ISD126-ADM-6361 Vendor Q and A.pdf

ePro Question # User Created Question Subject Question Response 1 Paul Ashe/ Securance LLC Technical Scope The RFP states up to 55,000 unique host IPs are in scope for vulnerability and penetration scanning. Can you confirm the approximate number of active IPs that will be in scope at the time of engagement, and whether the final count is expected to be closer to the upper limit?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

2 Paul Ashe/ Securance LLC Technical Scope The RFP references scans of every County internet protocol (IP) address across 47 departments. Will internal and external IP ranges be separated by department, or will the County provide a consolidated IP inventory?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

3 Paul Ashe/ Securance LLC Technical Scope Which specific web applications across the 47 departments are in scope for web application testing under Prong-One? Are they Internet-facing, internal only, or both?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

4 Paul Ashe/ Securance LLC Technical Scope Approximately how many IPs are active across the external (Internet-facing) network?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

5 Paul Ashe/ Securance LLC Technical Scope Is exploit testing included in the external or internal network vulnerability scans?

Yes, and the approach with exploit will be discussed during planning phase.

6 Paul Ashe/ Securance LLC Technical Scope Approximately how many IPs or subnets are in scope for internal network testing?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

7 Paul Ashe/ Securance LLC Technical Scope Can all internal network testing be done from a single County location, or will on-site presence be required at multiple facilities?

No, and some on site presence is required.

8 Paul Ashe/ Securance LLC Technical Scope Excluding redundant or firewalls running in high-availability mode, how many firewalls are in scope for the firewall configuration review?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

9 Paul Ashe/ Securance LLC Technical Scope How many routers and switches are in scope for the security configuration review? Is the County open to sample-based testing for network devices?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

10 Paul Ashe/ Securance LLC Technical Scope How many web applications are in scope across all departments? Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

11 Paul Ashe/ Securance LLC Technical Scope How many enterprise applications are in scope, and are they commercial off-the-shelf (COTS) or internally developed?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

12 Paul Ashe/ Securance LLC Technical Scope How many unique databases are in scope for database-specific testing?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

13 Paul Ashe/ Securance LLC Technical Scope If databases are in different locations, can all locations be reached from one central location?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

14 Paul Ashe/ Securance LLC Technical Scope How many unique server operating system versions are in scope for server configuration analysis?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

15 Paul Ashe/ Securance LLC Technical Scope Is the wireless network controller-based or access-point-based across County locations?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

16 Paul Ashe/ Securance LLC Technical Scope How many physical locations are in scope for wireless network penetration testing?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

17 Paul Ashe/ Securance LLC Technical Scope What types of social engineering testing does the County prioritize (email phishing, vishing, smishing, physical impersonation, tailgating)?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

18 Paul Ashe/ Securance LLC Technical Scope How many employees are anticipated as targets for each type of social engineering test?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

19 Paul Ashe/ Securance LLC Technical Scope Is there an MDM solution currently in place? If so, what is the vendor? Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

20 Paul Ashe/ Securance LLC Technical Scope How many endpoints are in scope for the endpoint security review, and what operating systems are in use on workstations?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

21 Paul Ashe/ Securance LLC Technical Scope What types of cloud services (IaaS, PaaS, SaaS) are in scope for the security architecture and configuration review? If SaaS, how many applications are in scope?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

22 Paul Ashe/ Securance LLC Technical Scope The RFP mentions follow-up health checks occurring between six and eighteen months after completion. Will health checks be scoped to the same IP ranges as the original engagement, or a subset?

Health checks are interviews critique based on final review; no tools are performed.

23 Paul Ashe/ Securance LLC Technical Scope The RFP references CJIS and FERPA compliance assessments as optional Prong-Three buffet items. Which departments have active CJIS or FERPA compliance obligations that may select those services?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

24 Paul Ashe/ Securance LLC Compliance Depth Has a security control framework been formally adopted countywide?

If yes, which framework (e.g., NIST CSF, NIST SP 800-53, ISO 27001)?

Yes, as stated in the Manditory Virtual Proposal Conference.

25 Paul Ashe/ Securance LLC Compliance Depth Are there documented IT security policies, procedures, standards, and guidelines currently in place countywide? If so, approximately how many?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

26 Paul Ashe/ Securance LLC Compliance Depth Does the County have formal HIPAA policies, procedures, and forms in place for each HCC Department?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

27 Paul Ashe/ Securance LLC Compliance Depth Which HCC departments should be included in the HIPAA Privacy Rule Compliance Assessment, and what is the number of physical locations per department?

Please refer to Section V – Scope of Work, Prong-Two: HIPAA Gap and Risk Analysis. The RFP identifies all Health Care Component (HCC) departments included in the HIPAA assessment under Section V.B, Project Description, and Exhibit B – HCC Department Locations (Prong-Two) provides the associated department locations and approximate employee counts. The HIPAA Privacy Rule Compliance Assessment applies to County Fire and each HCC Department identified in the RFP.

