New York State Contract Reporter #RFP No. 2026-SECURE-01

Ogdensburg municipal water and wastewater cybersecurity risk assessment

The City of Ogdensburg is seeking a consultant to assess cybersecurity risks across its municipal drinking water and wastewater systems. - Government buyer: City of Ogdensburg, New York — Office of the City Manager; related project offices include Planning/Engineering and Public Works. - Service requested: One integrated cybersecurity risk assessment covering both systems, including relevant treatment facilities, remote sites, and supporting IT/OT and SCADA/industrial control environments. - Approach and deliverables: Apply NIST Cybersecurity Framework 2.0 and CIA Triad principles; create system-specific Current and Target Profiles, assess applicable state DOH and DEC requirements, and provide compliance matrices, gap analysis, prioritized and costed remediation roadmaps, reports, executive summaries, and findings presentations. - Important constraints: The assessment must be non-intrusive. Active OT vulnerability scanning, penetration testing, exploitation, social engineering, and intrusive physical testing are prohibited. The combined all-inclusive price is capped at $45,000. - OEMs and products: No OEMs, branded products, or product part numbers are specified. No named assessment vendor is identified; the City seeks a qualified consulting firm. - Funding context: The assessment supports the New York State Environmental Facilities Corporation SECURE Assessment Grant.

Description

The City of Ogdensburg is seeking proposals for a comprehensive cybersecurity risk assessment of its municipally owned drinking water and wastewater systems, under the New York State Environmental Facilities Corporation SECURE Program Assessment Grant. The consultant will assess current cybersecurity posture, develop NIST CSF 2.0 current and target profiles, analyze regulatory gaps, and provide prioritized remediation actions and an implementation roadmap. Deliverables include assessment reports and executive summaries for both systems, plus a presentation of findings. The RFP sets an all-inclusive not-to-exceed budget of $45,000 for the combined work; Addendum No. 1 specifies that the assessment must be non-intrusive.

View original listing