Request for Proposals.pdf

ARC Network Security Audit and Vulnerability

Assessment RFP

April 23, 2025 Atlanta Regional

Commission

INTRODUCTION

Atlanta Regional Commission (ARC) Information Technology Group provides technology services to internal Centers\Groups and partner agencies with a focus on providing a secure, protected network infrastructure dedicated to the protection, reliability, and availability of the Agency’s data. We are looking for a service provider to help determine the maturity of the Agency’s information security program, while providing expert technical insight that will assist us in improving efficiency and security in the future.

Atlanta Regional Commission is soliciting proposals from qualified independent service providers with security assessment experience sufficient to perform a Network Security Audit and Vulnerability Assessment in accordance with the specifications outlined in this document. Deliverables from the assessment must include a findings document to include any non-compliant network vulnerabilities; a risk analysis listing the priority of each risk or vulnerability identified (i.e. high/med/low) and a roadmap document outlining technologies and best practices that the Agency should focus on to improve its security model. ARC is not looking for a SOC’s Team to take over security operations.

PROPOSAL SUBMITTAL

Questions should be submitted via email to Ray Randolph no later than 5:00 p.m. EST Monday, May 5, 2025, to RRandolph@atlantaregional.org. All questions received, and responses to those questions will be posted to the ARC website by Monday, May 12, 2025.

ARC must receive (1) copy in digital format (sent to it-rfq@atlantaregional.org), either in Microsoft Word or PDF format, no later than 5:00 p.m. EST on Friday, May 23, 2025.

• RFP release date: April 23, 2025

• Deadline for questions: May 5, 2025

• Response to questions: May 12, 2025

• Proposals due: May 23, 2025

Proposals shall not exceed a total of 15 pages (8.5 x 11) printed double-sided, inclusive of resumes and firm experience. Covers, end sheets, budget exhibits, and an introductory letter shall not count against this maximum. Font size shall be a minimum of 12 point in all cases.

If interviews are necessary, a short list of service providers will be invited to participate in an interview process with an evaluation committee to be scheduled in April. ARC will confirm a specific interview date and time with those selected firms. ARC reserves the right to award this contract based on initial proposals received without formal interviews and to award all or part of this project to one or more firms.

ARC reserves the right to select for contract or for negotiations a proposal other than that with the lowest cost, to reject any and all proposals or portions of proposals received in response to this RFP or to make no award, to waive or modify any information, irregularity, or inconsistency in proposals received, to request modification to proposals from any or all mailto:RRandolph@atlantaregional.org mailto:%20it-rfq@atlantaregional.org proposers during the contract review and negotiation, and to negotiate any aspect of the proposal with any proposer and negotiate with more than one proposer at the same time.

PROPOSAL FORMAT AND CONTENT

Interested service providers should submit a proposal that addresses the vendor requirements. The Proposer must provide a detailed breakdown of the proposed budget in the format of Exhibit B (See Attached). The successful service providers should be prepared to begin work immediately. ARC reserves the right to award all or part of the available funds for this project.

Proposals must include the following information:

1. Legal name of the firm.

2. Point of contact (name, title, phone number, mailing address, and email address) at lead firm.

3. Qualifications and technical competence of the firm(s) in the type of work required.

4. Description of experience on similar projects including a list of at least 3 references within the past 5 years, with current contact information.

5. Listing of key project personnel and their qualifications.

6. A detailed description of the technical approach proposed for accomplishment of the work.

7. A proposed Cost in the format at Exhibit B to this RFP.

8. Any other pertinent information.

PROPOSAL EVALUATION

The review of written proposals will be based on the following evaluation criteria, with the relative weights in parentheses:

A. Technical approach to provide the requested services, including the quality/thoroughness of example reports

35%

B. Demonstration of expert qualifications and experience to perform requested services

30%

C. Reasonableness of fee and expenses 20% D. References of the firm/organization, letters of support 10% E. Proposed Cost 5%

SERVICE PROVIDER REQUIREMENTS

The service provider must submit an executive summary, which outlines its proposal, including the proposed general management philosophy. The executive summary should include an identification of the proposed project team, the responsibilities of the project team, and a summary description of the services proposed. The vendor should also provide sample reports like the ones to be delivered (see list of deliverables below).

The service provider must submit a Statement of Work and proposed timeline, which describes tasks associated with the services including the vendor and Agency’s responsibilities along with the deliverables for each task of the project. Any Agency responsibilities identified should indicate the required skills needed.

The service provider must have Computer Information Security Audit (CISA) certified security experts (or equivalent certifications).

The service provider must provide three former customers as references for which similar services were performed (preferably local government). With each reference, please include a 1-2 paragraph summary of the work scope, deliverables and key outcomes.