28 Paul Ashe/ Securance LLC Compliance Depth Is Breach Notification currently in scope for each HCC department, or only specific ones?

Yes.

29 Paul Ashe/ Securance LLC Compliance Depth How many EMR applications are in scope for the HIPAA assessment, and which specific EMR applications are used by HCC departments?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

30 Paul Ashe/ Securance LLC Compliance Depth What is the current state of HIPAA risk analysis documentation for each HCC department? Has a prior formal risk analysis been completed?

Yes, the County has performed a HIPAA risk analysis.

31 Paul Ashe/ Securance LLC Compliance Depth Does the County expect the consultant to follow NIST SP 800-30 risk scoring methodology, or will an alternative methodology be acceptable if documented?

32 Paul Ashe/ Securance LLC Compliance Depth Are cybersecurity roles formally assigned to individuals within each department's IT organization, or is security responsibility shared across general IT staff?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

33 Paul Ashe/ Securance LLC Compliance Depth To what degree is cybersecurity integrated into the County's overall business or mission strategy at the departmental level?

100%

34 Paul Ashe/ Securance LLC Operational Logistics The RFP requires work to be performed within the continental United States. Will all testing activities be conducted remotely, on-site, or a combination? Will on-site testing require County escort personnel?

There will be a combination of remote and on-site work. If on-site work needs to be done, an escort will be required at most facilities.

35 Paul Ashe/ Securance LLC Operational Logistics Exhibit E shows a two-month window for Prong-One Countywide SARA across all 47 departments. What level of County IT staff availability is expected during testing phases to support consultant access and scheduling?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

36 Paul Ashe/ Securance LLC Operational Logistics Will the County provide temporary network access credentials and VPN access for internal network testing, or must the consultant arrive on-site for each assessment?

Please refer to Section V – Scope of Work, Prong-One and Prong-Two.

37 Paul Ashe/ Securance LLC Operational Logistics Are there any departments or systems where testing blackout periods apply (e.g., payroll processing windows, election cycles, EMS dispatch systems)?

Yes. The selected Vendor will be required to coordinate all testing activities with the County's Project Manager, the CISO (or designee), and the applicable department representatives to schedule assessments during approved testing windows.

38 Paul Ashe/ Securance LLC Operational Logistics Arrowhead Regional Medical Center has an employee count of approximately 5,200 and multiple satellite locations. Will the hospital's clinical environment (medical devices, EMR systems) be excluded from automated scanning, and if so, will a formal exclusion list be provided before testing begins?

Yes. A formal list of excluded systems and assets, as applicable, will be identified and provided during the project planning phase in coordination with the County's Project Manager, the CISO (or designee), and the applicable department representatives.

39 Paul Ashe/ Securance LLC Operational Logistics The timeline for Prong-Two HIPAA assessments varies from three to five months per HCC department. Will all 16 HCC departments begin simultaneously, or will the County stagger start dates?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

40 Paul Ashe/ Securance LLC Operational Logistics The RFP requires weekly status meetings with each department.

Across 47 departments, this creates a significant scheduling burden.

Will the County designate a single central point of contact for Prong- One status reporting, or will each department require individual status calls?

Please refer to Section V.C – Working Relationship. The RFP identifies the County's Project Manager (the CISO or designee) as the primary County representative for the overall project and requires the Consultant's Project Manager to coordinate with the County's Project Manager throughout the engagement. The RFP also specifies that status meetings and reports are to be provided to the respective Department Project Manager or HCC Department Project Manager, as applicable.

41 Paul Ashe/ Securance LLC Operational Logistics What is the expected timeline for the County to review and accept deliverables at each Milestone? Delays in acceptance could impact the overall project schedule.

42 Paul Ashe/ Securance LLC Operational Logistics Reports must be submitted in Microsoft Word format and plans in Excel. Are there specific County templates that must be used, or is the format at the consultant's discretion?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

43 Paul Ashe/ Securance LLC Operational Logistics How often will retesting occur for remediation verification, and is retesting included in the base Prong-One and Prong-Two scope or billed separately under Prong-Three?

Health checks are interviews critique based on final review; no tools are performed.

44 Paul Ashe/ Securance LLC Resource Constraints How many full-time IT staff members does the County have countywide? Of these, how many are dedicated to cybersecurity?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

45 Paul Ashe/ Securance LLC Resource Constraints When was the last time a countywide security assessment of this nature was performed?

This is the first Countywide security assessment being performed.

46 Paul Ashe/ Securance LLC Resource Constraints Approximately how many formal, documented IT security policies are in place? When were they last reviewed and updated?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

47 Paul Ashe/ Securance LLC Resource Constraints Does the County have a formal process in place for regularly assessing and mitigating cybersecurity risks countywide?

