69CRC-S3063 (Question & Answers).pdf

Question # Question Answer 1 Can you advise if you are open to working with a Canadian vendor on the above-noted opportunity?

This Open Market Bid is open to accepting bids from Canada and other countries.

2 External Vulnerability and Penetration Testing Clarify Scope: Identify the specific number of external IPs to be tested in each category. For example: How many active services or applications are exposed on the 451-500 IP range? Testing Depth: Will this be a black-box, gray-box, or white-box assessment? Should scanning be limited to identifying vulnerabilities, or should proof-of-exploit be demonstrated? Technology Requirements: Are there cloud-hosted or hybrid environments in scope? Do IP ranges belong to separate subnets or a unified environment? Remediation Validation:

Should remediation assistance and follow-up testing be included for high/critical findings? Internal Vulnerability and Penetration Testing Infrastructure Details: Are internal IP ranges virtualized, segmented, or flat? What operating systems, devices, and platforms make up the IP ranges? Access Requirements: Are there jump boxes or VPN access points required for internal testing? Is privileged access provided for scanning critical systems? Scope Clarifications: Will all VLANs and subnets need individual segmentation testing? Priority Areas: Are there specific mission-critical systems or applications that require focused testing?

External IPs: 1 Testing level: Black box testing Scanning: identifying vulnerabilities We have hybrid environments We have separate subnets No remediation assistance needed Internal IP ranges are virtualized and segmented Operating systems Windows, Mac, Linux and Mobile devices No jump boxes or VPNs needed for internal testing All VLANs and subnets need individual segmentation testing

3 Phishing and Vishing Engagements Phishing Scenarios: What types of phishing are required (e.g., credential harvesting, malware delivery)? Should custom payloads or domain spoofing be used? Target Groups: Are there high-value targets (e.g., executives) requiring tailored campaigns? Should department-based phishing metrics be gathered? Campaign Metrics: What KPIs are critical (e.g., open rate, click rate, credential submission)? Vishing Specifics: What roles will the five employees hold (e.g., helpdesk, HR)? Are specific pretexts (e.g., IT support calls) mandated? Web Application Vulnerability and Penetration Testing Application Details: For large, medium, and small applications: What frameworks, programming languages, and platforms are in use? What types of data do these applications handle (e.g., PII, financial)? User Roles: Will credentials for different user roles be provided? Should horizontal and vertical privilege escalation be tested? Test Boundaries: Should testing include backend systems or be limited to the application interface? Are third-party integrations in scope? Wireless Vulnerability and Penetration Testing Network Configuration: Are there multiple wireless SSIDs (e.g., guest vs. corporate)? What encryption protocols are in use (e.g., WPA2, WPA3)? Testing Depth: Should rogue device identification include active deauthentication attacks? Are there known interference risks during testing?

We aim for this risk assessment to adhere to industry standards and best practices, as it will establish a strong foundation for enhancing our agency's overall security posture and addressing corrective actions recommended during our recent audit. For phishing and vishing engagements, we are looking for realistic and comprehensive testing that provides actionable insights into vulnerabilities across various agency levels. We encourage you to apply your expertise in tailoring practical scenarios and reflecting on current threats.

For the broader testing efforts, we expect a thorough approach that holistically examines potential risks and vulnerabilities, ensuring critical areas are addressed while maintaining minimal disruption to operations. This assessment is new territory for us, and we trust your judgment in applying proven methodologies and frameworks to deliver meaningful results that meet the required recommendations we were given.

4 Pricing Considerations Deliverables: Confirm whether deliverables include detailed findings, screenshots, network maps, and recommendations for all tests. Follow-up:

Should pricing account for remediation re-testing or ongoing support? Resource Allocation: How many team members or consultants are expected for each type of test? Testing Timelines: What are the expected timeframes for each category, and are there penalties for delays?

This request is for a formal risk assessment and a report with detailed findings, screenshots if applicable, network maps, recommendations, and other items listed in the scope of work are needed. Pricing does not need to include remediation re-testing or on-going support.

