RFP - Cyber Security Audit Re-Bid - Addendum 3.pdf

RFP for CIT Cybersecurity Audit Re-Bid

Addendum #3 October 16, 2025

This Addendum is hereby issued to inform you of the following revisions and/or clarifications to the above-referenced RFP and/or the Contract Documents for the Project, to the extent they have been modified herein. Any conflict or inconsistency between this Addendum and the Solicitation Document or any previous addenda will be resolved in favor of this Addendum. Proposals shall conform to this Addendum. Unless specifically changed by this Addendum, all other requirements, terms and conditions of the Solicitation Document and or Contract Documents, and any previous addenda, remain unchanged and can be modified only in writing by CIT. The following changes are hereby made:

Questions Received:

• Do you leverage any managed service providers (e.g. outsourced IT, managed firewall) and do those environments fall within the assessment?

o CIT does not leverage any managed service providers.

• Are you expecting a configuration review of Azure AD/M365 (e.g. conditional access, MFA enforcement, DLP policies), or purely penetration testing?

o No, a configuration review of Azure AD/M365 is not requested, purely penetration testing.

• Has CIT undergone any prior cybersecurity audits or penetration tests in the past 2 years, and if so, should our review include a comparison to prior findings?

o No, CIT has not undergone prior cybersecurity audits or penetration tests in the past 2 years.

• Is post-assessment remediation support or validation testing expected as part of this engagement, or would that be scoped as a future phase?

o See RFP, Page 6, Part 3, Submission Requirements

• How many locations for the physical social engineering? 1 or 2?

o There are two geographic locations.

• Is there a specific NIST 800-series publication (e.g. 800-53 Rev 5, 800-171 Rev 2, or 800-115) that should serve as the primary reference for the control evaluation and reporting, or is general NIST 800 alignment is sufficient?

o See RFP Scope of Services and Addendum 1 & 2

• How many distinct network segments, VLANs, or physical sites will internal testing cover?

o CIT has multiple segments and physical sites, with under 10.

• Will internal testing be grey-box (Active Directory credentials provided) or unauthenticated/assumed breach?

o Please see RFP Page 6, Part 2 Scope of Services

• Which endpoint protection or monitoring technologies are deployed (e.g.EDR, SIEM, NAC)?

o Use of endpoint protection, SIEM.

• How many public IP addresses and/or domains are in scope?

o Please See RFP Scope of Services, Addendum 1 & 2

• Will limited credentialed (grey-box) access be provided for any external-facing systems?

o Please see RFP, Scope of Services

• Are any assets hosted by third parties or protected by a WAF/CDN that may affect testing?

o Yes, there are third parties that may affect testing.

• Should wireless testing include configuration review only or full attack simulation?

o CIT would like a full attack simulation included.

• Should the review include CI/CD pipelines, infrastructure-as-code, or Kubernetes components?

o No, the review should not include CI/CD pipelines, infrastructure-as-code, or Kubernetes components.

• Approximate number of unique pages or workflows per application.

o See Addendum 1

• Approximate number of API endpoints per service and whether authentication is required.

o Not Applicable

• Are there any rate-limited or sensitive modules to exclude?

o No, there are not rate-limited or sensitive modules to exclude.

• Does "mobile devices" refer to MDM policy review or to a mobile application pentest?

o In the CIT RFP ‘Mobile devices’ refer to MDM policy.

• If mobile apps exist, please confirm platform (Android/iOS) and availability of builds, source, or credentials.

o Not Applicable.

• For IoT devices (such as printers or cameras), should testing focus only on network exposure or include firmware review?

o Yes, testing should include network exposure.

• Will databases be accessed directly (credential) or only through applications?

o Databases will be accessed through applications.

• Are there multiple domains or forests with trust relationships to include?

o No, there are not multiple domains or forests with trust relationships to include.

• Which vectors are desired (email, phone, SMS)?

o All vectors desired.

• Should templates be customized per department?

o Yes, templates should be customized per department.

• Should results be anonymized or reported by department?

o Yes, results should be given in department.

• Which tactics are permitted (USB drops, Tailgating, badge cloning, etc.)?

o Please see Addendum 1 & 2.

