RFP CIT Cybersecurity Audit Re-Bid 9182025.pdf

REQUEST FOR

PROPOSALS (RFP) FOR

CIT CYBERSECURITY

AUDIT RE-BID

Issue Date:

Thursday, September 18, 2025

Proposal Due:

Tuesday, October 21, 2025, 2:00 PM PST

CIT Cybersecurity Audit Re-Bid

Page | 1

Table of Contents Part 1 Introduction

Notice

Changes to RFP

Background

Purpose

Project Budget

Project Schedule

Contract Requirements

Part 2 Scope of Services

Statement of Work

Part 3 Submission Requirements

General

Content Specifications

Proposal Preparation and Submission Instructions

Part 4 Proposal Evaluation and Award

Evaluation Process

Evaluation Criteria

Interviews

Award of Contract

Part 5 Clarifications

Requests of Information

Proposer Offer, Withdrawal, and Modification

Part 6 Reservations of Rights

Part 7 Sample Contract

Part 8 Proposal Forms

ATTACHMENT A - Proposers Certification

ATTACHMENT B - Estimated Fee and Reimbursable Expenses Proposal

Page | 2

Part 1 Introduction Notice

THE COQUILLE INDIAN TRIBE

REQUEST FOR PROPOSALS

CIT CYBERSECURITY AUDIT RE-BID

Through this Request for Proposals ("RFP”), the Coquille Indian Tribe (“CIT”, “the Tribe”), is seeking competitive proposals from qualified and experienced individuals or firms (hereafter, "Proposers", “Contractor”) to conduct a comprehensive cybersecurity audit. (“Project”). The purpose of this solicitation is to secure proposals to assess our current security posture, identify vulnerabilities, and provide actionable recommendations to enhance our cybersecurity framework. CIT will accept proposals until 2:00 PM PST on Tuesday, October 21, 2025.

Electronic copies of the RFP and all required forms and attachments may be obtained by emailing projects@coquilletribe.org.

One (1) digital copy shall be submitted via email to the contact listed below with the subject line to read:

Coquille Indian Tribe - Cyber Security Audit Re-Bid

Russell Crochetiere IT Director Office of Strategic Operations Coquille Indian Tribe projects@coquilletribe.org

Please note that no formal opening of the proposals will take place.

Proposals will be evaluated, and the successful contractor will be determined and approved by the Tribe. The Tribe reserves the right to reject any or all proposals and to select the contractor and services that best meet the needs of The Tribe.

Inquiries should be directed by e-mail to Russell Crochetiere, IT Director, at projects@coquilletribe.org no later than October 14, 2025, at 2:00 PM PST.

Procurement Schedule: (dates are estimates and subject to change)

RFP Issued September 18, 2025 Last Day for RFIs October 14, 2025 RFP Proposals Due October 21, 2025, at 2:00 PM PST

Proposals Selected for Interviews* October 24, 2025

Interviews* October 28-29, 2025

Notification of Intent to Award October 31, 2025 Project Start December 1, 2025

*The Tribe reserves the right to select a consultant from submitted qualification proposals alone.

mailto:projects@coquilletribe.org https://coquilletribe-my.sharepoint.com/personal/faunahill_coquilletribe_org/Documents/Desktop/Master%20Plan%20RFQ%20Template/faunahill@coquilletribe.org

Page | 3

Changes to RFP Any change or clarification of the Scope of Work, procurement process, contract terms and conditions, insurance requirements, or any other matter contained in this RFP will be issued in the form of a written Addendum to this RFP. CIT will make a good-faith effort to notify interested parties of any addenda issued for this RFP. However, it is the responsibility of all parties interested in this or any other CIT contract opportunity to check for any addenda that have been issued for this or other contract opportunities, up to the solicitation closing time.

Background The Coquille Indian Tribe is seeking to retain an experienced cybersecurity firm to assess the current cybersecurity posture of the Tribal Governments IT Environment. This would involve identifying vulnerabilities and risks within the environment, providing actionable recommendations to enhance security, and ensuring compliance with relevant federal, state, and tribal regulations. The Coquille Indian Tribe has approximately 250+ employees, including a Medical, Dental, and Behavioral Health division called Ko-Kwel Wellness Center. The Tribal Government and Wellness Center have a presence in Coos Bay and Eugene, Oregon.