Yes. The County does have a formal process in place for assessing and mitigating cybersecurity risks.

48 Paul Ashe/ Securance LLC Resource Constraints Is a formal security awareness training program currently in place?

How often is training provided to users?

Yes. Annually that includes continuous training for new hires.

49 Paul Ashe/ Securance LLC Resource Constraints Who will serve as the County's primary Project Manager for Prong-One and Prong-Two? Will each HCC department designate its own Project Manager, or will a single countywide representative be assigned?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

50 Paul Ashe/ Securance LLC Resource Constraints Will the County provide a point of contact within each of the 47 departments to coordinate scheduling, data requests, and testing windows?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

51 Paul Ashe/ Securance LLC Resource Constraints How many data centers are in scope for the risk assessment and general controls review?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

52 Carl Kishel/ Palo Alto Networks Compliance Depth Will you consider a response for only Prongs 1 and 2, or must we respond to all 3 Prongs? Also, will you consider a Prong 3 only response?

Proposers are required to submit a complete response addressing all three Prongs.

53 Joshua Chin/ Net Force Corporation

Operational Logistics Are all 55,000 IP addresses accessible from a single location? Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

54 J.R. Wright/ Dark Atreids LLC Operational Logistics Of the ~55,000 active host IPs, roughly what share are external-facing vs internal, and how many distinct physical sites will require an on-site physical assessment?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

55 Joshua Chin/ Net Force Corporation

Operational Logistics Approximately how many locations will we have to access all IPs? All 47 County office locations?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

56 Michael Kirchner/ Lumen Technologies

Technical Scope Can you give an overview of your expectations on the 'on-prem' requirements? For example, with respect to items like 'dumpster diving', how much, if any, of these sorts of activities will be expected?

The County anticipates meaningful on-premises assessments (e.g., dumpster diving). The frequency, locations, and extent should be proposed using a risk-based, reasonable methodology.

57 Joshua Chin/ Net Force Corporation

Compliance Depth Will Prong 1 be condcuted both Year 1 and Year 3? No. Prong-One is conducted during the first year of the engagement.

58 Daniel Casey/ PWC Technical Scope Section 1. Introduction, C. Budget in the RFP notes, "The County estimates a budget of $1,066,750 for completion of this work."

Would ITD provide more context regarding this expectation when compared to the scope of work discussed across P1 and P2

The budget is a planning estimate for completing all required Prong- One and Prong-Two activities. Proposers should independently price the full scope.

59 Jason James/ Regents and Park Technical Scope Will you issue an additional technical scoping appendix that covers the technical questions that will be posed as part of the bidding process? A dedicated tech spec document on which bidding can be based?

No.

60 Joshua Chin/ Net Force Corporation

Technical Scope Will the County allow offshore resources to be used in this engagement, including being used for penetration testing?

Will the County allow offshore resources to be used via an onshore terminal in this engagement?

E.g., offshore resources using an onshore computer/data center.

The SARA must be performed within the continental United States.

61 Mitthan Meena/ M2 Tech LLC Technical Scope Is NIST AI Risk Management Framework (NIST AI RMF) going to be part of it?

Yes, as stated in the Manditory Virtual Proposal Conference.

62 Jason James/ Regents and Park Clarification of Budget and Penetration Testing Scope

The RFP identifies an estimated total budget of $1,066,750. The scope appears to require external, internal, and wireless penetration testing across 47 County departments, including blind and informed attack simulations, vulnerability assessments, physical security reviews, social engineering, HIPAA risk and gap analyses, security architecture reviews, reporting, knowledge transfer, and follow-up health checks. Comprehensive external, internal, and wireless penetration testing can commonly cost approximately $25,000 to $40,000 per organization when performed as a standalone engagement. Applying even the lower end of that range across 47 departments would exceed the stated budget before the other required services are included. Can the County please clarify whether the budget is intended to cover all mandatory services for the full contract term, whether penetration testing is expected to be performed separately for each department or as a consolidated Countywide engagement, and whether shared infrastructure may be tested once and relied upon across multiple departments? Please also confirm whether asset quantities, including IP addresses, applications, network segments, wireless environments, and locations, will be provided to support accurate pricing.

Please refer to Section I.C – Budget, Section V – Scope of Work, and Exhibits A, B, C, and E.

63 Jason James/ Regents and Park Prong One and Prong Two Testing Overlap

Many HIPAA-covered departments appear to be included in both the Countywide SARA under Prong One and the HIPAA technical assessment under Prong Two. Can penetration-testing, vulnerability-scanning, physical-assessment and architecture-review work performed under Prong One be relied upon to satisfy equivalent Prong Two requirements, or must these activities be performed and priced separately for each prong?

Yes, Prong One can be used to satisfy Prong Two requirements.

