RFP - Cyber Security Audit Re-Bid - Addendum 2.pdf

RFP for CIT Cybersecurity Audit Re-Bid

Addendum #2 October 10, 2025

This Addendum is hereby issued to inform you of the following revisions and/or clarifications to the above-referenced RFP and/or the Contract Documents for the Project, to the extent they have been modified herein. Any conflict or inconsistency between this Addendum and the Solicitation Document or any previous addenda will be resolved in favor of this Addendum. Proposals shall conform to this Addendum. Unless specifically changed by this Addendum, all other requirements, terms and conditions of the Solicitation Document and or Contract Documents, and any previous addenda, remain unchanged and can be modified only in writing by CIT. The following changes are hereby made:

Questions Received:

• Can you advise if CIT is open to doing business with Canadian firms, provided they meet all the terms and conditions listed in the RFP?

o CIT is open to doing business with Canadian firms provided they meet all the terms listed in the RFP.

• Is this an audit or assessment exercise?

o This Cybersecurity Project is an Audit not just an assessment.

• Is the engagement purely assessment & reporting or does it also include remediation validation/retesting?

o See RFP, Page 4, Contract Requirements

• Are you fine with both remote testing?

o See RFP, Page 6, Part 2 Scope of Services, C7

• Are we expected to perform credential or non-credential testing for internal assets?

o See RFP, Page 6, Part 2 Scope of Services, C7

• For external testing, can you define all the public-facing IPs, domains, and cloud entry points?

o See RFP, Page 6, Part 2 Scope of Services, C1

• How many wireless networks (SSID) are in scope (guest, corporate, IoT, BYOD)?

o See Addendum 1

• Should configuration reviews be included along with vulnerability assessment?

o No, configuration reviews are not needed.

• What type of mobile devices (iOS, Android, MDM managed/unmanaged) are in scope?

o See RFP, Page 6, Part 2 Scope of Services, B4, iv

• Are IoT devices business-critical? (CCTV, access control, SCADA/OT) o No, IoT devices are not business critical.

• Are firmware and physical security tests required?

o No, a firmware and physical security test is not required.

• What is the desired/anticipated timeline for the completion of the engagement?

o See RFP, Page 3, Project Schedule

• Will all 250 employees be subject to social engineering assessment?

o Yes, all 250 employees will be subject to social engineering assessment.

• Are all these assets at a single physical location or across multiple sites? This affects logistics and travel.

o No, we have multiple locations.

• Are you seeking an assessment against a specific framework (e.g. NIST CSF, CIS Controls, ISO 27001)?

o See Addendum 1.

• Is prior experience with tribal governments organizations a mandatory requirement?

o No, prior experience with tribal governments organizations is not mandatory.

• This engagement is limited to the current North Bend, Oregon location (Coos Bay & Eugene), for required onsite visits?

o See RFP Page 3, Background.

• Will a HIPAA assessment be in-scope for the Ko-Kwel Wellness Center?

o No, a HIPAA assessment is not in scope.

• How many wireless networks are there?

o See Addendum 1

• Where are the wireless networks located?

o The wireless networks are at all locations.

• Is there guest (non-employee) network access?

o Yes, there is guest/non-employee access.

• Is the Point of Sales (POS) system infrastructure externally managed?

o No, the Point of Sales system infrastructure is not externally managed.

• Are there ATMs on the internal network?

o No, there are no ATMs on the internal network.

• Does CIT have a virtual machine environment, or will we need to bring infrastructure?

o CIT has a VDI environment.

• Is on Network access limited to client owned devices or are there BYOD devices allowed on network?

There are BYOD allowed on guest networks.

• Are there dedicated cybersecurity staff?

o No, there are no dedicated cybersecurity staff.

• Can we use in-person penetration techniques, including representing ourselves as contractors (e.g. pest control, HVAC maintenance, etc.)

o Yes, you can use in-person penetration techniques, including representing ourselves as contractors.

• Are out of state companies eligible to apply?

o Yes. See RFP, Page 7, Content Specification, A

• Is there local preference given or evaluation weight placed on being a local vendor?

o No, preference will be given based on experience and proposal of proposer.

• Is the wireless network control based?

o Yes, the wireless network is control based.

• How many wireless network locations are in scope for testing?

o See Addendum 1

• How many databases are in scope for testing? Three to five?

o Databases are not in scope for testing.

• Is the Active Directory instance hybrid (on-premises and Entra ID/Azure AD0?

o Yes, Active Directory and Entra are hybrid.

• For the cloud platforms, what is meant by “hybrid environment’?

o We have on-premises systems connected to cloud services.

• Is the cloud platform review limited to O365 and Entra ID/Azure AD, or is review of the Azure tenant in scope?

Are there any cloud platforms in place besides Azure?

o Yes, the cloud platform is limited to O365 and Entra ID/Azure AD. No, there are no other cloud platforms in place.

• Is the Tribe interested in any in-person social engineering activities besides baiting (USB drops)? Tailgating, for instance? If so, how many locations?

o The Tribe is interested in personal social engineering and baiting with three locations to test.

• Should the policy review be aligned with NIST SP 800-53 only, or are other NIST standards, such as NIST SP

800-171, in scope?

o The policy should align with NIST SP 800-53. NIST SP 800-171 is not in scope.

• Is the policy governance review limited to policies, or should we also review the design and test the effectiveness of IT controls and processes?

o CIT would like a review of design and testing for effectiveness as well.

• Does the project budget remain at $100,000?

o See RFP, Page 3, Project Budget

• Should the proposal include proof of our licensure to do business in Oregon?

o See RFP, Page 7-8, Content Specifications A and 2B

• We understand that the cover letter will include a brief description of our understanding of the scope and our approach. Does CIT have a page limit in mind for the cover letter? And would it be useful to CIT if we added a more detailed description of our approach, including technical methodologies, as an appendix?

o CIT does not have a page limit for Cover Letters, and would be interested in additional details of approach, including technical methodologies.

• Are workstations and/or networking devices similarly configured such that we can scan/test a cross-section of them? This is typical for a penetration testing.

o See RFP, Page 7-8, Content Specifications A and 2F.

• Are the wireless networks set up similarly such that we could test a cross-section of them? This is typical for penetration testing.

o See RFP Page 7-8, Content Specifications A and 2F

Additional Questions Received with Answers Not Provided:

Due to the sensitive nature of our cybersecurity infrastructure, responses to the questions below cannot be provided before contract award. Technical details, including configurations, protocols, and network architecture, will be shared with the selected vendor under confidentiality agreements. Additional questions have been received that have not been outlined in this addendum and will follow in a future addendum.

We are committed to a fair and transparent process and will ensure the awarded vendor has the information needed for a thorough audit. The questions below were asked and not answered directly.

• The RFP saying The Coquille Indian Tribe is seeking to RETAIN an experienced cybersecurity firm to assess the current Cybersecurity posture, please clarify?

• Do we have contractual permission to test 3rd party systems, or will this be interface testing only (API connections, VPN tunnels, data flows)?

• How many APIs (at least a range), databases, mobile IoT devices, 3rd party systems, SaaS?

• Excluding O365, how many SaaS applications are in scope?

• How many third-party systems are in scope? Are these different from the SaaS applications? If so, are we testing the systems themselves or the Tribe’s connection to them?

• How many formal security policies are in place?

END OF ADDENDUM #2