RFP Cybersecurity Audit_Final_072425.pdf

REQUEST FOR

PROPOSALS (RFP) FOR

CIT CYBERSECURITY

AUDIT

Issue Date:

July 24, 2025

Proposal Due:

August 26, 2025, 2:00

PM PST

CIT Cybersecurity Audit

Page | 1

Table of Contents Part 1 Introduc$on

No$ce

Changes to RFP

Purpose

Project Schedule

Contract

Contract Requirements

Part 2 Scope of Services

Statement of Work

Part 3 Submission Requirements

General

Content Specifica$ons

Proposal Prepara$on and Submission Instruc$ons

Part 4 Proposal Evalua$on and Award

Evalua$on Process

Evalua$on Criteria

Award of Contract

Part 5 Clarifica$ons

Requests of Informa$on

Proposer Offer, Withdrawal, and Modifica$on

Part 6 Reserva$ons of Rights

Exhibit 3 – Example Contract

ATTACHMENT A - PROPOSERS CERTIFICATION

Page | 2

Part 1 Introduc"on

No"ce

THE COQUILLE INDIAN TRIBE

REQUEST FOR PROPOSALS

CIT CYBERSECURITY AUDIT

Through this Request for Proposals ("RFP”), the Coquille Indian Tribe (“CIT”, “the Tribe”), is seeking competitive proposals from qualified and experienced individuals or firms (hereafter, "Proposers", “Contractor”) to conduct a comprehensive cybersecurity audit. (“Project”). The purpose of this solicitation is to secure proposals to assess our current security posture, iden$fy vulnerabili$es, and provide ac$onable recommenda$ons to enhance our cybersecurity framework. CIT will accept proposals until 2:00 p.m. PST on August 26, 2025.

Electronic copies of the RFP and all required forms and attachments may be obtained by emailing projects@coquilletribe.org.

One (1) digital copy shall be submitted via email to the contact listed below with the subject line to read:

Coquille Indian Tribe - Cyber Security Audit

Russell Crochetiere

IT Director

Office of Strategic Operations

Coquille Indian Tribe projects@coquilletribe.org

Please note that no formal opening of the proposals will take place.

Proposals will be evaluated, and the successful contractor will be determined and approved by the Tribe. The Tribe reserves the right to reject any or all proposals and to select the contractor and services that best meet the needs of

The Tribe.

Inquiries should be directed by e-mail to Russell Crochetiere, IT Director, at projects@coquilletribe.org no later than

August 19, 2025, at 2:00 p.m PST.

Procurement Schedule: (dates are estimates and subject to change)

RFP Issued July 24, 2025

Last Day for RFIs August 19, 2025

RFP Proposals Due August 26, 2025, at 2:00 p.m. PST

Notification of Intent to Award August 29, 2025

Project Start October 1, 2025

Page | 3

Changes to RFP

Any change or clarifica$on of the Scope of Work, procurement process, contract terms and condi$ons, insurance requirements, or any other maFer contained in this RFP will be issued in the form of a wriFen Addendum to this RFP. CIT will make a good-faith effort to no$fy interested par$es of any addenda issued for this RFP. However, it is the responsibility of all par$es interested in this or any other CIT contract opportunity to check for any addenda that have been issued for this or other contract opportuni$es, up to the solicita$on closing $me.

Purpose

The Coquille Indian Tribe is seeking to retain an experienced cybersecurity firm to assess the current cybersecurity posture of the Tribal Governments IT Environment. This would involve iden$fying vulnerabili$es and risks within the environment, providing ac$onable recommenda$ons to enhance security, and ensuring compliance with relevant federal, state, and tribal regula$ons. The Coquille Indian Tribe has approximately 250+ employees, including a Medical, Dental, and Behavioral

Health division called Ko-Kwel Wellness Center. The Tribal Government and Wellness Center has a presence in Coos Bay and Eugene, Oregon.

Project Schedule

The following is the an$cipated project $meline. A preliminary schedule is outlined below. Dates are subject to change.

RFP Issued July 24, 2025

Last Day for RFIs August 19, 2025

RFP Proposals Due August 26, 2025, at 2:00 p.m. PST

Notification of Intent to Award August 29, 2025

Project Start October 1, 2025

80% draft with recommendations October 31, 2025

Review with Tribal Council November 5, 2025

Final Draft December 1, 2025

Contract

The contract will become effec$ve upon execu$on by both par$es.

Authoriza$on to proceed with a subsequent phase will occur only aLer CIT and the Contractor have successfully nego$ated the scope and cost of the contemplated Correc$ve Ac$ons. The Coquille Indian Tribe, at its sole discre$on, may also wish to execute a services contract with the successful contractor at the conclusion of the project, which may include ongoing maintenance.

Proposers should state their willingness to execute a nego$ated agreement as outlined in this RFP. Proposers should expressly state their reserva$ons, if any, regarding the form of agreement and iden$fy changes, if any, in their proposal.

Proposers should be aware that CIT will value specificity and clarity regarding both the reserva$ons expressed and the requested modifica$ons, as well as their ra$onales.

Contract Requirements

The Proposer will be required to furnish proof of the following types of insurance:

A. Insurance Coverages. The Proposer shall procure and maintain at its expense during the Period of Performance and thereaLer as required below the following insurance from one or more companies authorized to do business in the State of Oregon with a policyholder’s ra$ng of not less than A-IX in the most recent edi$on of Best’s Ra$ng

Page | 4

Guide. Except as approved otherwise by the Owner in advance, such insurance shall protect against claims which arise out of or relate to all of the Proposer’s services under the Agreement, whether performed by the Proposer or a consultant or a person or en$ty for which either of them may be responsible.

