Addendum 2 - 1-17-25.pdf

CHIPPEWA VALLEY SCHOOLS

“Inspiring and empowering learners to achieve a lifetime of success.”

19120 Cass Avenue Clinton Township, MI 48038

Phone: (586) 723-2150, Fax: (586) 723-2128

ADDENDUM 2

January 17, 2025

District Cybersecurity Assessment

RFP 9.2425

This addendum is to clarify questions received via email and during the Pre-Bid meeting held on January 9, 2025, regarding RFP 9.2425 District Cybersecurity Assessment and provide answers, which shall be considered part of the official bid documents.

Please note:

• The Bid deadline and opening has been extended. All Bids are due no later than February 7, 2025, at 10:00 a.m., EST. Late Bids will NOT be accepted.

• Last day to submit questions via email is seven (7) days prior to bid opening – January 31, 2025, at 5:00 p.m., EST.

o If applicable, any additional questions received will be addressed in a final addendum to be posted by February 4, 2025.

• There is a June 30 deadline for all parts of this project to be completed as well as billing submitted.

• Deliverables in this project include a detailed vulnerability report, executive summary report, recommended remediation steps, debrief meeting with technical staff, and presentation to District stakeholders.

• Vendors may include in the Bid additional services they would recommend beyond the initial scope of work. Please include itemized pricing for these services in your Bid Proposal.

Questions and Answers

1. Please provide a list of assets that are to be tested as part of the scope of this bid:

Asset Count

Internal IPs See Subnet Table (Page 10)

External IPs 12 (/24 subnet)

VLANs See Subnet Table (Page 10)

Subnets See Subnet Table (Page 10)

Wireless Access Points 1500

Number of Buildings 23

2. What is not included in the scope of the bid?

a. Phishing, application testing, technology policies and procedures are not included in the base scope of work. If you have any other specifics you would like to address, please email.

3. Are there systems the District would like the vendor to show vulnerabilities versus actually testing the vulnerability?

a. Show vulnerabilities, we do not want actual breaches during the process.

4. Any systems the vendor should not access during the project?

a. No - all systems can be a part of this assessment.

5. Are any cloud resources included in the scope of work?

a. No.

6. Does the scope of work include testing backups?

7. What prompted the bid / project?

a. The District wants to be proactive in terms of security and grant funding provided an opportunity for the work.

8. Are any third-party integrations being tested as part of the scope of work?

9. Is all technology supported internally?

a. Yes, District staff manages all District technology and have access to needed systems. There are no third parties managing District technology.

10. Will Wi-Fi networks be tested as part of this project?

a. Yes, wireless networks should be tested for vulnerabilities as part of the scope of work. See

Question #1 for detailed numbers.

11. Does the District expect vendors to conduct social engineering / phishing simulations as part of the project?

a. No, the District currently performs phishing simulations and provides training using

KnowBe4.

b. Vendors may offer more sophisticated options as a voluntary alternate in their bid proposal.

12. Is automated AI based PEN testing acceptable?

a. An AI based proposal is acceptable as part of your proposal, but the District prefers human testing and interaction.

13. What level of testing is the District expecting? Are you looking for us to test script kiddie or APT testing?

a. The threat we focus on most is students trying to get around our filtering and device management. We also want to see what other systems/infrastructure they may be able to access and possibly do damage or disruption to. Script based threats are more common and should be the focus. Testing for more advanced APT threats would be an acceptable proposal for consideration.

b. The District’s perspective – we would like to see a vendor sit with a student computer and

District account and see where you can get and what holes you find. Repeat this with a personal device connected to our network using student and staff credentials.

i. This testing would need to be done on both domains joined and InTune managed

District devices.

14. Does the district want a review of technical policies and procedures as part of this contract?

a. The focus of this assessment should be on vulnerability scanning, but a review of policies and procedures would be an acceptable addition. This can be offered as part of the main bid or as a voluntary add item.

15. Is application testing expected as part of this contract?

16. Is testing of District Wi-Fi expected as part of this scope of work?

a. Yes.

17. Can there be an extension of the submission deadline?

a. We will look into this, but missing the February 3rd Board meeting could mean delaying start of project until April which leaves less time for project completion deadline of June 30.

b. Update after pre-bid meeting: Bid opening has been extended to February 7, 2025 at 10:00 am EST.