Purpose The Tribe is committed to safeguarding Tribal systems, data, and operations against cyber threats. CIT has issued this Request for Proposals (RFP) to identify a qualified cybersecurity firm to conduct a comprehensive cybersecurity audit of its technology environment.

The audit will evaluate CIT’s current cybersecurity posture, test system defenses through penetration testing, review policies for compliance and effectiveness, and provide actionable recommendations aligned with industry standards (NIST 800 framework).

Project Budget The Tribe has budgeted $100,000 for the audit and implementation of solutions.

Project Schedule The following is the anticipated project timeline. A preliminary schedule is outlined below. Dates are subject to change.

RFP Issued September 18, 2025 Last Day for RFIs October 14, 2025 RFP Proposals Due October 21, 2025, at 2:00 PM PST Proposals Selected for Interviews* October 24, 2025 Interviews* October 28-29, 2025 Notification of Intent to Award October 31, 2025 Project Start December 1, 2025 80% draft with recommendations February 13, 2026 Review with Tribal Council Early-March 2026 Final Draft March 31, 2026

*The Tribe reserves the right to select a consultant from submitted qualification proposals alone.

Contract Requirements The successful proposer will be invited to enter into a Professional Services Agreement (the “Contract”) with CIT. The contract will become effective upon execution by both parties.

Authorization to proceed with a subsequent phase will occur only after CIT and the Contractor have successfully negotiated the scope and cost of the contemplated Corrective Actions. The Coquille Indian Tribe, at its sole discretion, may also wish

Page | 4 to execute a services contract with the successful contractor at the conclusion of the project, which may include ongoing maintenance.

Proposers should state their willingness to execute a negotiated agreement as outlined in this RFP. Proposers should expressly state their reservations, if any, regarding the form of agreement and identify changes, if any, in their proposal.

Proposers should be aware that CIT will value specificity and clarity regarding both the reservations expressed and the requested modifications, as well as their rationales.

The Tribe, at its sole discretion, may also wish to execute a services contract with the successful contractor at the conclusion of the project, which may include ongoing maintenance. Proposers should state their willingness to execute a negotiated agreement as outlined in this RFP. Proposers should expressly state their reservations, if any, regarding the form of agreement and identify changes, if any, in their proposal. Proposers should be aware that CIT will value specificity and clarity regarding both the reservations expressed and the requested modifications, as well as their rationales.

As a condition of award and prior to commencement of services, the selected Contractor shall execute a Non-Disclosure Agreement (NDA) in a form acceptable to the Tribe. The NDA will apply to all personnel, subcontractors, and affiliates of the Contractor who may have access to the Tribe’s information, systems, facilities, or records.

Failure to execute the NDA within the specified timeframe may result in withdrawal of the award and selection of an alternate Contractor.

The Proposer will be required to furnish proof of the following types of insurance:

A. Insurance Coverages. The Proposer shall procure and maintain at its expense during the Period of Performance and thereafter as required below the following insurance from one or more companies authorized to do business in the State of Oregon with a policyholder’s rating of not less than A-IX in the most recent edition of Best’s Rating Guide. Except as approved otherwise by the Owner in advance, such insurance shall protect against claims which arise out of or relate to all of the Proposer’s services under the Agreement, whether performed by the Proposer or a consultant or a person or entity for which either of them may be responsible.

1. Workers’ Compensation Insurance, if required by law, with statutory limits.

2. Employer’s Liability Insurance, if employees are employed for other than secretarial or bookkeeping services, with a limit of not less than $1,000,000 each accident, $1,000,000 disease each employee and $1,000,000 disease policy limit.

3. Commercial General Liability Insurance, applicable to all premises and operations, including Bodily Injury, Property Damage, Personal Injury, Contractual Liability, Independent Contractors, Products and Completed Operations, Broad Form Property Damage (including Completed Operations), and coverage for explosion, collapse and underground hazards, with minimum limits of not less than $1,000,000 per occurrence, $2,000,000 aggregate applicable specifically to the Project, $1,000,000 personal and advertising injury and $1,000,000 Products and Completed Operations aggregate. Proposer shall notify the Owner, prior to signing the contract, of any “Residential Construction” exclusions and/or limitations of coverage that may be part of the Commercial General Liability Insurance.

