RFP - CIT Cybersecurity Audit - Addendum 2.pdf
PDF 154 KB Posted
- Attached to
- RFP CIT CYBERSECURITY AUDIT
- Solicitation number
- S-X06100-00014463
- Issued by
- Columbia County, Condon City, Oregon
About this file
This document is Addendum #2 for the CIT Cybersecurity Audit RFP dated August 15, 2025, issued by the Coquille Tribal Information Technology (CIT) department. The addendum provides clarifications and answers to potential bidders' questions about a comprehensive cybersecurity audit project. The scope includes scanning both internal and external network segments, policy gap assessments, and multiple testing methodologies such as phishing campaigns, in-person testing, and social engineering. The project requires multiple reports, including an executive summary for non-technical audiences, and allows for either remote or onsite access. Penetration testing will be conducted during and after business hours, and will include wireless network testing.
The document reveals a budget range of $100,000 for the project and specifies compliance with NIST 800 standards. Some technical details about the infrastructure will be withheld until after contract award and will be shared under confidentiality agreements. Third-party vendors and systems are in scope for testing, but Operational Technology (OT) and Industrial Control Systems (ICS) are not. The RFP does not include security awareness training sessions. Certain detailed questions remain unanswered, such as the number of onsite visits, wireless access points, and departments handling sensitive data, which will be disclosed to the selected vendor.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
CIT Cybersecurity Audit RFP Addendum #2
August 15, 2025
This Addendum is hereby issued to inform you of the following revisions and/or clarifications to the above-referenced RFP and/or the Contract Documents for the Project, to the extent they have been modified herein. Any conflict or inconsistency between this Addendum and the Solicitation Document or any previous addenda will be resolved in favor of this Addendum. Proposals shall conform to this Addendum. Unless specifically changed by this Addendum, all other requirements, terms and conditions of the Solicitation Document and or Contract Documents, and any previous addenda, remain unchanged and can be modified only in writing by CIT. The following changes are hereby made:
1. Additional Questions Received:
o Are systems segmented (e.g., internal vs. external networks), and are we expected to test both?
o Yes, systems are segmented and yes to scan both.
o Are any Operational Technology (OT) or Industrial Control Systems (ICS) in scope?
o No.
o Will we be expected to rewrite or just assess/document gaps in those policies?
o Yes, there are expectations to assess document gaps.
o Do you expect a phishing campaign, in-person testing (e.g., USB drops), phone-based social engineering, or a combination?
o Yes, a combination.
o How many presentations are expected? Is there one final meeting, or separate sessions for Tribal Leadership, IT, and others?
o Multiple Reports expected.
o Should we provide an executive summary for non-technical audiences in addition to the technical report?
o Yes.
o Will we be provided with remote access to systems and documents, or is onsite work required?
o Either remote or onsite access.
o Do you have a budget range or funding limit we should be aware of?
o $100,000 o Are security awareness training sessions expected as part of this engagement?
o No.
o Are any third-party vendors or systems in scope for testing or review?
o Yes.
o Do you want to include wireless penetration testing when conducting the internal testing?
o Yes.
o Can all penetration testing activities occur during business hours or do you require testing after hours?
o Yes, both during and after hours testing required.
o Can all penetration testing activities occur from one location?
o Yes.
CIT Cybersecurity Audit RFP Addendum #2
August 15, 2025 o You mention compliance with NIST, is this NIST CSF or other NIST publication?
o NIST 800
2. Additional Questions Received with Answers Not Provided:
Due to the sensitive nature of our cybersecurity infrastructure, some Q&A responses cannot be provided before contract award. Technical details, including configurations, protocols, and network architecture, will be shared with the selected vendor under confidentiality agreements.
We are committed to a fair and transparent process and will ensure the awarded vendor has the information needed for a thorough audit. The questions below were asked and not answered directly.
o Are mobile devices managed through MDM? If yes, which platform?
o Is CIT providing a user list, or will we need to identify phishing targets independently?
o How many onsite visits are expected, if any?
o How many wireless access points are in scope?
o How many departments handle sensitive/critical data that should be interviewed?
END OF ADDENDUM #2
File details come from the government source that posted it. Updated .