5 1. How many live and "in use" public IP addresses (how many total external hosts) does CRCNV have that would be included in this testing?

One

6 2. How many live and "in use" internal IP addresses (how many total internal hosts) does CRCNV have that would be included in this testing?

Approximately 85

7 3. Can a breakdown of the total number of "in use" internal IP addresses across the SilverNet, Wi-Fi, IoT, and Surveillance Camera networks be provided?

SliverNet: ~70, Wi-Fi ~1-10, IOT ~6, Surveillance ~5

8 4. Regarding the requirement to provide authenticated application vulnerability scanning and penetration testing, how many applications are there that will be subject to this authenticated testing?

Approximately 5 including some in-house web-based applications

9 5. Regarding the requirement to provide authenticated application vulnerability scanning and penetration testing, are these applications custom home-grown web applications or commercial off-the-shelf solutions? If there is a mix, can a breakdown be given?

There is a mix. 3 are commercial and 2 are in-house web applications

10 6. Regarding the requirement to perform wireless scanning of both private and guest networks, is CRCNV wishing to have a wireless protocol security testing phase where CRCNV's wireless security protocols (such as WPA, WPA2, WPA3 etc) and associated configurations are analyzed and subjected to penetration testing, or is the desire simply to include any wireless devices in network penetration testing (aka no actual testing of the wireless security protocols in use)?

Please include the wireless devices in the penetration testing. The wireless security protocols do not need to be tested.

11 7. How many wireless networks would be subject to wireless protocol security testing?

None

12 8. Of the wireless networks that are to be subject to wireless protocol security testing, are they all physically located at the same site? If not, how dispersed/spread out are the different networks to be tested (IE, how much drive time is required to drive between each site that needs to be tested)?

No protocol testing needed but all wireless are at the same site.

13 Does CRCNV want a firm, fixed price for the assessment or hourly rates only? Hourly rates or a package with hourly rates if needed.

14 Scope items ii.1, Penetration Testing, and iii.1, Perimeter Testing, appear identical. If they are not identical, how do they differ?

It is our understanding that perimeter testing checks the outer defenses of a network like firewalls and external-facing systems, to see if they can block unauthorized access.

Penetration testing, to our knowledge, goes deeper by simulating an actual cyberattack to find vulnerabilities not just at the perimeter, but also inside the network.

Perimeter checks the windows and doors to ensure they're locked.

Penetration tests the lock-picking ability to actually get inside.

15 Are firewall configuration reviews in scope? If so, how many firewalls should we expect to test? Of these, are any paired or in high-availability mode?

One firewall configuration review.

16 Are router/switch configuration reviews in scope? If so, of how many devices? Is a sampling approach acceptable?

Yes. ~6 switches, 1 router

17 Are server configuration reviews in scope? If so, how many unique operating system brands and versions are in scope?

4 different OS's

18 How many mission-critical applications are in scope for security scans? Are these limited to public-facing web applications?

3, these are not limited to public-facing web applications

19 Is segmentation testing limited to the IoT and surveillance camera networks? No

20 How many SSIDs are in scope for the wireless scanning? Are these shared across locations? If not, how many locations will we need to visit to conduct testing?

2, both at the same location.

21 How many users should we target with the social engineering tests? With approximately 40 total users, the anticipation would be all of them.

However, if you feel that a sample would be more efficient and offer a valid result, please indicate that.

22 Does CRC have documented IT policies and procedures? Are the policies and procedures aligned with the NIST CSF?

The CRC is currently developing standalone, documented IT policies and procedures. This risk assessment is a critical step in addressing that gap, as it will inform the development of comprehensive policies and procedures aligned with recognized frameworks. While the State of Nevada has established standards that the CRCNV adheres to, this effort aims to ensure our agency’s practices are consistent with those standards and tailored to meet our specific operational needs and improve overall cybersecurity resilience.