4. Business Automobile Liability Insurance, applicable to owned, non-owned and hired automobiles, with a limit of not less than $1,000,000 combined single limit each accident.

5. Professional Liability Insurance, applicable to all acts and omissions of Proposer and its consultants at all tiers, with limits of not less than $1,000,000 each claim and $2,000,000 aggregate.

B. Deductibles. The Proposer shall pay all deductibles on all policies required by Paragraph 1.

Page | 5

C. Waivers of Subrogation. The Workers’ Compensation and Employer’s Liability policies shall be subject to a waiver of subrogation in favor of Owner and its members, directors, agents and employees, and the successors in interest of the foregoing.

D. Cross-Liability Coverages. The Commercial General Liability and Automobile Liability policies shall provide cross-liability coverages as would be achieved under the standard International Organization for Standardization (“ISO”) separations of insureds clause.

E. Additional Insureds. The Commercial General Liability and Automobile Liability policies shall name the Owner and its members, directors, agents and employees, and the successors in interest of the foregoing, as additional insureds, using ISO additional insureds endorsement CG 20 10 11 85 or a substitute providing equivalent coverages. Such coverages provided to the additional insureds shall (a) be primary and noncontributory with respect to any insurance or self-insurance retention of the additional insureds, including but not limited to any Excess Liability coverage maintained by the additional insureds, (b) provide the same types and extents of coverages as the coverages provided to the primary insured, and shall not be limited to the “vicarious liability” of the additional insureds, (c) waive all rights of subrogation against the additional insureds, and (d) be maintained for the same durations as the coverages provided to the primary insured, including but not limited to the continuation of the Products and Completed Operations coverage until ten (10) years after final payment to the Owner’s prime contractor on the Project, and shall not be limited to “ongoing operations”.

F. Duration of Coverages. The insurance coverages required by Paragraphs 1 through 5 shall be written on an occurrence basis, except the Professional Liability Insurance. All other policies shall be in effect as of the date of commencement of the Proposer’s services under the Agreement. All policies shall be maintained and remain in effect until one (1) year after final payment to the Owner’s prime contractor on the Project and thereafter when the Proposer is assisting or advising the Owner regarding the correction of defective or nonconforming Work;

provided that the Products and Completed Operations policy and the Professional Liability policy shall remain in effect until three (3) years after final payment to the Owner’s prime contractor on the Project. The Proposer shall notify the Owner, in writing, of any claims against the Professional Liability policy and Commercial General Liability policy, in which event the Owner shall have the right to require the Proposer at its expense to obtain additional Professional Liability Insurance in order to restore the required coverage available for the Project.

G. Proof of Insurance. The Proposer shall file with Owner, upon execution of the Agreement, certificates of insurance acceptable to the Owner as well as copies of all insurance policies, with all riders and endorsements, all separate exclusions, conditions and waivers, and all other amendatory documents attached, evidencing the insurance required by this Exhibit. These certificates and policies shall contain a provision that coverages afforded under the policies will not be cancelled or allowed to expire until at least thirty (30) days’ written notice has been given to the Owner. If any of the required coverages are to renew during the period when such coverage is to remain in effect or are required to remain in force after final payment to the Owner’s prime contractor on the Project, an additional certificate evidencing continuation of such coverage shall be submitted upon renewal or with the Proposer's final invoice.

H. Effect of No or Insufficient Insurance. The Proposer’s failure to comply with the requirements of this Exhibit shall constitute a material breach of the Agreement entitling the Owner to terminate the Agreement for cause. In the alternative, the Owner in its sole discretion may purchase the insurance required of, but not obtained or maintained, by the Proposer pursuant to this Exhibit and charge such costs thereof to the Proposer. The Owner’s rights under this Paragraph shall be in addition to, and without waiver of, its other rights and remedies under the Agreement or applicable law.

I. Limitation of This Exhibit. Nothing in this Exhibit shall negate, abridge, or reduce the Proposer’s responsibilities or liabilities under the Agreement or applicable law, the meaning and effect of the provisions of this Exhibit being limited to setting out the Proposer’s express obligations with respect to insurance.