18. What is the project budget? Is there a funding/financial/budget range estimated that can help us to provide a quotation for this project?

a. The grant award is approximately $27,000. The District may fund some additional costs out of operational funds but would prefer to stay within the grant amount.

19. What is the preferred timeframe to perform penetration testing during the week?

a. Timeframes will be dependent upon the test. Some will be better executed during school hours. If the testing might disrupt access / learning, it would need to be scheduled after hours. The exact schedule for various tests can be worked through with the District and the awarded vendor after award.

20. Do all resources / people need to be onsite?

a. Some testing will require the vendor to be onsite. If the testing can be conducted with fidelity remotely, the District would be open to remote work when appropriate. Details of this can be discussed further after award of project.

21. Do you need resumes for all of the support people for this project?

a. No, but we are asking for an overview of the company as well as references, especially any schools you have worked with.

22. Is there an incumbent contract? If yes, what is the name and what work has been done?

a. There is no incumbent contract. This will be a new project for the awarded bidder.

23. Is this a single award or multiple award project?

a. Work will be awarded to a single contractor.

24. What is the total number of resources the client is expecting to work on this project? Please let us know the position name and hourly rate.

a. That is up to each individual vendor. Keep in mind the project is to be completed, with all deliverables and billing by June 30, 2025.

25. If only one candidate is required, can we propose multiple candidates as options in case one resource is unavailable?

a. Yes. It would be helpful to know and meet the project manager during post-bid meetings, but the awarded vendor can assign people to the job and change if needed.

26. Is the project entirely onsite or can it be done remotely to some extent?

a. We are open to remote work for this project. We would prefer that at least the initial and final meetings be in person. Some testing will require onsite work.

27. If interviews are scheduled, will it be for the resource personnel only or for a team from the company including a company representative?

a. Each company can decide who to send to post-bid meetings. The District would like to meet the proposed project manager, if possible, and other company staff are welcome to attend.

Virtual attendance for post-bid meetings is an option but the District would prefer in person whenever possible.

b. The District would like at least one technical representative in attendance at post-bid meetings.

28. If we are shortlisted for interviews and if our proposed personnel are not available, can we propose alternate resources for interviews?

a. Yes, each vendor can decide who is most appropriate and available to attend post-bid interviews. We ask that at least one technical person and project manager attend post-bid meetings.

29. Please confirm if we need to provide live resumes for the key personnel or if sample resumes will work for now?

a. We do not expect individual resumes to be submitted as part of the bid proposal. We would like information on the company as a whole and references for clients the company has performance similar work for. If education references are available, that would be preferred. If not, any company for whom you have performed similar work is acceptable.

30. What internal devices or technologies are being used?

a. Windows 10 devices (a few Windows 11)

i. A small number of iPads for select students

b. Windows servers

c. Active Directory

d. InTune and CCM for device management

31. Can all disparate physical location networks be accessed from a single network location?

32. How is instructional technology integrated with your network infrastructure? Are there specific security considerations for these platforms given your focus on instructional technology?

a. Instructional App management varies by program. Some connect via API with our student information system, some SSO with Microsoft, and some with AD. We use ClassLink to manage many of the apps and provide students with access in a central location. In terms of security, we consider data privacy as well as ports accessed and other potential security considerations.

33. How do you ensure consistent security across varying user groups and devices, especially students?

a. Active Directory is used to assign access to security groups.

b. Devices are centrally managed via InTune and / or CCM. GPOs also are in place and role and device-based rules for internet access.

34. Are education-focused recommendations required?

a. We would prefer education specific recommendations as the unique nature of the population we support has considerations and needs that differ from a corporate environment.

35. What specific measures are in place to protect student information during the assessment and beyond?

a. There will not be special measures put in place as the point of the assessment is to test current security.

36. What content filtering and network monitoring are currently deployed?

a. The district employs two methods of content filtering:

i. URL filtering via firewall

ii. Cisco Umbrella

b. The district employs several different technologies for network monitoring including:

i. Cisco Meraki Dashboard

ii. Splunk

iii. Nessus

iv. Lansweeper

37. How do those integrate with your overall security posture?

a. We continually monitor devices connected to the District network and potential threats.