• Any restrictions or safety requirements (escort, photo limitations, Tribal security notification).

o Yes, there will be restrictions.

• Expected evidence deliverables (photos, logs, proof artifacts).

o Yes, deliverables should include evidence.

• Which frameworks should be mapped in addition to NIST 800 (HIPAA, PCI-DSS, CJIS, etc.)?

o See RFP, Page 6, Scope of Service

• Will prior audits, assessments, or risk registers be shared?

o No, prior audits, assessments and risk registers will not be shared.

• Should recommendations include effort/priority scoring or maturity ratings (1-5 scale)?

o Yes, recommendations should include effort/priority scoring.

• Should separate briefings be scheduled for Tribal Leadership and IT, or one combined presentation?

o Please see RFP and Addendum 1 & 2.

• Should the final report include an attestation letter or framework-mapping appendix?

o The final report should include framework mapping appendix and attestation letter.

• Could the Tribe please confirm whether this is a new initiative or an existing engagement?

o This is a new initiative.

• Could the Tribe please provide the anticipated project timeline, including key milestones and the overall expected duration of the engagement?

o See RFP, Page 3, Project Schedule

• What is the actual duration of the project?

o See RFP, Page 3, Project Schedule

• Could the Tribe please clarify whether it intends to award this RFP to a single vendor or multiple vendors? If multiple awards are anticipated, could the Tribe specify the expected number of vendors to be selected?

o CIT is awarding one vendor for this RFP.

• Can you confirm whether the vendor is expected to provide all required testing tools and licenses, or if any existing tools can be leveraged (e.g. Nessus, Burp Suite, Qualys)?

o The vendor to provide testing tools.

• Are there any network restrictions (VPN, IP allowlists) that will impact remote testing?

o Yes, there are restrictions that will impact remote testing.

• Can you provide the expected number of cloud tenants, SaaS applications, and APIs/microservices in scope to better estimate testing effort?

o There are less than 10 cloud tenants, SaaS applications, and APIs/microservices in scope.

• For endpoints and servers, will staging/test environments be available for testing, or must testing occur directly on production systems?

o For endpoints and servers testing should occur directly on production systems.

• What are your primary goals for running this vishing exercise (e.g., awareness, testing incident response, compliance)?

o The primary goal for running this vishing exercise is compliance.

• Which groups of employees are in scope (all staff, specific departments, executives, help desk, etc.)?

o All staff are in scope.

• Are there any individuals or departments that should be excluded?

o No, there are no individuals or departments to be excluded.

• What type of deliverable do you expect (summary report, detailed transcripts, statistics, recommendations)?

o See RFP, Scope of Services.

• Are vendors expected to prioritize remediation recommendations based on risk or provide all findings equally?

o Vendors are expected to prioritize remediation recommendations based on risk.

• Should any policies be excluded (e.g., legacy policies, departmental-only policies)?

o No policies should be excluded.

• What is the approximate number of resources in your Azure Environment?

o There are no resources in Azure Environment.

• For the on-site social engineering test, do you also want a nighttime physical entry operation?

o No, CIT does not want a nighttime physical entry option.

• Is there an approximate count on the number of IOT devices in scope?

o There are approximately 100 IOT devices in scope.

• How many dynamic pages are in each web application?

o Not Applicable.

• Do any of the APIs require authenticated testing? If so, how many roles do they have?

o Not Applicable.

• How many SSIDs are being tested for the Wireless networks across how many locations?

o There are approximately 35 total SSIDs being tested for wireless networks across all locations.

• The RFP anticipates one to two onsite visits. Does CIT have preferred windows or blackout periods for onsite activity between December 2025 – March 2026?

o CIT would prefer to avoid the last two weeks of December 2025 and First week of January 2026.

• The RFP notes potential ongoing maintenance after project completion. Should the proposal include optional pricing for post-audit advisory or remediation validation?

o Yes, the proposal should include optional pricing for post-audit advisory or remediation validation.

• Does CIT’s Azure AD / M365 environment include any third-party integrations (example: HRIS, ERP, or finance systems) that should be included in the scope of testing?

o Yes, CIT’s Azure AD/M365 environment includes third-party integrations that should be included in the scope of testing.

