RFP - Cyber Security Audit - Addendum 2.pdf
PDF 123 KB Posted
- Attached to
- RFP CIT CYBERSECURITY AUDIT
- Solicitation number
- S-X06100-00014463
- Issued by
- Columbia County, Condon City, Oregon
About this file
This Addendum #1 to the RFP for Cybersecurity Audit issued by the Coquille Indian Tribe (CIT) provides clarifications and answers to proposer questions regarding the scope of the cybersecurity audit engagement. The addendum confirms that proposers must hold a State of Oregon business license prior to award. The audit scope encompasses under 60 physical and virtual servers, approximately 500 endpoints (workstations, servers, and mobile devices), network devices including routers, switches, firewalls, and wireless access points, IoT devices such as printers and cameras, APIs and microservices, SQL databases, SaaS applications including Office 365 and Salesforce, BYOD-enabled devices, and third-party vendor systems connected to CIT's network. The assessment will include grey-box penetration testing simulating both external Internet-facing attacks and internal lateral movement threats. Excluded from testing are containerized workloads such as Docker and Kubernetes. The social engineering component will encompass phishing simulations targeting approximately 250 employees. CIT has confirmed that internal cybersecurity policies and frameworks are already documented and that no legacy systems require special attention during the audit.
The addendum specifies that certain sensitive technical details regarding cybersecurity infrastructure, configurations, protocols, and network architecture will not be disclosed prior to contract award but will be shared with the selected vendor under confidentiality agreements. Specific unanswered questions include detailed information on known cybersecurity concerns, exact counts and specifications of workstations by operating system, network device vendors and configurations, server operating systems, IoT device types and counts, web application inventory, database platforms and counts, cloud instances and platforms in use, endpoint protection solutions currently deployed, remote access management methods and MFA implementation, compliance standards applicable to CIT (NIST, HIPAA, PCI-DSS, CJIS), incident response and disaster recovery testing frequency, restrictions on social engineering test types, and results from any previous assessments. This approach ensures a fair and transparent procurement process while protecting the tribe's sensitive infrastructure information until contract execution.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
RFP for CIT Cybersecurity Audit Addendum #1 August 6, 2025
This Addendum is hereby issued to inform you of the following revisions and/or clarifications to the above-referenced RFP and/or the Contract Documents for the Project, to the extent they have been modified herein. Any conflict or inconsistency between this Addendum and the Solicitation Document or any previous addenda will be resolved in favor of this Addendum. Proposals shall conform to this Addendum. Unless specifically changed by this Addendum, all other requirements, terms and conditions of the Solicitation Document and or Contract Documents, and any previous addenda, remain unchanged and can be modified only in writing by CIT. The following changes are hereby made:
Additional Questions Received:
• Is it mandatory for proposers to hold a State of Oregon business license at the time of proposal submission?
o Yes. Proposers need to be licensed to do business in the State of Oregon, prior to award.
• How many servers (physical/virtual) are in scope?
o Under 60 servers are in scope.
• Are network devices (routers, switches, firewalls, WAPs) part of testing?
o Yes, network devices are part of testing.
• Are IoT devices (printers, cameras, ICS/SCADA) included?
o Yes, printers and cameras are included.
• Are APIs or microservices in scope?
o Yes, APIs and microservices are in scope.
• Are databases (SQL, NoSQL) included?
o Yes, SQL databases included.
• Are containerized workloads (Docker, Kubernetes) part of testing?
o No, containerized workloads are not part of testing.
• Are SaaS applications (e.g., O365, Salesforce) included?
o Yes, SaaS applications included.
• Are there off-limits systems (e.g., production ERP, legacy systems)?
o Yes, there are off-limits systems.
• Will testing include third-party/vendor systems connected to your network?
o Yes, testing will include third-party/vendor systems connected to CIT’s network.
• For penetration testing, is the scope black-box, gray-box, or white-box?
o Grey-box penetration testing is preferred.
• Should testing simulate external attackers (Internet-facing systems) and/or internal threats (lateral movement)?
o Yes, testing should simulate external attackers and/or internal threats.
• Are there any legacy systems or unique network configurations that require special attention?
o No, there are no legacy systems that require special attention.
• What is the total number of endpoints (workstations, servers, mobile devices) to be assessed?
o Approximately 500 endpoints to be assessed.
• Are there any Bring Your Own Device (BYOD) policies or devices to include?
o Yes, there are Bring Your Own Device (BYOD) policies and devices included.
• What types of cloud services (IaaS, PaaS, SaaS) are deployed?
o SaaS cloud services are deployed.
• Are there any internal cybersecurity policies or frameworks already documented?
o Yes, there are internal cybersecurity policies already documented.
• What is the approximate number of employees to be included in phishing simulations?
o Approximately 250 employees to be included in phishing simulations.
Additional Questions Received with Answers Not Provided:
Due to the sensitive nature of our cybersecurity infrastructure, some Q&A responses cannot be provided before contract award. Technical details, including configurations, protocols, and network architecture, will be shared with the selected vendor under confidentiality agreements.
We are committed to a fair and transparent process and will ensure the awarded vendor has the information needed for a thorough audit. The questions below were asked and not answered directly.
• Are there any known cybersecurity concerns or past audit findings that should be addressed during this audit?
• How many workstations/endpoints (Windows, macOS, Linux) are included?
• Please provide network devices, counts and vendors (e.g., Cisco, Palo Alto).
• How many servers and, Specify OS (Windows Server, Linux, etc.).
• Approximate count and types of IoT devices.
• How many web applications (internal/external) will be tested? List critical ones (e.g., HR portals, CRM, payment systems).
• Approximate number and types of APIs and microservices (REST, SOAP).
• Provide database counts and platforms (e.g., MySQL, MSSQL, Oracle).
• How many cloud instances (AWS EC2, Azure VMs, etc.) are in scope?
• List critical SaaS applications.
• How many network segments/firewalls are in scope for assessment?
• Is there a network topology diagram available for reference?
• What endpoint protection solutions (e.g., EDR, antivirus) are currently in place?
• Which cloud platforms (e.g., AWS, Azure, Google Cloud) are in use?
• How is remote access managed (e.g., VPN, Zero Trust, MFA)?
• How many company-owned mobile devices are in scope?
• Are Mobile Device Management (MDM) solutions currently deployed?
• Which specific standards (NIST, HIPAA, PCI-DSS, CJIS) are mandatory for compliance?
• Are incident response or disaster recovery plans currently tested or updated? If so, how often?
• Are there any restrictions on the types of social engineering tests (e.g., no voice phishing)?
• Has the organization conducted similar assessments in the past? If so, what were the results?
END OF ADDENDUM #1
File details come from the government source that posted it. Updated .