64 Jason James/ Regents and Park Deliverable Review and Acceptance

Please define the acceptance criteria and review period for draft and final department reports, presentations and the consolidated report.

Is there a limit on the number of revision cycles included in the proposed price, and will a deliverable be deemed accepted when the County does not provide comments within a specified period?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

65 Jason James/ Regents and Park Physical Assessment Locations

Exhibit B identifies numerous facilities, while the scope references physical assessments for departments and locations handling PII or ePHI. Please identify the number of facilities that must receive an onsite physical assessment and whether the County expects every listed facility to be visited or will permit representative sampling based on location type and risk.

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

66 Cindy Curley/Tevora Business Solutions

SARA & HIPAA

services for Covered Entitites

In reviewing the scope of services there is a good amount of overlap between what the county is asking for for all department in the SARA and what the county is requesting for the HIPAA services. Does the county want the contractor to conduct both a SARA and the HIPAA Gap and Risk Analysis or combine the activities into one assessment so there isn't duplication of efforts where there is overlap between the two Prongs?

Yes, Prong One can be used to satisfy Prong Two requirements.

67 Cindy Curley/Tevora Business Solutions

Reports Is the county looking for a separate report for each department or one combined report of all departments for each of the prongs?

Please refer to Section V.C – Project Milestones, Tasks and Deliverables, specifically Milestone 2 (Prong-One), Milestone 3 (Prong- Two), and Milestone 4 (Reports Phase). For Prong-One, the Consultant is required to prepare assessment reports and presentations for each Department. For Prong-Two, the Consultant is required to prepare assessment reports and presentations for County Fire and each HCC Department. During Milestone 4, the Consultant must provide department-specific Final Project Status Reports, with each HCC Department receiving its own separate final report for Prong-Two, as well as a final compiled report that consolidates the results from all Departments from a County perspective

68 Cindy Curley/Tevora Business Solutions

Billing At the conclusion of each department's assessment, will we be invoicing the particular department or will billing and payment be centralized?

Please refer to Section X – Terms and Conditions, Paragraph 41 (Fiscal Provisions). The RFP requires the Contractor to submit itemized monthly invoices to the County in a format acceptable to the County for services performed under the Contract. The RFP does not provide for invoicing individual departments.

69 Cindy Curley/Tevora Business Solutions

Budget Is the anticipated budget to include Prong 1 and for year 1, Prong 2 for years 1 and 3 only or does it also include Prong 3?

The anticipated budget is for the base scope of work covering Prong 1 and Prong 2 only

70 Admin Purchaser/Check Point Software Technologies Inc.

Scope Are the 55,000 IPs all in scope for active vulnerability testing? Yes.

71 Admin Purchaser/Check Point Software Technologies Inc.

Scope How many public-facing IPs exist? Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

72 Admin Purchaser/Check Point Software Technologies Inc.

Scope How many Internet-facing applications exist? Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

73 Admin Purchaser/Check Point Software Technologies Inc.

Scope How many firewalls are in scope? Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

74 Admin Purchaser/Check Point Software Technologies Inc.

Scope Are cloud environments in scope (Azure/AWS/GCP)? No, cloud environments are not in scope.

75 Admin Purchaser/Check Point Software Technologies Inc.

Pen Testing Is exploitation required or validation only? Validation is required.

76 Admin Purchaser/Check Point Software Technologies Inc.

Pen Testing Is red-team style persistence required? Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

77 Admin Purchaser/Check Point Software Technologies Inc.

Pen Testing What limits exist for social engineering? Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

78 Admin Purchaser/Check Point Software Technologies Inc.

Phsyical How many facilities require site visits? Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

79 Admin Purchaser/Check Point Software Technologies Inc.

Physical Can physical security testing be sampled versus every location? Yes, will be determined during Milestone 1's Prong-One and Prong- Two Planning Phase.

80 Admin Purchaser/Check Point Software Technologies Inc.

HIPAA Are all listed HCC entities on independent networks? No, will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

81 Admin Purchaser/Check Point Software Technologies Inc.

HIPAA Will prior HIPAA analyses be provided? No prior HIPAA analyses will not be provided.

82 Admin Purchaser/Check Point Software Technologies Inc.

Reporting Must all departments receive independent reports? Refer to Question 72.

83 Admin Purchaser/Check Point Software Technologies Inc.

Reporting Is there a preferred risk scoring methodology? Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

84 Admin Purchaser/Check Point Software Technologies Inc.

Health Checks Are follow-up health checks included in fixed pricing or separately funded?

Prong-One and Prong-Two have follow-up health checks that are included in fixed pricing.