• Addendum #1 notes 10 sites and 10 segments per site. Should each site’s network be treated as independent (with separate VPN ingress) or as a unified hybrid environment for testing purposes?

o Primarily unified hybrid environment for testing purposes, but some instances require independent environment testing.

• I would like to know if you would consider proposals with an alternate scope/approach than what you have listed in your RFP.

o No, CIT would not consider proposals with an alternate scope/approach than what we have listed in the RFP.

• For the cross-mapping requirement (NIST, HIPAA, PCI-DSS, CJIS), should proposers assume: A single consolidated report with crosswalks, or separate reports for each framework?

o CIT would prefer a single consolidated report with crosswalks.

• Regarding CJIS, is the expectation a full compliance review, or only a gap analysis against NIST 800-53 equivalencies?

o CIT is not expecting a full compliance review, only gap analysis.

• Approximately how many cybersecurity policies are currently in place and expected to be reviewed?

o There are 10 or less cybersecurity policies currently in place that are expected to be reviewed.

• Could CIT clarify the level of detail required for effort estimates in the remediation roadmap (e.g., high-level effort bands vs. resource-hour estimates by task)?

o CIT finds all metrics listed useful (e.g. high-level effort bands and Resource hour estimates by task).

• Are there any specific weighting values assigned to the evaluation criteria (approach, cost, tribal preference, experience, etc.)?

o There is no specific weighting values assigned to the evaluation criteria.

• Sites – How many physical sites are expected to be in-scope for onsite testing (beyond the Coos Bay and Eugene references)?

o There are under 10 physical sites in scope that are expected for onsite testing.

• For Azure AD and Microsoft 365, is the expectation limited to configuration and security posture reviews (e.g., CIS/NIST benchmarks), or should proposers also include penetration testing of tenant/cloud workloads?

o The proposer should include pen testing of tenant/cloud workloads.

• For APIs and microservices (REST), could CIT provide an approximate count and details on authentication models (OAuth, SAML, API keys) to size the assessment?

o Not Applicable.

• Should the cloud review include cloud-native security controls (Azure Security Center, Defender for Cloud, Sentinel) and their configurations?

o Not Applicable.

• Should the audit also address data protection practices (backup, retention, encryption) for cloud-hosted workloads?

o Not Applicable.

• The RFP references phishing campaigns, phone-based testing, and USB drops. Should proposers also include spear phishing / targeted campaigns, or only generalized campaigns?

o The proposer should also include targeted campaigns.

• Are there any restricted testing windows for critical systems (e.g., ERP or legacy systems), or should we assume testing can occur during normal and after-hours operations without blackout periods?

o Testing should occur during business hours and after hours.

• Approximately how many different departments or business units will be included in the social engineering testing?

o There are under 20 departments to be included in the social engineering testing.

• For phone-based social engineering, is CIT seeking a policy compliance check only (confirming staff follow procedures), or a more in-depth “capture the flag” style assessment with staged questioning to test persistence and escalation resistance?

o We would like best practices to be used for this security assessment.

• Should proposers include remediation roadmap pricing (implementation costs), or limit pricing to the audit, testing, and reporting deliverables?

o CIT would like remediation roadmap pricing included with the proposal.

• Will CIT require ongoing support/maintenance services after the final report, or should proposals be scoped strictly to the audit project timeline (Dec 2025 – Mar 2026)?

o See RFP, Page 4

• On page 8, in reference to section 4 “Cost Proposal and Fee Schedule,” will Attachment B satisfy this requirement, or does the Tribe expect additional information, beyond the attachment, to be provided?

o The attachment provided is what is required for proposal.

• Are there any critical systems or applications that require limited or restricted testing windows (e.g. ERP, legacy apps)?

o There are no critical systems or applications that require limited or restricted testing windows.

• For web applications, APIs, and cloud services (Azure AD, M365, SaaS), what authentication methods and environments are available for testing?

o Not Applicable.

• Could you kindly confirm the expected location of services delivery for this engagement?

o The two geographical locations for service is Coos Bay, Oregon and Eugene, Oregon.

