by Cybersecurity. Privileged access is managed manually across disparate tools with inconsistent policies.
Administrators use multiple privileged accounts with separate credentials, lacking centralized oversight and audit trails.
These manual processes increase the risk of unauthorized access, reduce visibility into administrative actions, and make
compliance with standards such as NIST difficult.
Procuring a Privileged Access Management system is part of an overall Cyber Security program enhancement project.
40. Scope of Work.
The City is looking for a comprehensive and best practice solution to provide Privileged Access Management (PAM). The
following section details the scope of work and requirements of the City of Durham but is meant as an initial guide for the
proposal. Respond with a detailed description of how you will meet each requirement and the timeline. Your responses will
be scored based on the Evaluation Criteria listed in sections 180 - 230.
The City of Durham seeks to procure a comprehensive Privileged Access Management Solution to enhance its cybersecurity
posture by centralizing control over privileged credentials, enforcing least-privilege access, and continuously monitoring
and securing all privileged activities across its IT environment.
The selected vendor will be responsible for providing a solution that meets the following functional and technical
objectives:
Category Detailed Scope
Boss Desk Intake Integrate the PAM platform with Boss Desk to automate the complete privileged access request lifecycle
Process from intake through deprovisioning.
Automation Request Intake: Users submit privileged access requests through a standardized Boss Desk service
catalog, including system, access type, business justification, and requested duration.
Automated Validation: Verify user identity, required security training, manager assignment, and
eligibility for privileged access.
Approval Workflow: Route requests to the appropriate manager, system owner, and Information
Security (when required), with automated escalations and validation checks.
27-1101 RFP for Privileged Access Management Page 3

Just-in-Time Provisioning: Automatically grant time-limited privileged access, launch secure
sessions without exposing credentials, and record all privileged activity.
Session Monitoring: Monitor administrative activity, log commands, generate security alerts, and
enable SOC intervention when necessary.
Automatic Deprovisioning: Revoke elevated access, rotate passwords, remove temporary group
memberships, and terminate privileged sessions when the approved access period expires.
Audit & Ticket Closure: Update the Boss Desk ticket with approvals,
access duration, session references, password rotation status, audit logs, and completion details.
Credential Automated Discovery: Automatically find privileged accounts, service accounts, and SSH keys across
Vaulting & the network.
Rotation Secure Vaulting: Store passwords, secrets, and certificates in a centralized, encrypted repository.
Automatic Rotation: Change passwords automatically based on time intervals, complexity rules, or
usage events. (according to the policy)
Service Account Management: Update passwords for application-to-application (A2A)
dependencies without causing downtime.
Access Control & Just-In-Time (JIT) Access: Grant temporary, elevated permissions that expire automatically to
Session minimize standing privileges.
Management Session Isolation: Route connections through a secure proxy to prevent direct user-to-resource
exposure.
Multi-Factor Authentication (MFA): Support advanced MFA integration at the vault login and
session initiation levels.
Approval Workflows: Enforce customizable authorization gates (based on policies) before granting
access to critical infrastructure.
Vendor & VPN-Less Access: Enable secure HTML5 browser-based remote access without requiring client VPN
Contractor software installations.
Remote Access Identity Federation: Integrate with external identity providers to support Bring Your Own Identity
(BYOID) for third parties.
Time-Bound Provisioning: Automatically provision and de-provision contractor accounts based on
contract start and end dates.
Granular Asset Scoping: Restrict contractor visibility to only the specific servers, databases, or
applications needed.
Strict Session Gatekeeping: Force real-time administrator approvals for third-party access requests
to critical production systems.
CJIS Compliance & FIPS 140 Cryptography: Encrypt all credentials at rest and vault sessions in transit using FIPS 140-
Law Enforcement validated cryptographic modules.
Security Advanced CJIS MFA: Enforce mandatory Multi-Factor Authentication (MFA) capturing at least two
distinct factors for all administrative sessions.
Session Re-Authentication: Require explicit user re-authentication for privileged sessions after 30
minutes of system inactivity or every 12 to 8 hours of continuous connectivity.
Throttling & Account Lockout: Enforce account lockouts after a maximum of 5 consecutive
unsuccessful login attempts to prevent brute-force entry.
