RFP - Cyber Security Audit - Addendum 1.pdf

RFP for CIT Cybersecurity Audit Addendum #1 August 6, 2025

This Addendum is hereby issued to inform you of the following revisions and/or clarifications to the above-referenced RFP and/or the Contract Documents for the Project, to the extent they have been modified herein. Any conflict or inconsistency between this Addendum and the Solicitation Document or any previous addenda will be resolved in favor of this Addendum. Proposals shall conform to this Addendum. Unless specifically changed by this Addendum, all other requirements, terms and conditions of the Solicitation Document and or Contract Documents, and any previous addenda, remain unchanged and can be modified only in writing by CIT. The following changes are hereby made:

Additional Questions Received:

• Is it mandatory for proposers to hold a State of Oregon business license at the time of proposal submission?

o Yes. Proposers need to be licensed to do business in the State of Oregon, prior to award.

• How many servers (physical/virtual) are in scope?

o Under 60 servers are in scope.

• Are network devices (routers, switches, firewalls, WAPs) part of testing?

o Yes, network devices are part of testing.

• Are IoT devices (printers, cameras, ICS/SCADA) included?

o Yes, printers and cameras are included.

• Are APIs or microservices in scope?

o Yes, APIs and microservices are in scope.

• Are databases (SQL, NoSQL) included?

o Yes, SQL databases included.

• Are containerized workloads (Docker, Kubernetes) part of testing?

o No, containerized workloads are not part of testing.

• Are SaaS applications (e.g., O365, Salesforce) included?

o Yes, SaaS applications included.

• Are there off-limits systems (e.g., production ERP, legacy systems)?

o Yes, there are off-limits systems.

• Will testing include third-party/vendor systems connected to your network?

o Yes, testing will include third-party/vendor systems connected to CIT’s network.

• For penetration testing, is the scope black-box, gray-box, or white-box?

o Grey-box penetration testing is preferred.

• Should testing simulate external attackers (Internet-facing systems) and/or internal threats (lateral movement)?

o Yes, testing should simulate external attackers and/or internal threats.

• Are there any legacy systems or unique network configurations that require special attention?

o No, there are no legacy systems that require special attention.

• What is the total number of endpoints (workstations, servers, mobile devices) to be assessed?

o Approximately 500 endpoints to be assessed.

• Are there any Bring Your Own Device (BYOD) policies or devices to include?

o Yes, there are Bring Your Own Device (BYOD) policies and devices included.

• What types of cloud services (IaaS, PaaS, SaaS) are deployed?

o SaaS cloud services are deployed.

• Are there any internal cybersecurity policies or frameworks already documented?

o Yes, there are internal cybersecurity policies already documented.

• What is the approximate number of employees to be included in phishing simulations?

o Approximately 250 employees to be included in phishing simulations.

Additional Questions Received with Answers Not Provided:

Due to the sensitive nature of our cybersecurity infrastructure, some Q&A responses cannot be provided before contract award. Technical details, including configurations, protocols, and network architecture, will be shared with the selected vendor under confidentiality agreements.

We are committed to a fair and transparent process and will ensure the awarded vendor has the information needed for a thorough audit. The questions below were asked and not answered directly.

• Are there any known cybersecurity concerns or past audit findings that should be addressed during this audit?

• How many workstations/endpoints (Windows, macOS, Linux) are included?

• Please provide network devices, counts and vendors (e.g., Cisco, Palo Alto).

• How many servers and, Specify OS (Windows Server, Linux, etc.).

• Approximate count and types of IoT devices.

• How many web applications (internal/external) will be tested? List critical ones (e.g., HR portals, CRM, payment systems).

• Approximate number and types of APIs and microservices (REST, SOAP).

• Provide database counts and platforms (e.g., MySQL, MSSQL, Oracle).

• How many cloud instances (AWS EC2, Azure VMs, etc.) are in scope?

• List critical SaaS applications.

• How many network segments/firewalls are in scope for assessment?

• Is there a network topology diagram available for reference?

• What endpoint protection solutions (e.g., EDR, antivirus) are currently in place?

• Which cloud platforms (e.g., AWS, Azure, Google Cloud) are in use?

• How is remote access managed (e.g., VPN, Zero Trust, MFA)?

• How many company-owned mobile devices are in scope?

• Are Mobile Device Management (MDM) solutions currently deployed?

• Which specific standards (NIST, HIPAA, PCI-DSS, CJIS) are mandatory for compliance?

• Are incident response or disaster recovery plans currently tested or updated? If so, how often?

• Are there any restrictions on the types of social engineering tests (e.g., no voice phishing)?

• Has the organization conducted similar assessments in the past? If so, what were the results?

END OF ADDENDUM #1