• Does the Tribe have a preferred contract pricing model, or should vendors recommend a structure based on the proposed approach?

o The vendor should recommend a structure based on the proposal approach.

Additional Questions Received with Answers Not Provided:

Due to the sensitive nature of our cybersecurity infrastructure, responses to the questions below cannot be provided before contract award. Technical details, including configurations, protocols, and network architecture, will be shared with the selected vendor under confidentiality agreements. Additional questions have been received that have not been outlined in this addendum and will follow in a future addendum.

We are committed to a fair and transparent process and will ensure the awarded vendor has the information needed for a thorough audit. The questions below were asked and not answered directly.

• Will you provide test credentials and documentation for in-scope web applications, APIs, and networks?

Should testing include authenticated workflows (e.g. full web application and API testing) or just external, network-facing components?

• Could you please share whether there is a specific security concern, compliance deadline, or regulatory driver that you wish you emphasize (e.g. PCI-DSS)?

• Beyond policies, will you provide additional documentation, such as existing risk registers or prior assessments as part of the process?

• Are any systems or VLANs excluded from testing (e.g. medical, ERP, legacy)?

• Do any networks use enterprise authentication (802.1X / RADIUS), and will credentials be provided?

• Will administrative or read-only credentials be provided?

• Please list each web application in scope (name and environment).

• How many user roles exist (guest, admin, etc.)?

• Will test accounts be provided for each role?

• Will Active Directory testing include privilege escalation and GPO review?

• Preferred campaign timing (single event or staggered).

• Number of policy documents to be provided.

• Which departments will participate in interviews (IT, Wellness, Finance, HR)?

• Should the policy review also include procedural documents (e.g., incident response, change management), or only high-level security policies?

• How many policies are expected to be reviewed as part of the engagement?

• Are there any systems or networks, beyond the legacy/ERP systems, that are considered sensitive and require restricted testing windows?

• For authenticated (gray-box) testing, will test credentials or privileged accounts be provided for all in-scope systems?

• How will you define success for this engagement?

• Are there specific pretext scenarios you’d like us to use (e.g., IT support, vendor calls, HR-related)?

• Are there “red lines” we should not cross in the conversation (e.g., discussing payroll data, asking for credentials)? What is the best time window to conduct calls (business hours only, evenings/weekends)?

• Is there an existing incident response playbook we should measure against?

• Can you share approximate counts of users per department or total users in scope?

• How often should social engineering campaigns be conducted for phishing, phone, or in-person tests?

• Can you provide an approximate number of IT/security policies that are in scope for review?

• How many roles are available to users in each Web Application?

• Will CIT provide administrative or credentialed access (for grey-box testing) to selected systems and domains, or should the proposal assume external/black-box testing only?

• Since CIT does not use Microsoft Intune, which MDM platform manages mobile endpoints, and are mobile devices in-scope for phishing or endpoint testing?

• When reviewing security policies, should the scope include policies only, or also standards and procedures?

• Mobile Devices – Approximately how many managed/unmanaged mobile devices are in use and should be considered in scope?

• Third-Party Vendor Systems – Will proposers be granted permission to conduct testing on vendor-hosted applications or integrations, or should those be limited to review/documentation only?

• Could CIT clarify the extent of the hybrid environment to be reviewed (e.g., AD sync, conditional access, MFA, federation services)?

• For SaaS (e.g., HR, Finance, O365 apps), should testing be limited to tenant-level configuration reviews or include application-layer penetration testing?

• Could you please confirm the exact list of systems and assets in-scope (servers, endpoints, network devices, web apps, cloud, etc.) along with IP ranges or inventories?

• Can we get a current network diagram or architecture overview to understand segmented environments

(production, dev, DMZ, etc.)?

• How many onsite visits are expected, and when will the NDA and data-sharing process (for configurations, network details, MDM info) be completed?

• Is there an incumbent vendor currently supporting the Tribe on this initiative or related services?

• Must vendors be licensed in Oregon at proposal submission, or only before contact execution? Also, does this apply only to the vendor entity or to individual project team members too?

END OF ADDENDUM #3