85 Casey Moore/Shorebreak iThreat Security, LLC

Prong One Prong-One is allotted two calendar months in Exhibit E for all forty-seven (47) Departments and up to 55,000 active host IPs. Can the County confirm this duration, and clarify whether phased or wave-based scheduling across Departments is acceptable within that window? Can a technical approach justify a different duration?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

86 Casey Moore/Shorebreak iThreat Security, LLC

Prong One For Prong-One, does the County expect the full manual testing, wireless, physical, and social engineering battery to be performed individually at each of the forty-seven (47) Departments, or may shared enterprise infrastructure managed by the Innovation and Technology Department be assessed once and referenced by dependent Departments?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

87 Casey Moore/Shorebreak iThreat Security, LLC

Exhibit E Exhibit E lists Behavioral Health as ADMIN 2 / TECHNICAL 2 / PHYSICAL 1 calendar months with a stated total of 4 calendar months. Should the total be 5? Please confirm the controlling figure

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

88 Casey Moore/Shorebreak iThreat Security, LLC

Exhibit B Approximately how many physical locations should Proposers assume for Prong-One physical assessments? Exhibit B enumerates locations for HCC Departments under Prong-Two, but no equivalent listing is provided for the remaining Departments.

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

89 Casey Moore/Shorebreak iThreat Security, LLC

Prong Two Section 1 Approximately how many physical locations should Proposers assume for Prong-One physical assessments? Exhibit B enumerates locations for HCC Departments under Prong-Two, but no equivalent listing is provided for the remaining Departments. 5. Prong-Two Section 1.c re-specifies the full technical testing battery for County Fire and each HCC Department. Where a Department has already undergone Prong-One testing, may Prong-Two leverage Prong-One evidence and testing results, or does the County require independent re-testing for the HIPAA Risk Analysis?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

90 Casey Moore/Shorebreak iThreat Security, LLC

Scope of Work ISO The Scope of Work references International Standards Organization (ISO) standards without a specific designation. Can the County identify the applicable ISO standard or standards, for example ISO/IEC 27001, 27002, or 27005?

ISO/IEC 27001.

91 Casey Moore/Shorebreak iThreat Security, LLC

Inventory Will the County provide the IP address inventory, network diagrams, and asset listings during the planning phase, or is discovery of the environment solely the Consultant's responsibility?

Discovery.

92 Casey Moore/Shorebreak iThreat Security, LLC

Exhibit A Beyond the medical device exclusion noted in Exhibit A, are there environments excluded from active testing or requiring restricted methodology - for example operational technology, SCADA, building automation, public safety CAD/RMS, jail management, or election systems?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

93 Casey Moore/Shorebreak iThreat Security, LLC

Secuirty Architecture For the Security Architecture and Configuration Review skills assessment, will the County provide access to Departmental IT personnel for interviews, and does the County prefer a specific assessment instrument or competency framework?

Yes. Will be determined during Milestone 1's Prong-One and Prong- Two Planning Phase.

94 Casey Moore/Shorebreak iThreat Security, LLC

Credentials Will the County provide credentials for credentialed vulnerability scanning and are there Departments where only non-credentialed scanning will be permitted?

Yes. Will be determined during Milestone 1's Prong-One and Prong- Two Planning Phase.

95 Casey Moore/Shorebreak iThreat Security, LLC

Budget Does the County's estimated budget of $1,066,750 represent total contract value inclusive of all five years, or the value of Prong-One and Prong-Two (Milestones 1 through 4) only, with Prong-Three funded separately by Departments?

$1,066,750 represents year one, and not to exceed in subsequent years.

96 Casey Moore/Shorebreak iThreat Security, LLC

# External (Internet) Network Penetration Testing

Are cloud-hosted assets included (e.g., AWS, Azure, GCP)? - Are third-party hosted applications or services (e.g., hosted websites, SaaS platforms) included in scope? - Will any credentials be provided for externally accessible services (e.g., VPN, web portals, admin interfaces)?

Are there any proprietary web applications that require in-depth testing? If so, how many separate applications require testing?

Will API/usage documentation be provided for any proprietary applications?

Cloud-hosted assets are not included. Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

97 Casey Moore/Shorebreak

# (Internal) Network Penetration Testing

Is there an existing vulnerability management platform in place (e.g., Tenable, Qualys)? If so, will access be provided?

Will internal testing be performed in-person or remotely?

How will internal access be provided if testing is conducted remotely?

(e.g., VPN, virtual machine, SSH)

How many separate network perspectives will be required to cover internal VLANs/subnets?

Is the internal network primarily Windows, Linux, or a mix of both?

How many Active Directory/IdM domains or forests exist, and are they all in scope?

Will domain credentials be provided for auditing Active Directory or other domain level configurations?

Is the environment dependent on cloud/third party systems/services such as Azure, AWS, etc.? If so, will these be included in scope?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

98 Casey Moore/Shorebreak iThreat Security, LLC

# Physcial Access Testing

How many physical locations are in scope for physical testing?

For each location, what is the approximate size (e.g., square footage, number of floors)?

Are facilities owned, leased, or shared with third parties?

