New York State Contract Reporter #2139496

Managed vCISO, GRC, and Cybersecurity Program Management Services

Nassau Community College is seeking a hands-on partner to manage and advance its cybersecurity governance, risk, and compliance program. - Government buyer: Nassau Community College, State University of New York system; Procurement Office. - Scope: Managed Governance, Risk, Compliance, and Cybersecurity Program Management Services, including virtual Chief Information Security Officer (vCISO) leadership and active program coordination. - Key work: Cybersecurity strategy and maturity roadmaps; risk assessments, risk register and remediation tracking; compliance and audit support; technology and application inventory; policy and procedure management; business continuity and disaster recovery planning; vendor risk management; vulnerability and security assessments; incident response readiness and support; governance facilitation; and executive and Board reporting. - Framework and deliverables: Annual NIST CSF 2.0 assessment, ongoing maturity improvement, and maintenance of a centralized cybersecurity program system of record. The initial six months include baseline review and program transition. - Term: One initial year with up to four additional one-year extensions, for a maximum of five years. Annual fixed fees are requested for each contract year. - Products and OEMs: No hardware or software products, part numbers, or OEMs are identified; this is a services-focused opportunity.

Description

Nassau Community College is seeking a qualified cybersecurity services partner to provide Governance, Risk, Compliance (GRC) and Cybersecurity Program Management Services. The work includes virtual Chief Information Security Officer (vCISO) services and active program management, including planning, coordination, documentation, facilitation, risk and compliance management, governance support, and execution oversight. The selected firm will work as an extension of the College’s Information Technology organization to advance its cybersecurity program. Proposals are due October 27, 2026, by 12:00 PM; the contract term is five years.

View original listing