Comprehensive Audit Trail: Log all user creations, login attempts, password modifications, and
actions initiated via privileged accounts for a minimum retention period matching CJIS audit
requirement.
US-Based Cloud Bounds: Guarantee that data, metadata, and proxy sessions reside exclusively
within U.S. sovereign boundaries if utilizing a SaaS-based or cloud-hosted deployment model.
Vendor Background Adjudication: Ensure all vendor personnel with underlying cloud infrastructure
access undergo fingerprint-based criminal history background checks and sign the official CJIS
Security
Monitoring & Session Recording: Capture full video or text logs of all privileged active sessions.
Auditing Real-Time Monitoring: Allow administrators to view active sessions and terminate them instantly if
suspicious behavior occurs.
Keystroke Logging: Log all executed commands, scripts, and inputs for searchable audit histories.
SIEM Integration: Export audit logs and alerts natively to security information and event
management tools.
Dashboard & Reporting: The proposed Privileged Access Management (PAM) solution shall provide
customizable dashboards and reporting capabilities that deliver real-time visibility into privileged
accounts, privileged sessions, system health, and security events. Reporting should support
operational, compliance, and executive-level use cases.
Architecture & Hybrid Cloud Support: Protect infrastructure across on-premises, Azure, Oracle and SaaS
Integration environments.
27-1101 RFP for Privileged Access Management Page 4

The proposed Privileged Access Management (PAM) solution shall support secure access to web-
based administrative interfaces (HTTPS/URLs) through the PAM platform, including the ability to
launch and proxy browser-based sessions without exposing privileged credentials to the end user.
API Intake Access: Provide robust REST APIs for seamless integrations with Boss.
High Availability: Deliver a resilient architecture with built-in business continuity, disaster recovery
and failover modes.
50. Compensation Amount and Schedule
The timing of the payment or payments will be determined by a contract based on the project scope of work and
budget. Provide separate pricing for the following, regardless of whether the items will be bundled:
* Software license costs
* Initial configuration and set-up
* Hosting fees, if applicable and pricing model (by user, enterprise, module, etc.)
* Training costs
* Ongoing technical support/ maintenance costs, by year
* Additional requirements or service
* Optional functionality.
If pricing is tiered, please provide specific listing of services and associated functions and pricing for each tier. Vendor will
indicate which items are optional.
60. Definitions in this RFP: City, RFP, Proposal, Candidate, Contractor, Should. Unless the context indicates otherwise - (a)
The expressions "RFP," "this RFP," and "the RFP" refer to this document as it may be amended or updated. (b) "City" and
"city" mean the City of Durham. (c) The "proposal" or "Bid" is the response of a person, firm, or corporation proposing to
provide the services sought by this RFP. (d) The word "Candidate" or "candidate" is the person, firm, or corporation that
submits a proposal or that is considering submitting a proposal. (e) The word "Contractor" or "contractor" is the person,
firm, or corporation with which the City enters into a contract to provide the services sought by this RFP. That is,
"contractor" generally refers to a successful candidate that has obtained a fully executed contract with the City, while
"candidate" is generally reserved to the stage before a contract has been signed. (f) The word "should" is used to tell
candidates what the City thinks it wants and/or what the project manager thinks is best. Candidates that want to increase
the likelihood of being selected will, in general, do what the RFP says candidates "should" do, but failure to comply with all
"should" will not necessarily and automatically result in rejection.
70. Contract. The City anticipates that at the conclusion of the RFP process there will be a contract between the City and
the successful candidate under which the successful candidate will provide the goods and services generally described in
this RFP. It is the City's intention to use the contract that is attached as Exhibit A, modified and filled in to reflect the RFP
and the proposal. If a candidate objects to any of the contract provisions, it should state the objections in its proposal.
Failure to provide objections creates an assumption that the candidate accepts all standard City contract terms and
conditions.
If federal assistance or funds are used in conjunction with the services provided by the candidate, clauses for contracts
involving federal financial assistance shall be incorporated into contract. The Candidate is required to be familiar with these
federal assistance clauses and to comply with them.
80. Trade Secrets and Confidentiality. As a general rule, all submissions to the City are available to any member of the
public. However, if materials qualify as provided in this section, the City will take reasonable steps to keep trade secrets
confidential.
Definitions.