38. Are you exploring or piloting any emerging technologies such as AI / AR that might have security implications?

a. We are not currently using AR in classrooms. We have almost all AI blocked for students, but open for staff. Students have access to some AI tools built into other programs such as

Canva. High school students have access to ChatGPT.

39. Will you be able to host a VM or can we provide a device that can be connected to the network that we can access with a VPN during testing?

40. Will we have temporary access to all network devices?

41. Are there any custom internal websites or specific applications we will be testing?

42. Are there any websites, APIs, applications, or mobile sites to be tested? If yes, please provide quantity.

43. Based on this call, are we adding wireless network assessment and policy and procedure review to scope of work? Will there be an addendum defining final scope of work?

a. Wireless should be tested as part of this project.

b. Policy and procedure review can be offered as a separate line item and voluntary alternate within your bid but is not a part of the original scope of work.

c. This Q&A and addendum will suffice as clarification on scope of work. Feel free to offer any services you feel are important but not included as voluntary alternates with line-item pricing specified in your bid proposal.

44. Any grant requirements that are a must?

a. The awarded vendor cannot be banned from doing work with the federal government.

b. Project completion deadline, including final billing, must be completed by June 30, 2025.

45. Will the assessment include a data exfiltration test to evaluate the effectiveness of your DLP solution and its alignment with school content monitoring guidelines?

a. No

46. How much (%) of the infrastructure is in the cloud?

a. Cloud-based infrastructure will not be included in the assessment.

47. In the IT department/environment, how many employees work?

a. 18 – this includes four technical administrators, 4 instructional administrators, one director, and 9 help desk technicians.

48. Do you manage your own data center, or do you utilize any third-party/colocation facilities?

a. We manage our own data center.

49. How many locations are in scope for wireless network testing?

a. 23

50. Is the wireless network controller-based?

51. Is detailed (application-layer) web application testing included in the scope? If so, how many applications?

a. None

52. Approximately how many documented IT security policies are in place? When were they last reviewed and updated?

a. We are not asking for a policy review as part of this work.

53. Is Chippewa Valley Schools asking for separate reports for the external and internal network assessments? The RFP mentions a “standalone external assessment report”. Do you want a separate report for each network or a cumulative findings report?

a. External testing is not part of the base scope of the bid. Bidders can offer external assessment as a voluntary alternate for this bid. If the District chooses this alternate, we will want separate reports for internal and external assessments.

54. Bid Requirements, Tentative Timetable – Would Chippewa Valley consider a one-week extension to the Bid Opening Date?

a. The deadline has been extended as described above and in bid amendment one.

55. General Scope of Work - Can you please list the estimated number of live IPs in scope for internal testing?

a. See Question #1 and subnet table at end of document.

56. Under Bid Requirements, General Scope of Work, are all IP’s reachable from a single network location? If not, how many locations are in scope?

a. Yes, all IPs are reachable from a single network location.

57. List the internal network address ranges in scope for internal testing (IPs / Subnets)?

58. Where does this environment reside? Please specify specific providers.

a. Local

59. What is the desired infrastructure your networking team would like to utilize to establish a remote point of presence? Options include: Site-to-Site VPN, VMware OVA, AWS AMI.

a. We have VPN setup with Duo for MFA that can be used for work acceptable to be completed remotely. Anything needing to be done that needs to be tested as a user onsite needs to be done onsite as an actual person, i.e. student, or visitor.

60. Are internal network security controls configured to block known scans and attacks?

a. No scans are blocked.

b. Attacks may be blocked by Microsoft Defender or ESET on the endpoints.

61. Are there any vulnerability or security scans that occur normally? E.g. Rapid7, Nessus, SolarWinds, etc.

a. Yes, Nessus runs weekly against the server IPs.

62. Do you utilize an MSSP/SOC to monitor your infrastructure? If so, will you notify them of testing?

63. Would you be willing to authorize us to bypass these security controls through a whitelist approach (after documenting their effectiveness) to provide a more thorough and comprehensive review of the technology behind it?

a. The District wants the current controls / security in place to be tested. We won’t open things up, we want any holes to be identified and to know the consequences and remediation options of a potential breach of security control.

