Specifications include, but are not limited to: Managed Cyber Security Services include: Risk Assessments Incident Response Cyber Security Awareness Education Penetration Testing Vulnerability Assessments Cyber Security Consulting Virtual CISO Enhancement Internet of Things (IoT)/BioMed Device Security Services Management The following are specifically not within the scope of this RFP: Management of ECMCC Cyber Security systems, applications and/or environments. Management of the Cyber Security Program at ECMCC. Monitoring of ECMCC systems, cyber or otherwise. Respondents must additionally meet the following requirements: Respondents must be product agnostic and not a product vendor for a specific system or application. Respondents must have a physical and staffed office located in New York State.