Page | 6

J. Professional Liability (aka "Errors and Omissions") insurance with a combined single limit of not less than $1,000,000, on a claims-made basis, for indemnity of the insured for liability claims arising from or due to the negligence in the performance of professional services under an awarded contract.

As evidence of adequate insurance coverage and prior to contract execution, the selected Contractor(s) will provide to the CIT certificates of insurance listing the “Coquille Indian Tribe” as a certificate holder.

The certificate(s) shall provide that the Selected Contractor's insurance shall not be terminated or cancelled without thirty

(30) days prior written notice to CIT. Insuring companies or entities are subject to CIT's acceptance and must be licensed to provide insurance in the State of Oregon. Contractor's insurance shall be primary insurance, and any commercial insurance or self-insurance maintained by the Coquille Indian Tribe and/or CIT shall not contribute to it.

Part 2 Scope of Services Statement of Work The selected vendor will be expected to perform the following services:

A. Licensing & Compliance

1. Vendors must be licensed to do business in Oregon.

2. Testing and gap assessments must align with NIST 800 standards.

3. Review CIT’s cybersecurity policies for alignment with NIST 800; document gaps and provide recommendations.

B. Network & System Assessment

1. Conduct internal and external penetration testing, including wireless networks.

2. Perform testing during both business and after hours.

3. Confirm segmentation of systems and assess vulnerabilities across segmented networks.

4. In-scope systems include:

i. ~60 servers (Windows/Linux)

ii. ~500 endpoints (Windows/macOS; Linux possible in limited numbers)

iii. ~350 Network devices (routers, switches, firewalls, WAPs; vendor details post-award)

iv. Mobile devices in scope; MDM platform shared post-award

v. IoT devices (printers, cameras; ICS/SCADA excluded)

vi. Web applications (3–5 mission-critical; list post-award)

vii. APIs/microservices (REST; counts post-award)

viii. Databases (SQL/NoSQL; platforms include Microsoft SQL Server)

ix. Domain Service (Active Directory ADDS)

x. Cloud platforms (Azure AD, Microsoft 365, hybrid environment)

xi. SaaS applications (e.g., O365, HR, Finance apps)

xii. Third-party/vendor-connected systems

C. Social Engineering & Security Testing

1. Penetration testing: Both unauthenticated (black-box) and authenticated (gray-box) scans required; white-box only if mutually agreed.

2. No systems are explicitly off-limits, but some legacy/ERP may require restricted testing windows.

3. Testing windows: No blackout dates; testing may occur during and after business hours.

4. Execute phishing campaigns (user list provided post-award).

5. Conduct phone-based social engineering.

6. Perform in-person testing (e.g., USB drops).

7. Evaluate employee susceptibility; results may be anonymized but should include departmental trends.

Page | 7

D. Policy & Governance Review

1. Evaluate the comprehensiveness of IT security policies and controls.

2. Benchmark against NIST 800; cross-mapping to HIPAA, PCI-DSS, and CJIS where applicable.

3. Document deficiencies and provide remediation recommendations (policy rewrites not required).

E. Reporting & Presentations

1. Deliverables must include:

i. Technical report with vulnerabilities, risk ratings, and remediation recommendations.

ii. Executive summary for non-technical audiences.

iii. Remediation roadmap with effort estimates, vendor-neutral recommendations preferred.

2. Multiple presentations tailored to:

i. Tribal Leadership & Executive Team

ii. IT Department

iii. Other critical departments F. Access & Engagement

1. Work may be performed remotely or onsite; vendor to propose approach.

2. Expected 1–2 onsite visits (finalized during contract negotiation).

3. CIT IT will provision access within two weeks of contract execution.

4. Sensitive details (configs, diagrams, MDM platform) provided post-award under NDA.

G. Out-of-Scope

1. Operational Technology (OT) and Industrial Control Systems (ICS).

2. Security awareness training sessions.

Part 3 Submission Requirements General Proposals submitted in response to this RFP shall be of sufficient length and detail to demonstrate that the Proposer has a thorough understanding of the needs of the Project described in this RFP. Proposals should address the submittal requirements of this RFP in a clear, succinct, and direct manner. Proposals submitted in response to this RFP will be evaluated in accordance with the following Submittal Requirements and Evaluation Criteria. Please organize the proposal corresponding to the order of the sections below.

