Information Technology Security (Cyber Security) and Information Technology Support Services

PROPOSALS SUBMITTAL DEADLINE
TUESDAY, APRIL 28, 2026, 2:00 P.M. MDT
INTERVIEWS FOR SELECTED CONSULTANTS
The City of Moab ("City") hereby invites interested individuals and companies to submit
written proposals in accordance with the terms, conditions and specifications contained
in this document.
GENERAL SCOPE OF SERVICE REQUESTED
The City is requesting proposals from technology consulting firms for Cyber Security
and Technology Support Services. The City intends to contract with a qualified firm(s)
to provide consultation and guidance for Cyber Security and IT support in the following
areas: architectural guidance, project management, technology roadmap, technical
implementation, support services and future City technology needs and solutions with
an emphasis on technology (cyber) security. Firms may express interest and request
consideration for said project by making submittal to the City as outlined herein.
STATEMENT OF PURPOSE - MANAGED INFRASTRUCTURE AND NETWORK
SERVICES
the City is seeking comprehensive managed infrastructure and network services. The
winning vendor will provide hardware (server, desktop/laptop), network, and software
support and monitoring, helpdesk, back-ups, remote access, on-site support, email
maintenance and support, inventory control and management (hardware and software),
security, and disaster recovery. To accomplish this, it is expected that the winning
vendor(s) will be able to work effectively with other the City vendors (such as proprietary
software vendors and internet service providers) to make the IT System a seamless
process to the end user.
Additional consulting areas include voice and data network, physical security, SCADA
security, virtualization, data storage, Windows server, AI governance, and other general
infrastructure technologies.
It is also expected that the winning vendor(s) will assist management with long-term
planning to keep systems current and functional in the most cost-effective manner
possible. Additionally, they will work with the City's IT Supervisor and Technician
utilizing already established day-to-day tracking and prioritization system for work order
requests from the various departments.
The overall goal of this RFP is to procure long-term, comprehensive, reliable, timely,
proactive IT management, cybersecurity and support that will promote the mission of the
City in serving its citizens.
City of Moab - RFP for IT Security and Services
Page 3

MOAB CITY COMMUNITY PROFILE
The City is located just south of the Colorado River in Grand County and is a regional
center of southeastern Utah. It is located on the west side of the 12,500-foot-high La Sal
Mountains in a valley fifteen miles long and three miles wide within the heart of the
Colorado Plateau known as Spanish Valley.
Moab's historical economy was based on farming, ranching, and fruit growing although
some mining was done along the Colorado River and in the La Sal Mountains. Moab's
largest industry for the last quarter century has been tourism.
The 2020 Census shows the city's current population at 5,369. Jeeping, hiking, climbing,
mountain biking and river activities are all recreational opportunities available in Moab.
A five-member City Council and a Mayor govern the City of Moab, whom residents elect
for four-year terms. The Mayor acts as the chairperson for City Council meetings, breaks
ties, signs official documents, and appoints officials. The City Council approves
resolutions, ordinances, and financial activities of the City. The City Council also hires a
City Manager, who is the chief executive and who manages all employees of the City.
MOAB CITY TECHNOLOGY PROFILE
A. City Government Network:
The City Government provides voice and data services to approximately 200
employees in eight departments and fifteen divisions across multiple buildings,
including City Hall, Public Works, Wastewater Treatment, Animal Shelter, and the
Moab Arts & Recreation Center (MARC).
B. Server and Virtualization Infrastructure: The City has migrated to a virtualized
environment utilizing Microsoft Hyper-V.
1. Physical Hosts: Two (2) Dell PowerEdge R6515 Hypervisors running
Windows Server 2019 Datacenter.
2. Virtual Machines: Approximately 16 virtual servers running primarily
Windows Server 2019 Datacenter. Critical workloads include Domain
Controllers, File Servers, Print Servers, SQL Servers (Pelorus/Fatpot), and
Application Servers (HVAC, 3CX).
3. Legacy Systems: One legacy VM running Windows Server 2012 R2
(Fatpot - legacy PD) and one isolated VM running Windows 7 (HVAC
control).
C. Storage & Backups:
1. Primary Storage: Synology Flash Cluster SAN (RS3617xs+) and Synology
iSCSI Failover SAN (RS2818RP+).
2. Backup Strategy: Axcient x360 Recover provides image-based backups
with offsite replication. Synology DiskStations (DS1621+) supports local
backups.
D. Workstations & Laptops: The City supports a mixed fleet of approximately 180+
managed endpoints.
City of Moab - RFP for IT Security and Services
Page 4