CONFLICT OF INTEREST AND CONFIDENTIALITY

ARC is subject to the Georgia Open Records law. All proposals submitted will become public records to be provided upon request. Any information containing trade secrets or proprietary information, as defined by state law, must be marked as confidential to prevent disclosure. Confidential markings must be limited to the protected information. Entire proposals marked confidential will not be honored. Additionally, conflicts of interest are governed by the ARC Standards of Ethical Conduct available here: Standards of Ethical Conduct. Respondents must disclose any potential conflicts of interest that may arise from the provision of services described herein. Such disclosure should include the name of the individual(s) with whom there is a conflict, any relevant facts to the potential conflict, and a description of the internal controls proposed to mitigate any such conflict. ARC’s Staff Legal Counsel will determine whether such disclosure presents a potential organizational conflict of interest that should preclude award to the respondent.

https://cdn.atlantaregional.org/wp-content/uploads/arc-standards-of-ethical-conduct.pdf https://cdn.atlantaregional.org/wp-content/uploads/arc-standards-of-ethical-conduct.pdf

EXHIBIT A

SCOPE OF WORK

The vendor will perform a Network Security Audit and Vulnerability Assessment review that will address the following areas of the Agency’s infrastructure (Please note the actions listed below is an indicative but not exhaustive list. Vendor may propose additional services to be executed to achieve the stated objectives):

1. Edge Security

a. Perform ping sweep and port scan of external IP addresses

b. Perform vulnerability scan of all external IP addresses

c. Review ingress and egress firewall policies

d. Review network address translation rules for publishing internal systems

e. Verify firewall inspection layer - application layer / stateful inspection

f. Determine if reverse proxy is in place for inspecting encrypted traffic and pre- authentication

g. Determine if any unified threat management is configured for the edge security

h. Review current auditing policies and practice for edge security devices

2. Network Security

a. Review switch configurations to determine if network segmentation configured between networks

b. Determine if any internal firewalls are in place between workstations and servers

c. Determine if encryption is configured to protect internal communications

d. Review wireless security settings to validate security measures in place

e. Validate port security and whether or not network ports are active by default and if port security enforces based on MAC address

f. Determine if any network intrusion detection or prevention systems are providing network scanning

3. Systems Security

a. Perform ping sweep and port scan of internal IP addresses

b. Review all servers and workstations (see appendix) in the environment to determine if the following configurations have been made or security measures are in place

i. Have any unnecessary services been disabled?

ii. Is an existing patch management solution in place to ensure the latest operating system security updates are installed?

iii. Review the auditing policies and procedures in place for each system

iv. Does each system have an updated Endpoint protection application installed to provide for:

1. Anti-malware

2. Host IDS/IPS

v. Are host-based firewalls enforced and centrally managed on each endpoint?

vi. Is the local Administrators group membership restricted to privileged accounts?

vii. Are local Administrator and Guest user accounts renamed or disabled?

viii. File shares

1. Are default file shares still enabled?

2. What share permissions are configured

4. Access Management

a. Review the methods of authentication currently in place

b. Review domain group membership for high-privilege groups

c. Determine policy for using separate accounts for user level access and privileged access

d. Review the current password policy enforced on the domain

e. Perform password auditing for existing user passwords on the domain

f. Review remote access methods and security

5. Disaster Recovery

a. Perform three tabletop exercises (ttx) walking through disaster scenarios in the context of CRT

i. Prepare Tabletop Exercise briefing book

ii. A script of everything that will take place during the exercise and specify how the exercise will be conducted.

b. Conduct a minimum of two full disaster recovery (DR) drills using elastic disaster recovery

i. Business Analysis Impact

ii. Record time to recovery

iii. Recovery point objectives

iv. Disaster recovery sites

v. Data backup

vi. Testing and validation

vii. Incident response plan

DELIVERABLES

1. A findings and assessment document that details and demonstrates all threats and vulnerabilities that are identified. A risk and severity level will be assigned for threats and vulnerabilities identified.

2. A risk analysis listing of recommendations based on risk severity, probability, cost, and scope of work. This should also include recommendations that address policy or procedural vulnerabilities.

3. A Security Roadmap that lists the technology recommendations for the next 24-36 months and includes a strategic direction in support of the Agency’s security infrastructure.

4. Deliver presentations to the executive team on findings and recommendations

5. 30-day Vulnerability Risk Assessments

6. 2 Full DR drills using AWS elastic disaster recovery

7. 3 Tabletop exercises with CRT

8. Estimated length of the project and vulnerability risk assessment should be no more than 30 days, disaster recovery exercises through the end of the year.

EXHIBIT B

COMPENSATION AND METHOD OF PAYMENT

Compensation: In no event will the total compensation and reimbursement, if any, to be paid to the Consultant under this contract exceed the sum of $40,000.00. A breakdown of this budget is listed in “Exhibit B-1, Contract Budget,” which is attached to and made part of this contract for financial reporting, monitoring, and audit purposes.

Method of Payment: The following method of payment will be used for this project:

Progress Payments: The Consultant shall be entitled to receive progress payments on the following basis. On a monthly basis during the existence of this contract, the Consultant shall submit to ARC an invoice for payment documenting work performed during the invoice period. Any work for which payment is requested may be disallowed at ARC’s reasonable discretion if not properly documented in the required monthly progress report. Invoices properly submitted shall be paid or rejected within 45 days of receipt by

ARC.