Responses should be of sufficient length and detail to demonstrate the Proposer's understanding of the requirements described in Part 2 of this RFP, "Scope of Services."

Content Specifications A selection committee will assess each proposal as to completeness, qualifications, experience, project understanding, and approach. CIT may waive informalities and accept any given proposal as submitted and/or request further information.

CIT’s decision will be final and is not subject to appeal.

Prerequisites: In order to be considered, Proposer must:

A. Be a legal entity that has the authority to transact business in the State of Oregon.

B. Provide adequate proof of insurance, as set forth in Part 1 of this RFP, “Contract Requirements.”

C. Execute, provide, and comply with the Proposer’s Certification (Attachment A).

D. Provide a proposal sheet (Attachment B), including a rate sheet as outlined in “Cost Proposal and Fee Schedule.”

To be considered for selection, submit the below information, clearly labeled, and in the following order. The consultant shall submit one (1) digital copy of the submission in pdf format.

Page | 8

1. Cover Letter The cover letter should include a brief history of your firm, a short biography of the lead or primary person and description of the services your firm proposes to provide CIT. Summarize in a concise manner the proposer’s understanding of the scope of work and proposed approach, activities, and deliverables to meet the scope of work.

Additionally, include the mailing address, phone/fax numbers and email address of the individual signing the cover letter, as well as contact information for your firm's primary contact(s) for this RFP, if different.

2. Cybersecurity Team A. Narrative and/or graphic that identifies the key personnel at the corporate and field levels that will be assigned to this project. Describe their relevant experience, responsibilities, and approximate amount of time each will devote to this project during each phase.

B. Provide proof of valid State of Oregon licensure for all team members required to be licensed by state law.

C. State whether any member of the team is currently, or has been during the last five years, involved in defending, negotiating, mediating, or litigating any claims, liens, or allegations of theft relating to or arising from cybersecurity services, data breaches, security incidents, or failure to meet contractual obligations in information security or privacy-related engagements. Provide a brief description of the circumstances that led to the claim(s) and the final resolution(s).

3. Experience of Cybersecurity Team Describe capabilities for the following:

A. Company background and qualifications B. Experience with tribal governments or similar organizations C. References from past clients

4. Cost Proposal and Fee Schedule

Provide Not-to-Exceed Cost for items outlined in Part 2 “Scope of Services”.

A. Provide Standard Fee Schedule for field technical service including travel and incidental expenses.

B. Describe payment terms, including travel and incidental expenses.

5. Tribal Preference/Tribal Employment

Any proposals submitted by an Indian Owned Business (IOB) will be prioritized. Contractor shall work with CIT to set forth preferences in employment and contracting utilizing CIT owned business and qualified Tribal Members to provide labor and supplies for the construction of the project.

Proposal Preparation and Submission Instructions All proposals must comply with the following instructions. Failure to comply with these instructions will result in the disqualification of the proposal.

Notice of the opportunity, RFP documents and all associated addenda and award notifications will be published on State of Oregon’s, OregonBuys site (https://oregonbuys.gov/bso).

Proposal Due Date/Proposals must be received by CIT no later than October 21, 2025, at 2:00 PM https://oregonbuys.gov/bso

Page | 9

Proposals and questions should be submitted electronically and addressed to:

Russell Crochetiere IT Director Office of Strategic Operations Coquille Indian Tribe projects@coquilletribe.org

Respondents are responsible for ensuring receipt of electronic submission by the specified due date.

There will be no public opening of the proposals.

Part 4 Proposal Evaluation and Award Evaluation Process A Selection Committee will be formed to evaluate responsive proposals and shall apply the evaluation criteria set forth below. The Committee will determine which proposals are in the competitive range. CIT may, in its sole discretion, find that proposals not adhering to all terms and conditions of this RFP, or that are otherwise non-responsive, do not meet the minimum requirements and may be rejected or given a low rating in the evaluation process.