What credential types are used (e.g., proximity cards, smart cards, NFC, mobile credentials, biometrics)?

Are temporary badges, visitor badges, or contractor credentials used?

Will access badges be provided for testing, or is badge cloning/bypass expected?

Are security guards employed on-site or via a third-party vendor?

What physical attack techniques are permitted (e.g., tailgating, lock picking, badge cloning, door propping, pretexting)?

99 Casey Moore/Shorebreak

#Wireless Testing How many wireless networks (SSIDs) are in scope?

How many physical sites, floors, or buildings will be included in wireless testing?

What wireless technologies are deployed (e.g., 802.11a/b/g/n/ac/ax, WPA2-Enterprise, WPA3, Open networks)?

Are there any legacy authentication mechanisms or deprecated protocols still in use (e.g., WEP, WPA, LEAP, TKIP)?

Will test credentials or certificates be provided for Enterprise Wi-Fi networks?

Will rogue access point and de-authentication attacks be permitted?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

100 Casey Moore/Shorebreak iThreat Security, LLC

#Firewall Review Approximately how man separate firewall configurations will be reviewed?

What firewall technologies are in use?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

101 Casey Moore/Shorebreak iThreat Security, LLC

# Social Engineering What are the acceptable delivery methods for phishing simulations (e.g., email, SMS, phone, in-person)?

What should the focus of the phishing simulations be (e.g., credential harvesting, malware delivery, information gathering)?

How many separate Social Engineering tests are desired?

Will a list of target personnel be provided?

Will targets/context require prior approval?

How many employees will be targeted during phone/email-based social engineering?

Are there specific departments (e.g., IT, HR, finance) we should focus on?

Will the targets be aware of the test (i.e., authorized deception)?

Are there specific pretexts you want or don't want us to use?

Can we spoof internal phone numbers or email domains?

102 Joshua Chin/Net Force Is this a new opportunity or a continuation of an existing opportunity? This RFP is a new opportunity.

103 Joshua Chin/Net Force Is the incumbent performing to the satisfaction of the County of San Bernardino? Is the incumbent performing to the satisfaction of the CISO? Is the incumbent eligible to bid on this contract?

There is no incumbent.

104 Joshua Chin/Net Force For project management, staƯing, and resource-planning purposes, does the County anticipate that each project phase or workstream will be fully completed before the next phase, prong, or workstream begins, or may activities proceed concurrently or overlap?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

105 Joshua Chin/Net Force Based on the County's responses during the pre-proposal conference, we understand that the answers to the following questions are "No." We are submitting them during the formal question-and-answer period solely to confirm that understanding and establish a written record for all prospective proposers. Will Vendors be permitted to use off-shore teams to perform and/or support any and all penetration testing and assessment activities? Will Vendors be permitted to use offshore teams to perform and/or support any and all penetration testing and assessment activities through an onshore terminal, server, or data center?

The SARA must be performed within the continental United States.

106 Joshua Chin/Net Force Please clarify the County's expected scope and pricing basis for penetration testing of the identified IP address ranges. Is the successful contractor expected to perform penetration testing against every in-scope IP address, or may proposers use a sampling, risk-based selection, or time-boxed testing approach? If sampling or time-boxing is permitted, please clarify:

1. Whether the proposer must identify the number or percentage of IP addresses that will be tested;

2. Whether the proposer must describe the methodology used to select systems for testing;

3. Whether the County has established any minimum coverage requirements;

4. Whether pricing should be based on complete testing of all in-scope IP addresses or on a defined level of effort, such as 40 hours, 80 hours, or another specified testing period; and

5. How the County will evaluate proposals that offer different levels of IP coverage, testing depth, or labor hours at different prices. This clarification will help ensure that all proposers price the work using a consistent basis and that the County can meaningfully compare proposed cost, coverage, and testing depth.

107 Joshua Chin/Net Force Would the County be willing to provide the approximate size of each participating agency's in-scope network, expressed by CIDR range or estimated number of IP addresses? For example: Agency 1: /24 Agency 2: /23 Agency 3: /22 Agency 4: /25 Providing this information would allow proposers to develop more accurate and comparable pricing, staffing, and testing-duration estimates.

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

108 Joshua Chin/Net Force Will the County permit the use of artificial intelligence, including generative AI tools, solely to augment human-led analysis, documentation, and other project activities, provided that such tools are not used as a substitute for qualified personnel and that all outputs remain subject to appropriate human review, validation, confidentiality, and data-security controls?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

109 Joshua Chin/Net Force Many firms will claim that a "representative" sample of your systems being penetration tested is an accurate way to identify vulnerabilities and quantify risk, but the outcome is the sample misses systems that are high value targets or miss a handful of systems that are misconfigured that could gain access to the domain controller or root access to servers. Will you be allowing the sampling process to be used instead of a risk driven approach towards penetration testing and this project?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

110 Alex NokoƯ/The Redesign Group

Environment Data & Scope Sizing

Will the County release the Exhibit A per-department IP summary and preliminary asset counts (active host IPs, endpoints, employees, web applications) during the question/RFP period? Exhibit A caps scope at 55,000 unique active host IPs but states specific ranges will only be provided after award - proposers need indicative per-department volumes now to scope level of effort and price accurately.

