RFP - Cyber Security Audit Re-Bid - Addendum 1 9292025.pdf

RFP for CIT Cybersecurity Audit Re-Bid

Addendum #1 September 29, 2025

This Addendum is hereby issued to inform you of the following revisions and/or clarifications to the above-referenced RFP and/or the Contract Documents for the Project, to the extent they have been modified herein. Any conflict or inconsistency between this Addendum and the Solicitation Document or any previous addenda will be resolved in favor of this Addendum. Proposals shall conform to this Addendum. Unless specifically changed by this Addendum, all other requirements, terms and conditions of the Solicitation Document and or Contract Documents, and any previous addenda, remain unchanged and can be modified only in writing by CIT. The following changes are hereby made:

Questions Received:

• The RFP states as prerequisites, "be a legal entity that has the authority to transact business in the State of

Oregon. “Is this proof of authority to transact business in Oregon required at the response time or simply before work can commence?

o Yes, proposers need to be licensed with the state of Oregon prior to award.

• "Provide proof of valid State of Oregon licensure for all team members required to be licensed by state law"

We are from NJ and have not seen this type of requirement for individual team members required to be licensed from any other state. What does this mean and what does this entail? Are you looking for vendors located within Oregon? And is this proof of valid State of Oregon license for team members also required at response time of before work can commence?

o This statement in the RFP is as applicable for any work proposed that would require a license.

• Regarding External Penetration Test: What is the total number of external IPs?

o ~50 external IPs

• Regarding Internal Network Penetration/Vulnerability Testing: Do you require credential scanning?

o See RFP, Page 2, Part 2 Scope of Services, C1

• Regarding Internal Network Penetration/Vulnerability Testing: How are the assets separated- broadcast domains? By VPNs? By VLANS?

o Both by VPNs and VLANS

• Regarding Internal Network Penetration/Vulnerability Testing: What are the subnet sizes?

o The subnet size, \24.

• Regarding Internal Network Penetration/Vulnerability Testing: Do you utilize Microsoft Intune?

o No, we do not intend to utilize Microsoft Intune.

• Regarding Internal Network Penetration/Vulnerability Testing: Do you utilize site-to-site VPNs?

o Yes, we utilize site-to-site VPNs.

• Regarding Application Security Penetration Testing: Will application testing take place in a Production or Quality Assurance (QA) environment?

o Yes, application testing will take place in a Production Environment.

• Regarding Application Security Penetration Testing: Will login credentials be provided for testing each of the roles supported by the application?

o No, login credentials will not be provided for testing each role.

• Regarding Wireless Penetration Testing: How many sites are in-scope?

o There are approximately 10 sites in scope.

Emerald Brunett It wouldn’t let me add a comment to the title, but the top line of the title should be the official title of the RFP. You will also want to update the date to reflect the day we are posting it.

• How many IS Policies and Procedures are presently defined and implemented, and are there any that need to be developed from scratch?

o IS Policy Development is out of scope.

• Are you interested in a NIST CSF 2.0 Framework Assessment?

o The Tribe is interested in following the NIST 800 Framework.

• Regarding Social Engineering testing: Do you require physical security penetration testing?

o Please see RFP Page 6, Part 2 Scope of Services, C6.

• Might any of the following assessments also be in-scope? Network Architecture Evaluation o No, Network Architecture Evaluation are not in scope.

• Might the following assessments also be in-scope? Email Security Assessment o Yes, Email Security Assessment are in scope.

• Can you confirm that the “implementation of solutions,” means the implementation of tooling required to conduct penetration test?

o Any implementation of solutions is considered a future phase of the project. It does not mean implementation of tooling required or any other pieces of completing the audit.

• Which NIST 800 Publication must the testing and gap assessment align with?

o The gap assessment should align with NIST 800-53. Additional details to be discussed post award.

• Can you confirm the total number of active users across all locations, including Ko-Kwel Wellness Center?

o Please See RFP Page 3, Background.

• Are there any shared user accounts or service accounts in use that should be considered during the audit?

o Yes there are shared user accounts. Additional details provided post award.

• Could you provide a detailed inventory and count of all in-scope assets (servers, endpoints, network devices, mobile devices, loT, web apps, APIs, databases)?

o Inventory List Provided Post Award

• Are there any legacy systems or ERP platforms that require special handling or limited testing windows?

o Yes, there are legacy systems. No special handling required.

• Is CIT expecting any form of incident response or handling support as part of this engagement?

o Any implementation of solutions or additional support is considered a future phase of the project.

• Is there any expectation for real-time or 24x7 monitoring support during or after the audit period?

o No. Any implementation of solutions or additional support is considered a future phase of the project.

• Will the Tribe require after-hours availability for testing or reporting?

o Please see RFP, Page 6, Part 2 Scope of Services, B2.

• Will CIT procure any new tools as part of this engagement, or is the vendor expected to bring their own?

o The vendor is expected to bring their own tools for cybersecurity audit.

• Per Part 2, Section B, item 3, "Confirm segmentation of systems and assess vulnerabilities across segmented networks". How many networks will be a part of the segmentation testing? Can all networks be reached from a single physical location (i.e. All networks are trunked through an IT office)?

o There are approximately 10 segments per site, with 10 sites. Additional testing details discussed post award. They cannot all be reached from a single location.

• How many live hosts does the Tribe expect are exposed externally/to the internet? This could help properly "right size" the effort allocated to the external penetration test.

o There are approximately 50 public IPs.

Additional Questions Received with Answers Not Provided:

Due to the sensitive nature of our cybersecurity infrastructure, responses to the questions below cannot be provided before contract award. Technical details, including configurations, protocols, and network architecture, will be shared with the selected vendor under confidentiality agreements. Additional questions have been received that have not been outlined in this addendum and will follow in a future addendum.

We are committed to a fair and transparent process and will ensure the awarded vendor has the information needed for a thorough audit. The questions below were asked and not answered directly.

• Regarding Application Security Penetration Testing: Approximately how many pages comprise each application?

• Are there preferred tools or platforms for penetration testing, vulnerability scanning, or policy compliance assessments?

• Will CIT provide access to existing tools (if in place) for audit exercise?

• Will the audit include review of past incidents or breach history?

• Is CIT seeking only tool licensing or full-service implementation and support for any cybersecurity technologies?

• Will CIT require post-audit support such as remediation assistance or ongoing advisory services?

• If ongoing support is expected, what level of support (e.g., monthly check-ins, helpdesk, onsite visits) is envisioned?

• Has the Tribe had penetration testing similar in scope performed previously? If so, what is/was the expected timeframe specifically performing penetration testing (i.e. One week, two weeks, etc.)

END OF ADDENDUM #1

Emerald Brunett Once you finish the edits, make sure that no questions are broken between pages and that the “END” is on a page with information.