REQUEST FOR PROPOSAL FOR CYBER LIABILITY INSURANCE

Description: The State of Rhode Island ("State") Office of the General Treasurer ("Treasurer") in conjunction with Employees' Retirement System of the State of Rhode Island ("ERSRI") are issuing this Request for Proposals ("RFP"). ERSRI administers retirement, disability, and survivor benefits for public employees across the state, including state workers, public school teachers, and many municipal employees. Established in 1936, ERSRI has grown into a centralized office responsible for managing member services, benefit calculations, and the oversight of multiple pension plans. Over the years, the office has expanded its administrative capabilities, modernized its operational systems, and strengthened governance practices to support a diverse and evolving membership base. ERSRI continues to focus on service excellence, financial stewardship, and secure, efficient administration of retirement benefits for Rhode Island's public workforce. ERSRI seeks cyber liability insurance coverage designed to protect the organization against financial loss, operational disruption, and reputational impact resulting from cybersecurity incidents. This coverage should address risks associated with unauthorized access, data breaches, malware, ransomware, business email compromise, and other cyber-related events affecting ERSRI's information systems, member data, and third-party integrations. The insurance must provide first-party coverage for incident response, forensic investigation, data restoration, system recovery, notification services, regulatory compliance, and crisis communications. ERSRI also requires coverage tailored to the unique responsibilities of a public retirement system, including protection for sensitive member records, fiduciary obligations, and interactions with state-managed IT infrastructure. ERSRI would like quotes for a term length of one (1), three (3) and five (5) years of coverage to compare and choose the best fit for the organization. Scope of services required by ERSRI includes, but is not limited to: 1. Cyber Liability Insurance. Minimum Qualifications: 1. Coverage is required for the following items at the following limits: - Aggregate Policy Limit of Liability: $10,000,000.00 - Ransomware and Cyber Extortion Limit: $10,000,000.00 - Data Recovery and Computer Replacement Costs: $10,000,000.00 - Direct Business Interruption for Security, Systems Failure: $10,000,000.00 - Voluntary Shutdown Interruptions: $10,000,000.00 - IT Provider Security or Systems Failure: $10,000,000.00 - Non-IT Provider Security or Systems Failure: $5,000,000.00 - Reputational Harm Loss: $10,000,000.00 - Proof of Loss Preparation: $250,000.00 - Funds Transfer Fraud and Social Engineering: $250,000.00 - Service Fraud Including Cryptojacking: $250,000.00 - Impersonation Repair: $250,000.00 - Network Security and Privacy Liability: $10,000,000.00 - Funds Transfer Liability: $10,000,000.00 - Media Liability: $10,000,000.00 2. Agreement must include the following: pre-incident risk management, immediate technical incident response, and post-breach financial, communication and legal support. 3. Quotes should be given for as many of these terms as possible: coverages for one (1), three (3) and five (5) year agreements. Information requested from respondents includes contact information for the individual(s) responsible for the response; a description of the firm including background, experience, organizational history and ownership structure; the firm's experience and qualifications in cyber liability insurance; identification and qualifications of assigned employees; a list of any subcontractors and their roles; three references with entity name, contact and description of services; any additional topics the respondent wishes to bring to the Treasurer's attention; and a certification regarding whether AI was used in preparing the response and that qualified human reviewers provided oversight. Proposed fees must be provided in a separate document and include an itemized list of all costs and fees associated with one (1), three (3) and five (5) year agreements. Fees are material to the award but are only one factor in evaluation. The Treasurer and ERSRI reserve the right to negotiate fees and request best and final offers. The RFP includes a selection schedule with the RFP issued on 10-30-2026, deadline for respondent questions 11-27-2026, responses to questions due 12-4-2026, proposals due 12-17-2026 by 4:00 PM EST, and selection anticipated 1-15-2027. The Issuing Officer and sole point of contact for this RFP is Justin Miller, Director of Cybersecurity, Rhode Island Office of the General Treasurer. Respondents should follow the format and instructions in the RFP; proposals must include substantial evidence of the respondent's ability to undertake the services. The Treasurer and ERSRI reserve rights to request additional information, conduct interviews or site visits, accept or reject proposals, waive immaterial defects, negotiate with qualified sources, or cancel the RFP at any time. Proposals become the property of the Treasurer and ERSRI. Confidentiality and public records treatment are governed by applicable Rhode Island law; respondents claiming portions of their proposal as non-public must follow the redaction/submission process described in the RFP.