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

111 Alex NokoƯ/The Redesign Group

Environment Data & Scope Sizing

Of the 55,000 active-IP ceiling, approximately how many IPs are expected to be excluded (e.g., medical devices), and what is the realistic active-IP count that should be scoped and priced against?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

112 Alex NokoƯ/The Redesign Group

Environment Data & Scope Sizing

What is the total count of publicly routable IPv4 and IPv6 addresses across all 47 departments?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

113 Alex NokoƯ/The Redesign Group

Environment Data & Scope Sizing

What is the complete list of primary root domains and known subdomains managed by the County?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

114 Alex NokoƯ/The Redesign Group

Environment Data & Scope Sizing

Are external assets hosted in public cloud environments (AWS, Azure, GCP)? If so, how many cloud subscriptions/accounts exist?

Cloud-hosted assets are not included. Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

115 Alex NokoƯ/The Redesign Group

Environment Data & Scope Sizing

What is the total employee/workforce count for each of the 47 departments? (Exhibit B provides HIPAA-focused counts for a subset of locations only.)

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

116 Alex NokoƯ/The Redesign Group

Environment Data & Scope Sizing

Approximately how many live external hosts/IPs are active per department?

117 Alex NokoƯ/The Redesign Group

Environment Data & Scope Sizing

How many externally exposed remote-access gateways (VPN, RDP, Citrix, VDI) exist, listed by department?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

118 Alex NokoƯ/The Redesign Group

Environment Data & Scope Sizing

Approximately how many live internal hosts/IPs exist across the 47 departments, listed by department?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

119 Alex NokoƯ/The Redesign Group

Environment Data & Scope Sizing

How many Active Directory domain accounts and distinct AD forests/domains exist, listed by department?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

120 Alex NokoƯ/The Redesign Group

Environment Data & Scope Sizing

What Endpoint Detection and Response (EDR) software is deployed across internal endpoints, listed by department?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

121 Alex NokoƯ/The Redesign Group

Environment Data & Scope Sizing

How many isolated network segments (VLANs/VRFs) must be traversed during testing, listed by department?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

122 Alex NokoƯ/The Redesign Group

Prong One - Penetration Testing Scope & Approach

Will County perimeter devices (firewalls/WAFs) whitelist the testing team's scanning IPs, or is unwhitelisted "blind" testing required?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

123 Alex NokoƯ/The Redesign Group

Prong One - Penetration Testing Scope & Approach

Will the County deploy a consultant-provided virtual machine or small appliance on an administrative segment to enable the assumed-breach internal foothold?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

124 Alex NokoƯ/The Redesign Group

Prong One - Penetration Testing Scope & Approach

Will the County deploy a consultant-provided virtual machine or small appliance on an administrative segment to enable the assumed-breach internal foothold?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

125 Alex NokoƯ/The Redesign Group

Prong One - Penetration Testing Scope & Approach

Confirm both pre-determined internal footholds are in scope for every department: (a) access from a physical network port without credentials, and (b) access from an authenticated workstation simulating a Trojan or successful phishing attack.

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

126 Alex NokoƯ/The Redesign Group

Prong One - Penetration Testing Scope & Approach

Is the County seeking a full black-box red team, a light assumed-breach red team, or a collaborative purple-team exercise?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

127 Alex NokoƯ/The Redesign Group

Prong One - Penetration Testing Scope & Approach

What are the specific target objectives / "crown jewels" per department (e.g., compromise Domain Admin, exfiltrate mock ePHI, access CJIS databases)?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

128 Alex NokoƯ/The Redesign Group

Prong One - Penetration Testing Scope & Approach

Are email phishing, vishing, and credential harvesting authorized for initial access within the manual/red-team scenarios?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

129 Alex NokoƯ/The Redesign Group

Prong One - Penetration Testing Scope & Approach

Which critical systems are strictly oƯ-limits from active testing (e.g., 911 dispatch, Arrowhead Regional Medical Center patient life-support systems), listed by department?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

130 Alex NokoƯ/The Redesign Group

Prong One - Penetration Testing Scope & Approach

Is manual/intelligent penetration testing required at every one of the 47 departments, or is a representative sample acceptable for lower-risk departments? If a sample is acceptable, what sample size does the County prefer?