In this section (Trade Secrets and Confidentiality) -
The term "candidate" includes the candidate as contractor (that is, after it is a party to a contract with the City).
The term "trade secret" means business or technical information, including but not limited to a formula, pattern,
program, device, compilation of information, method, technique, or process that:
a. Derives independent actual or potential commercial value from not being generally known or readily
ascertainable through independent development or reverse engineering by persons who can obtain economic
value from its disclosure or use; and
b. Is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.
The existence of a trade secret shall not be negated merely because the information comprising the trade
secret has also been developed, used, or owned independently by more than one person, or licensed to other
persons.
27-1101 RFP for Privileged Access Management Page 5

The term "record" means all documents, papers, letters, maps, books, photographs, films, sound recordings, magnetic
or other tapes, electronic data-processing records, artifacts, or other documentary material, regardless of physical form
or characteristics, received by the City of Durham in connection with the candidate's proposal.
(a) Designation of Confidential Records. To the extent that the candidate wishes to maintain the confidentiality
of trade secrets contained in materials provided to the City, the candidate shall prominently designate the
material with the words "trade secrets" at the time of its initial disclosure to the City. The candidate shall not
designate any material provided to the City as trade secrets unless the candidate has a reasonable and good-faith
belief that the material contains a trade secret. When requested by the City, the candidate shall promptly
disclose to the City the candidate's reasoning for designating material as trade secrets; the candidate may need to
label parts of that reasoning as trade secrets. In providing materials to the City, the candidate shall make
reasonable efforts to separate those designated as trade secrets from those not so designated, both to facilitate
the City's use of the materials and to minimize the opportunity for accidental disclosure. For instance, if only a
sentence or paragraph on a page is a trade secret, the page must be marked clearly to communicate that
distinction. To avoid mistakes or confusion, it is generally best to have only trade secret information on a page
and nothing else on that page.
To the extent authorized by applicable state and federal law, the City shall maintain the confidentiality of records
designated "trade secrets" in accordance with this section. Whenever the candidate ceases to have a good-faith
belief that a particular record contains a trade secret, it shall promptly notify the City.
(b) Request by Public for Access to Record. When any person requests the City to provide access to a record
designated as a trade secret in accordance with subsection (a) above, the City may
(1) decline the request for access,
(2) notify the candidate of the request and that the City has provided, or intends to provide, the person
access to the record because applicable law requires that the access be granted, or
(3) notify the candidate of the request and that the City intends to decline the request.
Before declining the request, the City may require the candidate to give further assurances so that the City can be
certain that the candidate will comply with subsection (c) below.
(c) Defense of City. If the City declines the request for access to a record designated as trade secrets in
accordance with subsection (a), then, in consideration of the promises in (b) above and for considering the
candidate's proposal, the candidate agrees that it shall defend, indemnify, and save harmless Indemnitees from
and against all Charges that arise in any manner from, in connection with, or out of the City's non-disclosure of
the records. In providing that defense, the candidate shall at its sole expense defend Indemnitees with legal
counsel. The legal counsel shall be limited to attorneys reasonably acceptable to the City Attorney.
Definitions. As used in this subsection (c), "Charges" means claims, judgments, costs, damages, losses, demands,
liabilities, fines, penalties, settlements, expenses, attorneys' fees, and interest. Indemnitees" means the City, and
officers, officials, independent contractors, agents, and employees, of the City. "Indemnitees" does not include
the candidate. The City may require the candidate to provide proof of the candidate's ability to pay the amounts
that may reasonably be expected to become monetary obligations of the candidate pursuant to this section. If
the candidate fails to provide that proof in a timely manner, the City shall not be required to keep confidential the
records whose non-disclosure gives rise to the potential monetary obligation. Nothing in this agreement shall
require the City to require any person (including the City itself) to be placed at substantial risk of imprisonment, of
being found by a court to be in contempt, or of being in violation of a court order. This subsection (c) is separate
from and is to be construed separately from any other indemnification and warranty provisions in the contract
between the City and the candidate.
85. Reserved.
90. Bonds. No performance bond or payment bond is required for this contract.
100. Insurance.
The Contractor agrees to maintain on a primary basis, at its sole expense, and always during the life of this contract the
following applicable coverages and limits. The requirements contained herein, as well as the City's review or acceptance of
insurance maintained by the Contractor, are not intended to, and shall not in any manner, limit or qualify the liabilities or
obligations assumed by the Contractor under this contract.