1. Operating Systems: Primarily Windows 11 Pro.
2. Hardware Standard: Diverse environment including Dell Latitude Rugged
laptops (Police Department), HP EliteDesk/ProDesk desktops, Lenovo
ThinkPads, and Microsoft Surface devices.
E. Network & Security:
1. Firewalls: SonicWall NSA series (Primary at City Hall) and SonicWall TZ
series at remote sites (Aquatics, Animal Shelter, Public Works, MARC).
2. Switching: Ubiquiti EdgeSwitch and UniFi Pro PoE switches utilized for
core and edge networking.
3. Wireless: Hybrid environment utilizing Cisco Meraki and Ubiquiti UniFi
access points for secure internal and public Wi-Fi access.
4. Remote Access: NetMotion (Absolute Secure Access) for the Police
Department and VPN L2TP for other remote users.
5. Antivirus
F. Phone System:
1. VoIP Solution: 3CX Phone System (Virtual Machine) utilizing Nuso SIP
Trunks.
2. Hardware: Yealink T46S and T54W handsets deployed across all
departments.
G. SCADA Network: The SCADA network monitors the City's municipal water and
reclamation facilities.
1. Infrastructure: FortiNet firewalls managed by third party (Dorsett) with
specific VMs (InfoScan) isolated on the City network for monitoring.
H. Enterprise & Departmental Applications:
1. Productivity: Google Workspace (primary Email/Collab) and Microsoft
Office 365 (Desktop Apps).
2. Financial/HR: Pelorus DGS & Timekeeper (On-premise SQL).
3. Public Safety: Spillman (hosted by Grand County), Fatpot
(Legacy/Maintenance mode), Axon Evidence (Cloud), and NetMotion for
secure cruiser connectivity.
4. Other Critical Apps: Sportsman (Cloud/Web-based for Rec Center),
ArcGIS (Engineering), and Ascent Compass (HVAC).
I. Physical Security:
1. Access Control: Axis A1001 Network Door Controllers managing
approximately 29 doors across City facilities. Replacing with Unifi Access
Control Units.
2. Surveillance: ExacqVision NVRs (PD Interview rooms) and Lorex/UniFi
camera systems at various facilities.
City of Moab - RFP for IT Security and Services
Page 5

PART 1 - SCOPE OF SERVICES / PROPOSAL REQUIREMENTS - CYBER
SECURITY
The Scope of Services for this RFP is to maintain a robust, proactive IT Security
Program. The selected vendor must provide a multi-layered security approach
("Defense in Depth") to ensure the confidentiality, integrity, and availability of the City of
Moab's data. The solution must meet Compliance-level standards.
Specific Requirements:
The proposal must demonstrate the ability to provide the following security services:
A. 24/7 Security Operations Center (SOC): Provide continuous 24/7/365 monitoring
and response of the City's network environment by a staffed SOC.
B. SIEM & Log Analysis: Deployment of Security Information and Event
Management (SIEM) tools to aggregate and analyze event logs from firewalls,
servers, and endpoints to identify anomalies in real-time.
C. Advanced Endpoint Protection (EDR): Deployment and management of NextGen
Antivirus (NGAV) combined with Endpoint Detection and Response (EDR)
software to detect, isolate, and remediate advanced threats (e.g., ransomware,
zero-day attacks) that traditional antivirus cannot catch.
D. Protective DNS & Content Filtering:
Implementation of a Protective DNS solution (e.g., Cisco Umbrella or equivalent)
to block malicious domain requests at the DNS layer before a connection is
established. The solution must include:
1. Threat Protection: Automatic blocking of known malware, ransomware,
phishing, and Command & Control (C2) callback domains.
2. Roaming Protection: Agents installed on City laptops to enforce security
policies even when devices are off the City network (e.g., employees
working from home or hotels).
3. Content Policy Enforcement: Granular filtering capabilities to block specific
categories (e.g., Adult Content, Gambling) in accordance with City HR
policies.
E. Managed Intrusion Detection (IDS): Continual monitoring of internal and public-
facing infrastructure for intrusion attempts.
F. Vulnerability Management: Continuous vulnerability scanning of the City's IT
infrastructure to identify and prioritize risks for remediation.
G. Automated Patch Management: Management of security patches for Microsoft
Operating Systems and critical 3rd Party Applications (e.g., Adobe, Chrome,
Zoom) to close security gaps.
H. Dark Web Monitoring: Continuous monitoring of the Dark Web for compromised
City credentials (emails/passwords) to prevent unauthorized access.
I. Cloud Security & Backup:
City of Moab - RFP for IT Security and Services
Page 6

1. Configuration and security monitoring of Google Workspaces and
Microsoft Office 365 tenants.
2. Automated, immutable backups for Google Workspaces and Office 365
(Exchange, SharePoint, OneDrive) to protect against data loss in the
cloud.
3. Server Business Continuity (BCDR):
i. Image-Based Backups: Deployment of a BCDR solution for all
critical physical and virtual servers (as listed in the Technology
Profile). Backups must capture the full server state (OS, Apps,
Files), not just files.
ii. Hybrid Storage: Backups must be stored on a local appliance for
rapid restoration and replicated to a secure, compliant cloud
repository for disaster recovery.
iii. Instant Virtualization: The solution must demonstrate the ability to
"spin up" (boot) servers as virtual machines directly on the local
backup appliance or in the cloud to minimize downtime during a
hardware failure or ransomware event.
iv. Automated Verification: Daily automated integrity checks (e.g.,
screenshot verification) to prove backups are bootable and viable.
J. Security Awareness Training: Provision of an ongoing Security Awareness
Training platform for City employees, including automated phishing simulations to
test and educate staff.
K. SCADA & Perimeter Security:
1. Configuration of perimeter security controls (Firewalls/VPNs).
2. Third party interface with vendor who manages the SCADA system, is
limited to access to network through VPN.
3. Maintain segregation of the City's SCADA network (Water/Reclamation) to
ensure isolation from the corporate network.
L. Council Room Audio Visual System:
1. End User Support: Provide technical assistance to designated City staff to
ensure the enable recording, live streaming, and hybrid participation (e.g.,
Zoom/YouTube) of Council meetings.
2. Vendor Liaison: Act as the primary technical point of contact with the
specialized A/V integrator to troubleshoot hardware or configuration issues
with the control systems.
M. Incident Response & Breach Management:
1. Define, create, and execute on a standard Incident Response Plan (IRP)
for phishing, malware, and data breaches.
N. Compliance & Reporting: Real-time visibility into the security posture of the
network, including blocked threats, patch status, and vulnerability scores.
City of Moab - RFP for IT Security and Services
Page 7

PART 2 - SCOPE OF SERVICES / PROPOSAL REQUIREMENTS -
INFORMATION TECHNOLOGY SUPPORT SERVICES
The City requires a proactive Managed Services Provider (MSP) rather than a reactive
break/fix vendor. The Consultant(s) will provide IT Infrastructure Consulting Services
including architectural guidance, technology roadmap insight, technical implementation,
support, and project management related to the following specific areas:
Specific Requirements:
The proposal must demonstrate the ability to provide the following support services:
A. Infrastructure & Server Management:
1. Management and monitoring of the City's hybrid cloud infrastructure,
including on-premise Microsoft Hyper-V clusters (Windows Server
2019/2022) and cloud tenants.
2. Administration of Active Directory, Group Policy, and Azure AD Sync.
3. Management of Storage Area Networks (SAN) and iSCSI targets
(specifically Synology infrastructure) to ensure high availability.
B. Network & Connectivity:
1. Administration of a complex multi-site Wide Area Network (WAN) across
8+ locations.
2. Management of VLAN segmentation to ensure security and traffic
prioritization (e.g., Voice, Data, Guest, SCADA, and CJIS-compliant Public
Safety networks).
3. Support for Firewall infrastructure (SonicWall) and Switching infrastructure
(Ubiquiti/Cisco).
4. Management of wireless networks including Ubiquiti and Cisco Meraki
cloud controllers.
C. Remote End-User & Application Support:
1. Service Desk: 24/7/365 Help Desk support for Windows endpoints.
2. Vendor Liaison Services: Acting as the technical point of contact for
mission-critical third-party municipal applications. This includes
troubleshooting connectivity and facilitating support with vendors for:
i. Public Safety: Spillman, Fatpot, Axon Evidence (Must understand
CJIS compliance).
ii. Utilities/Finance: Pelorus, Sportsman.
iii. Facilities: SCADA, Dorsett Controls, and HVAC systems.
iv. Council Chambers: AV System
3. SaaS Management: Administration of Google Workspace (G-Suite) and
Microsoft Office 365 tenants, including user lifecycle management
(onboarding/offboarding).
City of Moab - RFP for IT Security and Services
Page 8

O. DEDICATED ONSITE STAFFING (STAFF AUGMENTATION):
The City requires a dedicated onsite IT presence to serve as the Primary Tier 1 &
Tier 2 Support for City staff. This role is intended to resolve the majority of end-
user tickets in-person, utilizing the remote support team only for support of any
absences, Tier 3 escalation, project engineering requests, or complex backend
issues.
4. Staffing Requirements:
i. Hours: Provision of a dedicated technician onsite at City Hall for 40
hours per week (e.g., M-F, 8:00 AM - 5:00 PM), plus any overtime
as needed.
ii. Role: This resource will act as the "Face of IT" for the City,
handling:
a. Immediate Response: Instant troubleshooting for Police
Department critical issues (MDTs, vehicle connectivity) and
walk-up requests.
b. Physical Logistics: Deployment of new hardware, cable
management, and asset retrieval for termed employees.
c. Vendor Escort: Supervising third-party access (ISP, HVAC,
SCADA) to secure areas.
d. Meeting Support: Hands-on setup for City Council meetings
(adjusting schedules to accommodate evening meetings as
needed).
D. Voice & Physical Security Support:
1. Maintenance and support of the City's VoIP Phone System (3CX hosted
on Hyper-V), including SIP trunk management (Nuso) and handset
configuration.
2. Underlying network support for physical security systems, including Axis
Door Controllers, Unifi Door Controllers, and IP Camera NVRs
(ExacqVision/Lorex).
E. Strategic Planning:
1. Provide a dedicated resource to assist with budgeting, lifecycle
management, and long-term technology roadmaps.
2. Strategic Business Reviews: Conduct regular reviews to discuss system
health, ticket trends, and future projects.
P. Professional Services:
1. Capability must be displayed by having and executing Information
Technology-related projects with best-practice systems via a formal
project management structure or equivalent, such as a Project
Management Office (PMO).
City of Moab - RFP for IT Security and Services
Page 9

2. A formal leadership structure of professionally appropriate project
management-based leaders should exist. Project Management
Professional (PMP), or equivalent, credentials are strongly preferred.
3. Formal systems to manage project schedule and costs should be utilized
and issues communicated via a standard cadence. Project scoping should
be provided via best practice in formal Statement of Work (SOW)
documents.
4. Project-related tasks should be executed as normal course of action such
as kick-offs, cutover planning, service hand-off and change control efforts.
PART 3 - SCOPE OF SERVICES - ARTIFICIAL INTELLIGENCE GOVERNANCE &
STRATEGY
The City recognizes the growing impact of Artificial Intelligence (AI) on municipal
operations and the risks associated with unmanaged AI usage. The selected vendor
must provide tools and consulting services to help the City harness AI efficiency while
protecting sensitive data (CJIS, PII, and HIPAA).
Specific Requirements:
The proposal must demonstrate capability in the following areas:
A. AI Visibility & Assessment:
1. Ability to conduct technical assessments to identify unmanaged AI
(unauthorized use of public AI tools like ChatGPT) within the City network.
2. Provide reporting on which employees are using AI tools and the potential
security risks associated with that usage.
B. Secure AI Access Platform:
1. Provide a secure, managed platform or gateway that allows City staff to
access Large Language Models (LLMs) while ensuring enterprise-grade
data privacy.
2. Data Privacy Requirement: The solution must ensure that City data (e.g.,
Police reports, HR documents) is not used to train public AI models.
C. Policy & Governance Development:
1. Assist the City in drafting "Acceptable Use Policies" for AI to ensure
compliance with Federal and State regulations.
2. Provide guidance for high-risk departments (e.g., Police Department
usage of AI for case reporting).
D. Training & Education:
1. Provide training resources to educate City employees on the safe and
effective use of AI tools to improve productivity without compromising
security.
PART 4 - REQUIRED SUBMITTAL FORMAT & PRICING
City of Moab - RFP for IT Security and Services
Page 10