131 Alex NokoƯ/The Redesign

Prong One - Web & Mobile Application Testing

How many dynamic web applications require dedicated OWASP testing across the 47 departments, listed by department?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

132 Alex NokoƯ/The Redesign Group

Prong One - Web & Mobile Application Testing

Per application, approximately how many dynamic pages/functions and how many distinct user roles exist?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

133 Alex NokoƯ/The Redesign Group

Prong One - Web & Mobile Application Testing

Will test credentials be provided for each user role? Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

134 Alex NokoƯ/The Redesign Group

Prong One - Web & Mobile Application Testing

How many custom mobile applications exist, and are they compiled for iOS, Android, or both? Are the supporting backend APIs in scope?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

135 Alex NokoƯ/The Redesign Group

Prong One - Wireless, Physical, Social & Configuraiton Reviews

Does wireless penetration testing need to cover all department locations? If so, how many physical locations require an on-site wireless assessment?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

136 Alex NokoƯ/The Redesign Group

Prong One - Wireless, Physical, Social & Configuraiton Reviews

Does the physical assessment include all 47 departments and all County buildings, or a sample of high-risk locations? If a sample, what is the sample size?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

137 Alex NokoƯ/The Redesign Group

Prong One - Wireless, Physical, Social & Configuraiton Reviews

Does the physical assessment scope include physical social-engineering to bypass security controls, or is it a walkthrough/review of the environment only?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

138 Alex NokoƯ/The Redesign Group

Prong One - Wireless, Physical, Social & Configuraiton Reviews

Does the social-testing scope include only targeted spear-phishing campaigns, or full employee-wide testing?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

139 Alex NokoƯ/The Redesign Group

Prong One - Wireless, Physical, Social & Configuraiton Reviews

Does social testing include all departments, or is a per-department sample acceptable rather than targeting every employee? If sampling, what is the County's preferred sample size per department? (Testing every employee across each department increases the likelihood of detection.)

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

140 Alex NokoƯ/The Redesign Group

Prong One - Wireless, Physical, Social & Configuraiton Reviews

If secondary controls such as email filtering cannot be bypassed, is the County open to allow-listing the phishing campaign to validate whether employee-level and other secondary controls are working?

141 Alex NokoƯ/The Redesign

Prong One - Wireless, Physical, Social & Configuraiton Reviews

How many firewalls / firewall rule sets require configuration and diagnostic review, listed by department?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

142 Alex NokoƯ/The Redesign Group

Prong One - Wireless, Physical, Social & Configuraiton Reviews

Will the County share the make, model, and firmware/OS version of each firewall in scope for the firewall review? Effort varies significantly by platform (e.g., Palo Alto, Cisco ASA/Firepower, Fortinet, Check Point), so this is needed to scope the review accurately.

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

143 Alex NokoƯ/The Redesign Group

Prong One - Wireless, Physical, Social & Configuraiton Reviews

How many mobile-device management (MDM) environments or mobile-device populations that access regulated data require review?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

144 Alex NokoƯ/The Redesign Group

Prong One - Wireless, Physical, Social & Configuraiton Reviews

The Security Architecture & Configuration Review (SOW V.B.1.i) requires that a skills assessment and correlation of existing IT security staff be generated "for each" department - addressing knowledge gaps in security practices, quantifying time spent on security matters (e.g., prior incident response), and quantifying staff with shared security/IT responsibilities. Please confirm: (a) does this apply to all 47 departments; (b) approximately how many IT/security staff per department are to be assessed; and (c) what depth and methodology are expected (e.g., structured interviews, surveys, or a formal competency framework)?

Yes. Will be determined during Milestone 1's Prong-One and Prong- Two Planning Phase.

145 Alex NokoƯ/The Redesign Group

Prong One - Wireless, Physical, Social & Configuraiton Reviews

Will the County provide credentialed access for authenticated vulnerability scans, or should scanning be non-credentialed?

Yes. Will be determined during Milestone 1's Prong-One and Prong- Two Planning Phase.

146 Alex NokoƯ/The Redesign Group

Prong One- Vulnerability & Automated Scanning

Does the County want a review/comparison of its current scanning results against the consultant's scanning results?

Will be determined during Milestone 1's Prong-One and Prong-Two Planning Phase.

147 Alex NokoƯ/The Redesign Group

Prong One- Vulnerability & Automated Scanning

Confirm that both native/unfiltered raw scan output and a prioritized, validated (false-positive-filtered) report are required deliverables per department.

Yes, both native/unfiltered raw scan output and a prioritized, validated report are required as deliverables.

148 Alex NokoƯ/The Redesign Group

Follow-up Health Checks, Physical Security & Remediation

Health-check frequency: within the six-to-eighteen-month window, is a single follow-up health check performed per department, or are recurring checks expected across that window? Please clarify the exact number of health checks the County expects per department

Health checks are interviews critique based on final review; no tools are performed.

149 Alex NokoƯ/The Redesign

Follow-up Health Checks, Physical Security & Remediation

Health-chec…