Commercial General Liability - Combined single limit of no less than $1,000,000 each occurrence and $2,000,000
aggregate. Coverage shall not contain any endorsement excluding or limiting Product/Completed Operations, Contractual
Liability, Cross Liability, or Personal and Advertising Injury Liability.
27-1101 RFP for Privileged Access Management Page 6

Automobile Liability - Limits of no less than $1,000,000 Combined Single Limit. Coverage shall include liability for Owned,
Non-Owned, and Hired automobiles. In the event the Contractor does not own automobiles, the Contractor agrees to
maintain coverage for Hired and Non-Owned Auto Liability, which may be satisfied by way of endorsement to the
Commercial General Liability policy or by separate Auto Liability policy. Automobile coverage is necessary only if vehicles
are used in the provision of services under this contract or are brought on a City site.
Umbrella or Excess Liability - The Contractor may satisfy the minimum liability limits required above under an Umbrella or
Excess Liability policy. There is no minimum Per Occurrence limit of liability under the Umbrella or Excess Liability. However,
the Annual Aggregate limits shall not be less than the highest "Each Occurrence" limit for required policies. The Contractor
agrees to endorse the City as an "Additional Insured" on the Umbrella or Excess Liability unless the certificate of insurance
states the Umbrella or Excess Liability provides coverage on a "Follow-Form" basis.
Workers' Compensation & Employers Liability - The Contractor agrees to maintain Worker's Compensation Insurance in
accordance with Chapter 97 of the North Carolina General Statutes and with Employer Liability limits of no less than
$1,000,000 for each accident, each employee, and policy limit. This policy must include a waiver of subrogation.
Cyber Liability - Limits of no less than $1,000,000 each occurrence and $2,000,000 aggregate.
Additional Insured - The Contractor agrees to endorse the City as an Additional Insured on the Commercial General
Liability. The Additional Insured shall read "City of Durham as its interest may appear".
Certificate of Insurance - The Contractor agrees to provide the City a certificate of insurance evidencing that all coverage,
limits, and endorsements required herein are maintained and in full force and effect, and certificates of insurance shall
provide a minimum thirty (30) day endeavor to notify, when available, by the Contractor's insurer. If the Contractor
receives a non-renewal or cancellation notice from an insurance carrier affording coverage required herein or receives
notice that coverage no longer complies with the insurance requirements herein, the Contractor agrees to notify the City
within five (5) Business Days with a copy of the non-renewal or the cancellation notice or with written specifics as to which
coverage is no longer in compliance. The Certificate Holder address should appear as follows:
City of Durham
Attn: Technology Solutions
101 City Hall Plaza
Durham, NC 27701
All primary insurance carriers must be authorized to do business in North Carolina. As used in this contract, "Business Day"
is defined as any day other than Saturdays, Sundays, and any legal holiday recognized by the City pursuant to City Code
Section 42-16, as amended.
110. Discretion of the City.
A. The City of Durham reserves the right to (i) reject any, any part of, or all proposals, or (ii) accept that proposal
which the City deems to be in its best interest, whether or not it is the lowest dollar proposal.
B. NOTWITHSTANDING anything to the contrary in this document or in any addendums to this document, unless the
contrary provision refers specifically to this provision, the City reserves the right (i) to negotiate changes of any nature
with any candidate with respect to any term, condition, or provision in this document and/or in any proposals,
whether or not something is stated to be mandatory and whether or not it is said that a proposal will be rejected if
certain information or documentation is not submitted with it, and (ii) to enter into an agreement for some or all of
the work with one or more persons, firms, or corporations that do not submit proposals. For example, all deadlines
are for the administrative convenience or needs of the City and may be waived by the City in its discretion. This
subparagraph B applies to the entire RFP.
C. Where the City asks or tells candidates to do stated things, such as that a proposal should follow a stated format or
that the candidate should do stated things in seeking the contract, the City may reject a proposal because it does not
comply with those requests, so the candidate is adding to its risk of rejection by non-compliance. Still, the City may,
in its discretion, waive non-compliance. This subsection (C) does not limit subsections (A) and (B).