The following process will be generally followed for the evaluation and award of a contract:

A. Determine if proposals meet minimum requirements.

B. Evaluate proposals.

C. Determine which proposals are in the competitive range.

D. Selection of candidate.

Evaluation Criteria

The Tribe will evaluate respondents based upon the written response to this RFP and any other information requested by The Tribe.

Criteria Description

Approach Consultant’s understanding of and approach in providing RFP services. Responsiveness and completeness of the proposal and any value-added component. The degree to which the proposal offers a clear, comprehensive, and collaborative process.

Cost Overall cost, cost effectiveness, and resource allocation.

Experience Working with Tribes Demonstrated qualifications and experience working with other tribal communities

Project Management Consultants' experience with similar projects and references from their clients. Ability to perform and complete the work in a professional and timely manner.

Additional Qualifications Preferences given to consultants with cybersecurity certifications such as CEH, CISSP or other.

Tribally Owned Business Preference is given to firm/consultant owned or operated by Coquille Tribal members or other tribal or indigenous owned businesses.

Women, Veteran, and Minority-Owned Business

Preference is given to firm/consultant owned or operated by minority, veteran, or women-owned or designated DBE.

Page | 10

CIT reserves the right to investigate the qualifications of all Proposers under consideration and to confirm any part of the information furnished by a Proposer, or to require additional evidence of managerial, financial, technical, or other capabilities that are considered necessary for the successful performance of the work.

Interviews During the review of proposals CIT may ask for additional information and request face-to-face interviews with the top three candidates. CIT will then make the final selection decision. At its sole discretion, CIT may invite the Finalist Proposer(s)' Key Personnel to interview with CIT staff, in person, via conference-call or another mutually agreeable medium, to clarify their proposal and determine the overall suitability of Finalist Proposer(s)' Key Personnel to the anticipated project.

If requested, attendance at such an interview is mandatory and failure to meet with CIT within a reasonable period of time will be grounds for proposal rejection. Following the interview, CIT reserves the right to re-score the Finalist Proposer(s) or to use the original scores solely as the basis to determine the Finalist Proposer(s) and make an award determination based on the overall strength of the Finalist proposal and interview.

Award of Contract A. CIT reserves the right to select for contract award the Proposer that offers the best overall value, benefit, convenience, and service to CIT, taking into account the cost. However, cost is only one of several evaluation and selection criteria, and on its own, is not determinative of the best overall value, benefit, and service to CIT.

B. After completion of the evaluation process, CIT will name an "apparent successful Proposer" and issue a "Notice of Intent to Award" a contract to this Proposer.

Part 5 Clarifications Requests of Information All requests for clarification or change regarding any technical, procedural, contractual or insurance requirement(s), or any other matter regarding this RFP must be submitted in writing via e-mail to projects@coquilletribe.org. All requests for clarification or change must be submitted by October 14, 2025. CIT will consider all timely-received questions and requests for change and, if reasonable and appropriate, will issue an addendum via e-mail to all recipients to clarify or modify this

RFP.

Proposer Offer, Withdrawal, and Modification Any proposal submitted in response to this RFP will be regarded by CIT as a binding offer by the Proposer to complete the work described above for a period of ninety (90) calendar days from the date proposals are due. This period may be modified upon the mutual agreement between CIT and Proposer. Proposals may be withdrawn or modified prior to the date and time proposals are due by written request. Proposals may not be withdrawn or modified after the date and time proposals are due unless agreed to by CIT in writing.

Part 6 Reservations of Rights The Coquille Indian Tribe reserves all rights (which may be exercised by The Tribe in its sole discretion) available to it under applicable laws, including without limitation, and with or without cause and with or without notice, the right to:

A. Cancel this RFP in whole or in part, at any time before the execution of a contract by The Coquille Indian Tribe, without incurring any cost, obligations, or liabilities.

B. Issue addenda, supplements, and modifications to this RFP.

Page | 11

C. Revise and modify, at any time before the RFP submittal due date, the factors and/or weights of factors The Tribe will consider in evaluating RFP submittals and revising or otherwise expanding its evaluation methodology as set forth herein.

D. Extend the RFP submittal due date.

E. Investigate the qualifications of any firm under consideration and require submittal confirmation of information furnished by a firm.

F. Require additional information from a firm concerning the contents of its RFP until such time as The Tribe declares, in writing, that a particular stage or phase of its review of the responses has been completed or closed.

