ESBD_387539_1736543956965_RFQ No. 781-5-03287 - Questions and Answers.pdf
PDF 258 KB Posted
- Attached to
- Request for Qualifications 781-5-03287 Information Technology Audit and Advisory Services
- Solicitation number
- 781-5-03287
- Issued by
- Texas
About this file
This document contains Questions and Answers for Request for Qualifications (RFQ) No. 781-5-03287 issued by the Texas Higher Education Coordinating Board for Information Technology Audit and Advisory Services. The RFQ seeks vendors to provide IT audit services, with work expected to be performed through a combination of onsite and remote arrangements. The scope may include penetration testing, systems vulnerability assessments, and social engineering activities, though specific projects will be determined later. The agency has a current IT and Information Security team of 51 FTEs covering areas like QA, AppDev, COTS, System Administration, Technical PMO, Security, and Data, with approximately 500 endpoints managed across a primary network and disaster recovery network.
The budget for services will be determined once specific projects are identified, with no services provided in the prior fiscal year (FY 2024). While there is a 23.7% subcontracting goal for Historically Underutilized Business (HUB) vendors, utilization of HUB vendors is not mandatory and will not impact bid scoring. The agency maintains an electronic working paper system for documentation, though vendors may use other appropriate applications as needed. The organization performs custom software development, has an up-to-date Business Impact Analysis, and clarifies this is not part of an integrated financial statement audit. The selected firm will not be involved in IT audit universe identification, annual risk assessment, or quarterly leadership reporting.
View the file
Other files
Show all 19
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
TEXAS HIGHER EDUCATION
COORDINATING BOARD
Request for Qualifications (RFQ)
Information Technology Audit and Advisory Services
RFQ No. 781-5-03287
Questions and Answers January 10th, 2025
1. Is there a set budget for these services in the upcoming year? If not, if these services were provided in the last year what was the actual spend under the contract?
Response: The budget for the services to be provided will be determined once specific projects have been identified. These services were not provided in the prior fiscal year
(FY 2024).
2. Are there any expectations for performing work onsite or is remote work acceptable unless there are specific items that necessitate onsite work?
Response: It is expected that work will need to be performed onsite, but remote work may be acceptable for some tasks and will be determined once specific projects have been identified.
3. The subcontract goal to disadvantaged groups seems to be 23% but there are no points awarded for using these groups. Can you elaborate if it is required that disadvantaged groups get 23% of the contract spend and how documenting usage of these groups will impact scoring of the bids.
Response: The subcontracting goal to disadvantaged groups/Historically Underutilized
Business (HUB) vendors is 23.7% for this solicitation. While the HUB Subcontracting Plan
(HSP) is a required element of this solicitation, the utilization of HUB vendors in subcontracting is not a requirement. Therefore, the actual utilization of HUB vendors will have no impact on the scoring of bids. Furthermore, in accordance with 34 TAC
§20.285, the HSP must demonstrate that the respondent acted in good faith in developing the HSP for each part of the contract the respondent actually intends to subcontract.
4. Can any portion of the IT audit be completed remotely?
Response: Please see the response to Question #2.
5. Is the performance of an IT Risk Assessment and development of an IT Audit Plan to be included as part of the IT audit?
Response: No.
6. Is the scope of the IT audit to include areas such as:
a. Penetration Testing
b. Systems Vulnerability Assessments
c. Social Engineering – electronic
d. Social Engineering – on site physical testing
Response: All of these activities may be appropriate and included within the scope of the work to be performed. The nature and scope of tasks to be performed will be determined once specific projects have been identified.
7. Are there any operational technology devices, such as programmable logic controllers, operating on the network?
Response: No.
8. Does entity perform any kind of software development or custom coding?
Response: Yes.
9. Do you already have an up-to-date Business Impact Analysis of critical systems and applications (Yes or No)?
Response: Yes.
10. How large is the internal IT team, and what are their roles?
Response: IT team + Information Security (IS) team = 51 full-time equivalents (FTEs).
This includes teams for QA, AppDev, COTS, System Administrators, Technical Project Management Office (PMO), Security, and Data.
11. Approximately how many endpoints are managed and operating on the network?
Response: There are approximately 500 endpoints.
12. Are their multiple locations with separate networks?
Response: Yes. There is a primary network and a disaster recovery (DR) network.
13. Is this engagement part of, or expected to be part of, an integrated audit?
Response: If the term integrated audit is referring to an audit that combines a financial statement audit and an audit of internal controls, then no.
14. Will the selected firm be involved in the identification of the IT audit universe, annual risk assessment process, and quarterly reporting to leadership?
Response: No.
15. Is there an electronic working paper system we will need to utilize for requests, audit work papers, issue management, and reporting?
Response: Yes, there is an electronic working paper system which will maintain the official working papers and supporting documentation. However, the selected vendor(s) may be permitted to use other appropriate applications and systems to complete audit work as necessary.
16. Is there an expected number of hours per audit?
Response: The expected number of hours will be determined once specific audit projects have been identified.
17. How long does each audit typically take to complete?
Response: Please see the response to Question #16.
18. Is there a budgeted amount already determined for this annual audit activity?
Response: Please see the response to Question #1.
File details come from the government source that posted it. Updated .