D. Of course, once a contract is signed, the parties to the contract may enforce the contract according to its terms as
allowed by applicable law.
SCHEDULE
120. Schedule.
27-1101 RFP for Privileged Access Management Page 7

This schedule is the City's best estimate of the schedule that will be followed. If a component of this schedule is delayed,
the rest of the schedule will be shifted by the same number of days.
The City expects that the winning candidate will be able to provide a fully operational Privileged Access Management
System by April 30, 2027.
Timeline for RFP Process
Solicitation of proposals from Candidates by the City of Durham: September 28, 2026
Pre-bidding conference date: October 14th at 10:30 AM EST
Deadline for Questions: October 21st at 5:00 PM EST
Receive Proposal / RFP Close Date: October 28th at 5:00 PM EST
Proposal Evaluation Committee to complete its evaluation; 30 days past previous step
City Council authorizes the City Manager to sign the contract; 60 days past previous step
City Manager and successful candidate sign contract; 30 days past previous step
130. Keeping Proposals Open. All proposals will remain open and valid for the City to accept for a period of 150 days after
the deadline for submission of proposals. The Project Manager may release candidates from this obligation by a written
letter that specifically refers to this paragraph if he or she determines that the candidate and/or the proposal will not meet
the City's needs.
140. Deadline to Submit Proposals. Candidates should see that their proposals are received via email to
Prasanna.Ramamoorthy@durhamnc.gov by 5:00 PM EST, October 28, 2026.
GETTING MORE INFORMATION ON THE PROJECT AND RFP PROCESS
150. Questions. Questions about the RFP and the RFP process should be submitted to the project manager identified at the
beginning of this RFP, Prasanna.Ramamoorthy@durhamnc.gov and must be received by 5:00 PM EST on October 21, 2026.
160. Pre-submittal conferences, meetings, and site visits.
The city will conduct a Pre-Bid Conference on October 14th at 10:30 AM EST via Microsoft Teams (details below) Attendees
should be already familiar with this RFP. The meeting will be recorded for future reference:
________________________________________________________________________________
Microsoft Teams
Join: https://teams.microsoft.com/meet/28253819365498?p=Ipwa6ZWYtcsI7ouK2g
Meeting ID: 282 538 193 654 98
Passcode: xk9rP3LX
170. Updates and revisions to RFP
If you have supplied the Project Manager with your preferred method of contact (email, fax, etc.), updates to this RFP
("addendums" or "addenda") will be sent to you in that manner. This RFP and addendums are normally posted on the
City's website, on the Purchasing Division's webpage. Check that webpage to see that you have received all addenda at:
https://durhamnc.gov/bids.aspx
EVALUATION CRITERIA
180. Evaluation Criteria. If an award is made, it is expected that the City's award will be to the candidate that agrees to
meet the needs of the City. Several relevant matters will be considered, including qualifications and cost.
Phase 1 Compliance - Proposals that do not meet the City's IT standards will not be considered.
Phase 2 Business Value
Demonstrated understanding of purpose, scope, expected deliverables, and ability to meet them
Completeness of a plan to implement a generative AI solution for Durham One Call
Vendor experience and staff qualifications
Cost proposal
Complete proposal
Equal Business Opportunity Program Participation
27-1101 RFP for Privileged Access Management Page 8

Phase 3 Reference Checks
Phase 4 Ranked vendor by scoring and selecting finalist
EVALUATION CRITERIA (Sections 190-230)
190. Understanding of the Project - 5 points
Proposals will be evaluated against the questions set out below.
(a) How well has the candidate demonstrated a thorough understanding of the purpose and scope of the project?
(b) How well has the candidate identified issues and potential problems related to the project?
(c) How well has the candidate demonstrated that it understands the deliverables the City expects it to provide?
(d) How well has the candidate demonstrated that it understands the City's schedule and can meet it?
200. Methodology Used for the Project - 15 points
Proposals will be evaluated against the questions set out below.
(a) How well does the methodology depict a logical approach to fulfilling the requirements of the RFP?
(b) How well does the methodology match and contributes to achieving the objectives set out in the RFP?
(c) How well does the methodology interface with the schedule in the RFP?
210. Management Plan for the Project - 15 points
Proposals will be evaluated against the questions set out below.
(a) How well does the management plan support all the project requirements and logically lead to the
deliverables required in the RFP?