G. Reject at any time, any or all submittals, responses, and RFP submittals received.

H. Terminate, at any time, evaluations of responses received.

I. Appoint an evaluation committee to review RFP submittals or responses, make recommendations, and seek the assistance of outside technical experts and consultants in RFP submittal evaluation.

J. Hold interviews and conduct discussions and correspondence with one or more of the firms responding to this

RFP to seek an improved understanding and evaluation of the responses to this RFP.

K. Seek or obtain data from any source that has the potential to improve the understanding and evaluation of the responses to this RFP.

L. Waive deficiencies in an RFP submittal, accept and review a non-conforming RFP submittal or seek clarifications or supplements to an RFP submittal.

M. The Tribe reserves the right to terminate this process or to cancel or modify this solicitation process at any time.

In no event will The Tribe or any of its respective agents, representatives, consultants, directors, officers, or employees, be liable for, or otherwise obligated to reimburse the costs incurred in preparation for this RFP or any other related costs. The prospective firms shall be fully responsible for all costs incurred in the preparation and/or presentation of the RFP submittals. The RFP submittals will become the property of The Tribe.

N. The Tribe reserves the right to reject any or all proposals submitted or make modifications to the scope of work, subject to appropriate negotiation, during the design process.

O. The final decision is the sole decision of The Tribe, and the respondents to this formal request have no appeal rights or procedures guaranteed to them.

P. Data handling: All testing data must be securely handled and destroyed at project closeout, with certification of destruction to CIT.

Page | 12

Part 7 Sample Contract

(Page purposely left blank)

Page | 13

Page | 14

Page | 15

Page | 16

Page | 17

Page | 18

Page | 19

Part 8 Proposal Forms

(Page purposely left blank)

Page | 20

ATTACHMENT A - Proposers Certification

A. The undersigned acknowledges receipt of Addendum numbers ______ through ______ or N/A.

B. Proposer certifies it is an independent contractor as defined by ORS 670.600 and under penalty of perjury is, to the best of the undersigned's knowledge, not in violation of any local, state, or federal tax law.

C. Proposer certifies this proposal is genuine and not made in the interest of or on behalf of any undisclosed person, firm, or corporation; Proposer has not induced any person, firm, or corporation to refrain from proposing; and Proposer has not sought by collusion or fraud to obtain for itself any advantage over any other Proposer or over

CIT.

D. Proposer certifies that the firm has no business or personal relationships with any other company or person that could be considered a conflict of interest or potential conflict of interest to CIT.

E. Proposer agrees to make their proposal a binding offer to CIT for a period of ninety (90) calendar days from the date proposals are due.

F. The undersigned warrants that he/she is an authorized representative of the Proposer; has read, understands and agrees to be bound by all RFP instructions, insurance requirements and contract terms and conditions contained herein (including all addenda issued for this RFP); that the information provided in this proposal is true and accurate; and that providing incorrect or incomplete information may be cause for proposal rejection or contract termination.

Legal Business Name:

Mailing Address:

Contact Person Printed Name & Title:

Phone Number: Email:

Federal Tax Identification Number (FEIN):

Signature: Date:

Page | 21

ATTACHMENT B - Estimated Fee and Reimbursable Expenses Proposal

Project Personnel List all project personnel you would assign to the project and associated costs for the duration of the project based on the schedule listed in the RFP. If a category listed below will not be assigned and/or charged as reimbursable to the project, please indicate so.

List the reimbursable expenses for the duration of the project based on the schedule outlined in the RFP.

Cost Category Description Unit (Hrs/Fixed) Quantity Rate ($) Extended

Cost ($)

Project Management & Planning

Kick-off meetings, coordination, status calls

Network Penetration Testing

Servers, endpoints, devices, wireless, APIs

Social Engineering Testing Phishing, phone, in-person testing

Policy & Compliance Review NIST 800 alignment gap analysis

Reporting & Documentation

Technical report & executive summary

Presentations Leadership, IT, and department sessions

Travel & Onsite Expenses Lodging, mileage, meals (if applicable)

Optional Services

TOTAL COST

(Not-to-Exceed)

Name of Company:

Authorized Signature: Date: