Bid Kit
What a procurement officer needs to know about Security Medic Consulting, in one place
A procurement officer adding a new firm to a bidders list, checking a vendor before an award, or deciding whether to invite a quote usually needs the same few facts. They are below. Anything not listed here is answered in our response to each solicitation, or by email.
Company details
- Legal name
- Security Medic Consulting, LLC
- Name in the SAM.gov registration
- Security Medic Consulting Limited Liability Company
- Organized in
- New York
- Based in
- Poughkeepsie, New York
- Service area
- New York first; also New Jersey, Connecticut, Pennsylvania, Massachusetts and Vermont. Remote delivery, on site as needed.
- Teaming
- Prime contractor or named subcontractor
- Contact for solicitations
- support@securitymedic.com
Our Unique Entity ID (UEI) and a capability statement are available on request from support@securitymedic.com.
NAICS codes
Most state and local solicitations do not ask for these, but vendor systems and federal forms do.
- 541690 Other Scientific and Technical Consulting Services
- 541611 Administrative Management and General Management Consulting Services
- 541512 Computer Systems Design Services
- 541519 Other Computer Related Services
What we provide
Cybersecurity risk assessment
NIST CSF 2.0 current and target profiles, gap analysis, a prioritized plan of fixes, and executive and board reporting.
Virtual CISO and security program management
Risk register, plans of action and milestones (POA&M), governance committee support, and quarterly and annual reporting.
Policy and planning
Information security policies, incident response plans, business continuity and disaster recovery plans, business impact analysis, and tabletop exercises.
Third-party and vendor risk
A vendor risk method, security review of technology purchases and contracts, and yearly reassessment of critical vendors.
Privacy
Privacy programs, HIPAA security risk analysis, 42 CFR Part 2 consent and record reviews, and Education Law § 2-d and Part 121 data security and privacy plans.
AI governance
AI use policies and AI risk assessments aligned with the NIST AI Risk Management Framework.
Water and wastewater cybersecurity
Readiness for the New York Department of Health and DEC cybersecurity rules, and NIST CSF 2.0 assessments for EFC SECURE grant recipients.
Every engagement has one accountable senior lead, and runs on our own GRC platform as the organization’s system of record. The organization owns its data and receives a full export at the end of the engagement. We do not install or operate tools, perform penetration tests, give legal advice, or certify on the organization’s behalf.
Policies a procurement officer should know
Insurance
Certificates of insurance are available on request.
References and client confidentiality
We do not publish client names, stories or testimonials. Where a solicitation asks for references or past performance, our response addresses it directly.
Pricing
Prices are set for each scope and stated in the proposal or bid. We do not publish rates.
Contract terms
One-off work, month to month, or a 3-, 6- or 12-month commitment; or the term the solicitation sets.
How public bodies can work with us
Through an RFP
We respond to solicitations as the prime contractor or as a named subcontractor on another firm’s team.
Direct purchase
Where the organization’s procurement policy allows a direct purchase or quotes, we provide a written proposal for the scope.
Grant-funded work
When a grant pays for an assessment or plan, we scope the work to the grant’s conditions and reporting.
Procurement officers will find our company details and what to expect in a response in the bid kit.
Before an RFP
If a solicitation is still being planned, a free 30-minute call or the free assessment can help define the scope. There is no cost and no obligation.
Questions about a solicitation?
Book a free 30-minute call, or write to support@securitymedic.com.
Book a free call