64. Please confirm if it is a requirement to have HVAC and SCADA Systems tested? If yes, what type of system(s) and how many devices?

a. Yes. Tested like all other systems. See Question #1 and subnet table at end of document.

Device agnostic testing.

65. Would Higher Education references be acceptable in place of K-12 references?

a. The district would prefer K-12 references, if available. If no K-12 references are available, higher education or business references for whom you have completed similar work is acceptable.

66. If systems are hosted outside the client managed network, please specify which hosting/cloud provider hosts these systems?

a. We are not asking for any systems outside our network to be tested.

67. Have you received authorization for testing from the provider?

a. N/A

68. List estimated number of live IPs in scope for external testing.

69. List the external network address ranges in scope for external testing (IPs / Subnets)?

70. Are external security controls configured to block known scans and attacks? E.g. Firewall, WAF, etc.

71. Full network assessment: What type of assessment would you like performed? Should this assessment focus on specific topics, such as IoT, Cyber Risk, or Zero Trust? If so, please specify.

a. Cyber Risk on internal systems.

72. For the vulnerability assessment: How many active IPs and Assets are included in this assessment?

a. See Question #1and subnet table at end of document.

73. Are there any specific crown jewels (critical assets or sensitive information) within the internal network that should be prioritized during the test?

a. None

74. Internal network security assessment: Is the request for to evaluate controls and frameworks like

NIST, CIS, or NIS2? If so, please specify.

a. CIS would be the preferred framework.

75. Internal penetration testing: How many active IPs and Assets are included in this assessment?

76. How many servers and endpoints should be included in the scope of the internal penetration test?

77. Do you want us to perform authenticated testing (with credentials) on the internal systems?

a. Yes, we will provide credentials.

78. Would you like us to conduct unauthenticated testing on the internal systems, simulating an attacker who has connected their computer to any available port in the network, using a Kali

Linux machine?

79. Are there any limitations or restrictions we should be aware of when conducting the internal pentest (e.g., certain IP ranges to be excluded from testing)?

80. Are there any specific areas or systems within the internal network that require extra attention during the penetration test?

a. Servers

81. Is it an Active Directory environment, Azure AD environment, or hybrid?

a. Hybrid

82. Do you require a Wi-Fi assessment? If Wi-Fi testing is included, how many SSIDs are there to test?

a. Yes, we would like Wi-Fi to be tested. There are 6 SSIDs.

Any changes or clarifications made in this addendum supersede any previously provided information that may conflict with the answers provided here. If any further questions arise regarding the interpretation of this addendum, please contact purchasing@cvs.k12.mi.us.

Lillian Grayson

Lillian Grayson Purchasing & Risk Management Coordinator mailto:purchasing@cvs.k12.mi.us

Subnet Table

Building Subnets Use

District

/16 default

/12 Card Access

/16 HVAC

/24 Security Camera Servers

/23 Layer3_Network

/24 Vendor Equipment

/18 Guest Network

Administration Campus (2 Buildings)

/23 Servers (Data Center Only)

/24 DMZ (Data Center Only)

/23 Admin. Admin (Maybe 2 devices)

/24 Admin. Internet (Maybe 1 device)

/24 Digital Signage

/23 Voice Systems

/24 Management

/21 Staff Devices

/21 Student Devices

/24 Security Cameras

/22 Wifi Management

/20 Staff Wifi

/20 Student Wifi

/22 Staff BYOD (Wifi)

/20 Student BYOD (Wifi)

/20 Staff Unmanaged (Wifi)

/20 Student Wifi (Medical Devices)

/24 Bus Lot Wifi

School Buildings (21 Buildings)

/23 Voice Systems

/24 Management

/21 Staff Devices

/20 Student Devices

/24 Security Cameras

/22 Wifi Management

/20 Staff Wifi

/20 Student Wifi

/22 Staff BYOD (Wifi)

/20 Student BYOD (Wifi)

/20 Staff Unmanaged (Wifi)

/20 Student Wifi (Medical Devices)

/24 Digital Signage

/20 ESports (1 Bldg Only)