23 When was the last maturity assessment against the NIST CSF performed? The State of Nevada followes NIST standards and applies them to the CRCNV, we do our best to follow them

24 Approximately how many IT staff members does CRCNV have? 3

25 How many internal IPs are in scope for penetration testing? How many external IPs? ~85 internal, 1 external

26 Is this contract for an MSA or a specific project? Specific project

27 1) Who controls cyber policy and network architecture? 2)Who is responsible for OA&M of each network IT/OT? and 3)Are network component choices uniform across both sides or different? (OT gear is often hardened environmental resilient vs.

IT gear which is Data Center focused and high performance leaning.)

The State of Nevada sets standards and some policies. The CRCNV sets the rest. The CRCNV is responsible for the O&M of the majority of the the network. There are no OT components in this assessment. You might look at our other request for bid #69CRC-S3055.

28 1) There are 5 network systems mentioned in order to align resources, do these assessments need to run in parallel or in series? and 2)Does the main control room require a Physical Security assessment?

Assessments can be run in parallel, however there are not 5 networksand ther is not a main control room You might be refering to our other request for bid #69CRC-S3055.

29 Have the regional utilities had an assessment on their IT/OT and will that info be available to us?

There are no OT components in this assessment. You might look at our other request for bid #69CRC-S3055.

30 1) How large is the in-scope network? 2)How many network devices would we need to assess? 3)What OEM is the switching, networking, and security components? 3) Does your organization have tool(s) preferences?

1) ~85, 2) 7 networking devices, 3) We do not wish to provide details on components at this time, 4) No tools preference.

31 Can you provide the BES Cyber Systems Categorization (CIP-002-5) for the systems? Or is the goal to have them reassessed to meet v5 categorization?

Some of the current systems lack written documentation. This assessment is to include categorization of all systems.

32 Are OT components expected to be included in pentest scope? Or will the scope focus on only IT systems If included, do contingency plans exist if tests impact critical systems?

There are no OT components in this assessment. You might look at our other request for bid #69CRC-S3055.

33 Please clarify if 500K to 1.5M provided is an annual or total price estimate? This bid request is a total price not an annual cost of the contract.

34 Will there be an opportunity for the contractor to assist with the implementation of the recommendations or remediation actions identified in the risk assessment, or is this scope limited to assessment and reporting only?

This request for bid is limited to assessment and reporting only.

35 What level of involvement and availability should be expected from the CRCNV IT and PDG teams during the risk assessment process, particularly for interviews, data collection, and testing?

The CRCNV IT team will be available at your request pending an emergency or manatory meetings.

36 Can you confirm whether any existing network diagrams, asset inventories, or system documentation for the listed networks (CorpNet, ManageNet, SCADANet, RevNet, and Wonderware Modbus Plus Network) will be provided to the vendor as a baseline for network mapping? If so, how comprehensive is the current documentation?

These networks are part of our other request for bid #69CRC-S3055.

37 During the mapping phase will passive and active tools be allowed to be used? Yes

38 Will the vendor have access to configurations from network devices, OT devices, OT systems and IT systems to aid in the network mapping phase?

Yes for this request although there are no OT components in this assessment. You might look at our other request for bid #69CRC- S3055.

39 Approximately how many in scope systems exist within each of the five networks. There are not 5 networks in this request You might look at our other request for bid #69CRC-S3055. This bid has following networks:

SliverNet: ~70, Wi-Fi ~1-10, IOT ~6, Surveillance ~5

40 For critical systems and devices will non production systems such as those in a test range\lab or at a site that is none production (under maintenance) be provided?

No

41 What impact levels does the NERC CIP program cover? Is a control center(s) and its assassinated datacenter(s) in scope?

NERC CIP does not apply to this request. You might look at our other request for bid #69CRC-S3055.

42 Can you provide the inventory counts of devices (e.g., servers, endpoints, networking equipment) connected to SilverNet and CoxNet?

~85 SilverNet, ~15 CoxNet

43 Is any part of the network hosted in a cloud environment? If yes, what services (e.g., AWS, Azure, GCP) are in use?

Yes, Micosoft Office 365