Invoices shall be submitted to:

Program managers contact information:

Raymond Randolph 229 Peachtree St NE, STE 100 Atlanta, Georgia 30303 Rrandolph@atlantaregional.org

Final Payment: Final payment shall only be made upon determination by ARC that all requirements hereunder have been completed. Upon such determination and upon submittal of a final invoice, ARC shall pay all compensation due to the Consultant, less the total of all previous progress payments made.

Consultant’s final invoice and final narrative progress report must be received by ARC no later than fifteen days after the project completion date specified in the contract. ARC may, at its discretion, disallow all or part of a final invoice received after this deadline.

Invoices: ARC shall make payments to the Consultant as the work progresses but not more often than once a month. Invoices shall be submitted to ARC by the 10th day of each month to the above listed contact. Invoices shall include a description of work completed, and percentage of work completed, amount previously billed, a unique invoice number, the period of performance in which the work completed took place, and a valid payment address. ARC may, at its discretion, disallow all or part of a payment of an invoice received after this deadline or determined to be incomplete.

Invoices shall also include payments to approved subcontractors. It should be noted on the invoices if a subcontractor is a DBE/MBE/WBE.

mailto:Rrandolph@atlantaregional.org

The following are approved Subcontractors:

Name Subcontract Amount

For contracts involving funds from the U.S. Department of Transportation (consult the Director of Support Services) over $10,000 with private for-profit professional services consultants or for subgrant contracts over $100,000 on an annualized basis with local governments, the following paragraph should be added to Attachment B:

Participation by Minority Business Enterprise in Department of Transportation Program Policy. It is the policy of ARC and the Department of Transportation that minority business enterprises as defined in 49 CFR Part 23 shall have the maximum opportunity to participate in the performance of contracts financed in whole or in part with Federal funds under this agreement. Consequently, the MBE requirements of 49 CFR Part 23 apply to this agreement.

MBE Obligation. The Consultant (or Subrecipient) agrees to ensure that minority business enterprises as defined in 49 CFR Part 23 have the maximum opportunity to participate in the performance of contracts and subcontracts financed in whole or in part with Federal funds provided under this agreement. In this regard, all recipients or contractors shall take all necessary and reasonable steps in accordance with 49 CFR Part 23 to ensure that minority business enterprises have the maximum opportunity to compete for and perform contracts. Recipients and their contractors shall not discriminate on the basis of race, color, national origin or sex in the award and performance of DOT-assisted contracts.

EXHIBIT B-1

PROPOSED COST PROPOSAL

AREAS AMOUNT

Edge Security $

Network Security $

Systems Security $

Access Management $

Disaster Recovery $

TOTAL AMOUNT $

APPENDIX A

Network Resources Resource Qty. Description/ Device in use

Network ISP managed Router 1

Layer 2 Switches 10 Cisco 3850, Meraki MS350, Cisco SG300 Vlans 3

Internal IP Addresses 18 External IP Addresses 21

Physical Servers 10 Vmware

Cluster physical servers 6 Virtual Servers 51

SANS 2

Domain Controllers 4

Access Points 22 Meraki MS350 End Users 220 windows, Mac

Security ISP managed Firewall 1 Fortinet 200D SIEM 1 Gray Log and Manage Engine Anti-Virus Sophos

Web IIS 20-30 20-30 bindings, 1 Internal facing Apache

MS Exchange Regulations/Certifications

HIPPA

ISO 27001

NIST 800-53

GEORGIA SECURITY AND IMMIGRATION COMPLIANCE ACT AFFIDAVIT

CONTRACTOR AFFIDAVIT

By executing this affidavit, the undersigned person or entity verifies its compliance with O.C.G.A. §13-10-91, stating affirmatively that the individual, firm or entity which is engaged in the physical performance of services under a contract with the Atlanta Regional Commission has registered with and is participating in a federal work authorization program, in accordance with the applicability provisions and deadlines established in O.C.G.A. 13-10- 91.

The undersigned person or entity further agrees that it will continue to use the federal work authorization program throughout the contract period, and it will contract for the physical performance of services in satisfaction of such contract only with subcontractors who present an affidavit to the undersigned with the information required by O.C.G.A. 13- 10-91(b).

The undersigned person or entity further agrees to maintain records of such compliance and provide a copy of each such verification to the Atlanta Regional Commission within five

(5) business days after any subcontractor is retained to perform such service.

EEV / E-Verify TM Company Identification Number Date of Authorization

Company Name

Signature of Authorized Officer or Agent

Title of Authorized Officer or Agent

Printed Name of Authorized Officer or Agent

SUBSCRIBED AND SWORN

BEFORE ME ON THIS THE

DAY OF , 20

[NOTARY SEAL]

Notary Public My Commission Expires: