Wichita Vendor Cybersecurity Rules for City Contracts
Vendors contracting with the City of Wichita, Kansas must understand how the city approaches cybersecurity in procurement, what contractual obligations may be imposed, and which departments handle compliance and complaints. This article summarizes where the city publishes requirements, how enforcement typically works, the application steps for vendors, and practical action items for cybersecurity in city contracts.
Scope of Vendor Cybersecurity Requirements
The City of Wichita embeds cybersecurity expectations in procurement documents, contract terms, and information-technology policies administered by Procurement Services and the city Information Technology department. Vendors should review RFP/RFQ terms and contract attachments for any required standards, incident notification timelines, and data-handling clauses. [1]
Typical Contract Terms to Expect
- Data classification and handling obligations for city data.
- Incident notification requirements and timelines.
- Audit, access, and recordkeeping provisions for security reviews.
- Contract remedies language allowing withholding, setoff, or termination for security breaches.
Penalties & Enforcement
The city enforces cybersecurity obligations primarily through contract remedies and administrative actions. Specific monetary fines tied to cybersecurity breaches are not specified on the cited procurement or IT policy pages; consult contract terms for liquidated damages or fee schedules. [1]
- Monetary fines or liquidated damages: not specified on the cited page.
- Contract escalation: first breach may trigger cure notices, repeated or continuing breaches may lead to termination or withholding of payments; exact escalation procedures depend on contract language and are not fully specified on the cited pages.
- Non-monetary sanctions: suspension or termination of contract, corrective-action orders, required remediation, and possible revocation of vendor eligibility.
- Enforcer: Procurement Services and the City Information Technology department handle compliance, investigations, and vendor restrictions. Report concerns to the official procurement or IT contacts. [1]
- Appeals and review: contract documents typically specify protest and appeal procedures and time limits; if not in the contract, standard procurement protest deadlines apply per Procurement Services guidance. Exact appeal time limits are not specified on the cited pages.
- Defences and discretion: the city may allow cures, mitigation plans, or approved variances where contracts permit; specific discretionary standards are contract-dependent.
Applications & Forms
Vendors should register with Procurement Services, respond to posted RFP/RFQ documents, and submit required security attachments when requested. The procurement site posts vendor registration and solicitation documents; specific cybersecurity compliance forms are not universally published and may be attached per solicitation. [1]
Action Steps for Vendors
- Review RFP/RFQ attachments and the draft contract for incident notification timelines and reporting requirements.
- Prepare a written incident response plan and a data-handling exhibit to attach to proposals.
- Register as a vendor with Procurement Services and ensure contact information is current.
- Designate an incident contact and escalation chain for the city to reach out to in case of a breach.
Common Violations
- Failure to notify the city within contractual timelines following a breach.
- Inadequate data protection leading to unauthorized disclosure of city data.
- Non-compliance with contractual audit or remediation obligations.
FAQ
- Do vendors need to follow specific cybersecurity standards for Wichita contracts?
- The city requires vendors to meet contractual cybersecurity obligations; specific named standards (for example, NIST or ISO) are included when stated in individual solicitations or contracts, otherwise not specified on the cited procurement pages.
- Who investigates reported cybersecurity incidents involving vendors?
- Procurement Services coordinates contract enforcement and the Information Technology department manages technical investigation and containment; contact details are provided by the city procurement and IT offices. [1]
- Are there published fines for cybersecurity breaches?
- No uniform monetary fines for cybersecurity breaches are published on the cited procurement or IT policy pages; remedies are determined by contract terms and applicable law.
How-To
- Before bidding, download the solicitation and all attachments and search for security, data, or incident clauses.
- Prepare a tailored security exhibit describing controls, encryption, and notification procedures.
- Register with Procurement Services and submit the proposal with the required attachments by the stated deadline.
- If awarded, keep security documentation current and notify the city immediately per contract terms if an incident occurs.
Key Takeaways
- Cybersecurity requirements are contract-specific; always read attachments closely.
- Procurement Services and IT are the primary contacts for compliance and incident reporting.
- Maintain a written incident response plan and vendor security exhibit to speed compliance.
Help and Support / Resources
- Procurement Services - City of Wichita
- City Information Technology Department - Wichita
- City Clerk - Ordinances and Code Access