ESBD_387539_1736543956965_RFQ No. 781-5-03287 - Questions and Answers.pdf
PDF 258 KB Posted
- Attached to
- Request for Qualifications 781-5-03287 Information Technology Audit and Advisory Services
- Solicitation number
- 781-5-03287
- Issued by
- Texas
About this file
This is a Questions and Answers document for RFQ No. 781-5-03287 issued by the Texas Higher Education Coordinating Board (THECB) for Information Technology Audit and Advisory Services. The document clarifies that work will need to be performed both onsite and remotely, with specific arrangements to be determined once projects are identified. The scope may include penetration testing, systems vulnerability assessments, and social engineering (both electronic and physical). The audit will not include IT Risk Assessment development or IT Audit Plan development, and it is not part of an integrated financial audit. The selected firm will not be involved in identifying the IT audit universe or quarterly reporting to leadership.
The THECB's current IT environment consists of 51 full-time equivalents across IT and Information Security teams, managing approximately 500 endpoints on primary and disaster recovery networks. The organization performs custom software development and has an up-to-date Business Impact Analysis of critical systems. There is no set budget for these services, as budgets will be determined once specific projects are identified. The RFQ includes a 23.7% HUB subcontracting goal, though utilization is not mandatory and will not impact bid scoring. An electronic working paper system will be provided, though vendors may use other applications as needed. Previous services were not provided in FY 2024.
View the file
Other files
Show all 19
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
TEXAS HIGHER EDUCATION
COORDINATING BOARD
Request for Qualifications (RFQ)
Information Technology Audit and Advisory Services
RFQ No. 781-5-03287
Questions and Answers January 10th, 2025
1. Is there a set budget for these services in the upcoming year? If not, if these services were provided in the last year what was the actual spend under the contract?
Response: The budget for the services to be provided will be determined once specific projects have been identified. These services were not provided in the prior fiscal year
(FY 2024).
2. Are there any expectations for performing work onsite or is remote work acceptable unless there are specific items that necessitate onsite work?
Response: It is expected that work will need to be performed onsite, but remote work may be acceptable for some tasks and will be determined once specific projects have been identified.
3. The subcontract goal to disadvantaged groups seems to be 23% but there are no points awarded for using these groups. Can you elaborate if it is required that disadvantaged groups get 23% of the contract spend and how documenting usage of these groups will impact scoring of the bids.
Response: The subcontracting goal to disadvantaged groups/Historically Underutilized
Business (HUB) vendors is 23.7% for this solicitation. While the HUB Subcontracting Plan
(HSP) is a required element of this solicitation, the utilization of HUB vendors in subcontracting is not a requirement. Therefore, the actual utilization of HUB vendors will have no impact on the scoring of bids. Furthermore, in accordance with 34 TAC
§20.285, the HSP must demonstrate that the respondent acted in good faith in developing the HSP for each part of the contract the respondent actually intends to subcontract.
4. Can any portion of the IT audit be completed remotely?
Response: Please see the response to Question #2.
5. Is the performance of an IT Risk Assessment and development of an IT Audit Plan to be included as part of the IT audit?
Response: No.
6. Is the scope of the IT audit to include areas such as:
a. Penetration Testing
b. Systems Vulnerability Assessments
c. Social Engineering – electronic
d. Social Engineering – on site physical testing
Response: All of these activities may be appropriate and included within the scope of the work to be performed. The nature and scope of tasks to be performed will be determined once specific projects have been identified.
7. Are there any operational technology devices, such as programmable logic controllers, operating on the network?
Response: No.
8. Does entity perform any kind of software development or custom coding?
Response: Yes.
9. Do you already have an up-to-date Business Impact Analysis of critical systems and applications (Yes or No)?
Response: Yes.
10. How large is the internal IT team, and what are their roles?
Response: IT team + Information Security (IS) team = 51 full-time equivalents (FTEs).
This includes teams for QA, AppDev, COTS, System Administrators, Technical Project Management Office (PMO), Security, and Data.
11. Approximately how many endpoints are managed and operating on the network?
Response: There are approximately 500 endpoints.
12. Are their multiple locations with separate networks?
Response: Yes. There is a primary network and a disaster recovery (DR) network.
13. Is this engagement part of, or expected to be part of, an integrated audit?
Response: If the term integrated audit is referring to an audit that combines a financial statement audit and an audit of internal controls, then no.
14. Will the selected firm be involved in the identification of the IT audit universe, annual risk assessment process, and quarterly reporting to leadership?
Response: No.
15. Is there an electronic working paper system we will need to utilize for requests, audit work papers, issue management, and reporting?
Response: Yes, there is an electronic working paper system which will maintain the official working papers and supporting documentation. However, the selected vendor(s) may be permitted to use other appropriate applications and systems to complete audit work as necessary.
16. Is there an expected number of hours per audit?
Response: The expected number of hours will be determined once specific audit projects have been identified.
17. How long does each audit typically take to complete?
Response: Please see the response to Question #16.
18. Is there a budgeted amount already determined for this annual audit activity?
Response: Please see the response to Question #1.
File details come from the government source that posted it. Updated .