(b) How well is accountability completely and clearly defined?
(c) Is the organization of the project team clear?
(d) How well does the management plan illustrate the lines of authority and communication?
(e) To what extent does the candidate already have the hardware, equipment, and licenses necessary to perform
the contract?
(f) Does it appear that the candidate can meet the schedule set out in the RFP?
(g)Has the candidate offered alternate deliverables and gone beyond the minimum tasks necessary to meet the
objectives of the RFP?
(h) Is the proposal practical, feasible, and within budget?
(i) How well have potential problems been identified?
(j) Is the proposal responsive to all material requirements in the RFP?
220. Experience and Qualifications - 15 points
Proposals will be evaluated against the questions set out below.
Questions regarding the personnel.
(a) Do the individuals assigned to the project have experience of similar projects?
(b) Are resumes complete and do they demonstrate backgrounds that are desirable for individuals engaged in the
work the project requires?
(c) How extensive are the applicable education and experience of the personnel designated to work on the
project?
(d) How knowledgeable are the candidate's personnel of the local area and how many individuals have worked in
the area previously?
Questions regarding the candidate:
(e) How well has the candidate demonstrated experience in completing similar projects on time and within
budget?
(f) How successful is the general history of the candidate regarding timely and successful completion of projects?
(g) Has the candidate provided letters of reference from clients?
27-1101 RFP for Privileged Access Management Page 9

(h) How reasonable are the candidate's cost estimates?
(i) If subcontractors will perform work on the contract, how well do they measure up to the evaluation used for
the candidate?
230. Contract Cost - 40 points
The lowest cost proposal will receive the maximum number of points allocated to cost. Cost is one of a number of factors,
so a candidate with the lowest cost cannot count on being selected.
CONTENTS OF PROPOSAL
240. Contents of Proposal.
The proposal should include sections, numbered as follows:
1. Contact information. Include the candidate's name and address, and the contact information (name, mailing
address, email address, fax number, and telephone number) of the person whom the City should contact
regarding the proposal.
2. Legal Status of the Candidate and Signers. State the full, exact name of the candidate. State whether the
candidate is an individual, corporation, limited partnership, general partnership, limited liability company,
professional corporation, professional association, etc. If it is anything other than an individual or a general
partnership, specify the State under which the entity is organized. If the State under which the entity is organized
is not North Carolina, specify whether the candidate has received a certificate of authority from the N. C.
Secretary of State to transact business in North Carolina. State whether the entity is in existence at the time the
proposal is submitted, and if not, whether and when the candidate intends to officially form the entity. State the
names and titles of the individuals who sign the contract with the City.
3. Qualifications, References, and Licenses. This part should include the candidate's experience on similar
projects and include references and how to contact them.
List the candidate's current licenses that are pertinent to this project.
4. Project Team, Location of Work, and Subcontracting. State the names and qualifications of the individuals
who will be responsible for this project.
5. Methods and Procedures. Include the work breakdown structure and outline the schedule for this project.
6. Compensation. Explain the entire compensation arrangement that you propose.
7. Assumptions regarding City of Durham Actions and Participation. If your proposal assumes that the City will
take certain actions, provide facilities, or do anything else, you should state these assumptions explicitly.
8. Small Local Business Enterprises (SLBEs). N/A
9. Financial Condition, Insurance, Bonds, and Taxes. The City may reject proposals from candidates that are
overdue on City property taxes.
10. Conflict of Interest. If the candidate has any grounds to believe there could be a conflict of interest, such as
that a City employee who is involved in awarding the contract has a connection with the candidate, please
explain.
11. Non-collusion.
Sign the following and include it with your response:
NON-COLLUSION AFFIDAVIT
By executing this proposal, I certify that this proposal is submitted to the City of Durham competitively
and without collusion. I am authorized to represent the candidate both in submitting this bid and in making this
Non-collusion Affidavit. To the best of my knowledge and belief, (1) the candidate has not violated N. C. General
Statute section 133-24 in connection with the proposal, (2) the candidate has not entered into any agreement,
participated in any collusion, or otherwise taken any action in restraint of free competitive bidding in connection
with its proposal, and (3) the candidate intends to do the work with its own Bonafide employees or
27-1101 RFP for Privileged Access Management Page 10