1. Workers’ Compensa0on Insurance, if required by law, with statutory limits.

2. Employer’s Liability Insurance, if employees are employed for other than secretarial or bookkeeping services, with a limit of not less than $1,000,000 each accident, $1,000,000 disease each employee and

$1,000,000 disease policy limit.

3. Commercial General Liability Insurance, applicable to all premises and opera$ons, including Bodily Injury, Property Damage, Personal Injury, Contractual Liability, Independent Contractors, Products and

Completed Opera$ons, Broad Form Property Damage (including Completed Opera$ons), and coverage for explosion, collapse and underground hazards, with minimum limits of not less than $1,000,000 per occurrence, $2,000,000 aggregate applicable specifically to the Project, $1,000,000 personal and adver$sing injury and $1,000,000 Products and Completed Opera$ons aggregate. Proposer shall no$fy the Owner, prior to signing the contract, of any “Residen$al Construc$on” exclusions and/or limita$ons of coverage that may be part of the Commercial General Liability Insurance.

4. Business Automobile Liability Insurance, applicable to owned, non-owned and hired automobiles, with a limit of not less than $1,000,000 combined single limit each accident.

5. Professional Liability Insurance, applicable to all acts and omissions of Proposer and its consultants at all

$ers, with limits of not less than $1,000,000 each claim and $2,000,000 aggregate.

B. Deduc0bles. The Proposer shall pay all deduc$bles on all policies required by Paragraph 1.

C. Waivers of Subroga0on. The Workers’ Compensa$on and Employer’s Liability policies shall be subject to a waiver of subroga$on in favor of Owner and its members, directors, agents and employees, and the successors in interest of the foregoing.

D. Cross-Liability Coverages. The Commercial General Liability and Automobile Liability policies shall provide cross-liability coverages as would be achieved under the standard Interna$onal Organiza$on for Standardiza$on

(“ISO”) separa$ons of insureds clause.

E. Addi0onal Insureds. The Commercial General Liability and Automobile Liability policies shall name the Owner and its members, directors, agents and employees, and the successors in interest of the foregoing, as addi$onal insureds, using ISO addi$onal insureds endorsement CG 20 10 11 85 or a subs$tute providing equivalent coverages. Such coverages provided to the addi$onal insureds shall (a) be primary and noncontributory with respect to any insurance or self-insurance reten$on of the addi$onal insureds, including but not limited to any

Excess Liability coverage maintained by the addi$onal insureds, (b) provide the same types and extents of coverages as the coverages provided to the primary insured, and shall not be limited to the “vicarious liability” of the addi$onal insureds, (c) waive all rights of subroga$on against the addi$onal insureds, and (d) be maintained for the same dura$ons as the coverages provided to the primary insured, including but not limited to the con$nua$on of the Products and Completed Opera$ons coverage un$l ten (10) years aLer final payment to the

Owner’s prime contractor on the Project, and shall not be limited to “ongoing opera$ons”.

F. Dura0on of Coverages. The insurance coverages required by Paragraphs 1 through 5 shall be wriFen on an occurrence basis, except the Professional Liability Insurance. All other policies shall be in effect as of the date of commencement of the Proposer’s services under the Agreement. All policies shall be maintained and remain in effect un$l one (1) year aLer final payment to the Owner’s prime contractor on the Project and thereaLer when the Proposer is assis$ng or advising the Owner regarding the correc$on of defec$ve or nonconforming Work;

provided that the Products and Completed Opera$ons policy and the Professional Liability policy shall remain in effect un$l three (3) years aLer final payment to the Owner’s prime contractor on the Project. The Proposer shall no$fy the Owner, in wri$ng, of any claims against the Professional Liability policy and Commercial General Liability

Page | 5 policy, in which event the Owner shall have the right to require the Proposer at its expense to obtain addi$onal

Professional Liability Insurance in order to restore the required coverage available for the Project.

G. Proof of Insurance. The Proposer shall file with Owner, upon execu$on of the Agreement, cer$ficates of insurance acceptable to the Owner as well as copies of all insurance policies, with all riders and endorsements, all separate exclusions, condi$ons and waivers, and all other amendatory documents aFached, evidencing the insurance required by this Exhibit. These cer$ficates and policies shall contain a provision that coverages afforded under the policies will not be cancelled or allowed to expire un$l at least thirty (30) days’ wriFen no$ce has been given to the Owner. If any of the required coverages are to renew during the period when such coverage is to remain in effect or are required to remain in force aLer final payment to the Owner’s prime contractor on the Project, an addi$onal cer$ficate evidencing con$nua$on of such coverage shall be submiFed upon renewal or with the

Proposer's final invoice.

H. Effect of No or Insufficient Insurance. The Proposer’s failure to comply with the requirements of this Exhibit shall cons$tute a material breach of the Agreement en$tling the Owner to terminate the Agreement for cause. In the alterna$ve, the Owner in its sole discre$on may purchase the insurance required of, but not obtained or maintained, by the Proposer pursuant to this Exhibit and charge such costs thereof to the Proposer. The Owner’s rights under this Paragraph shall be in addi$on to, and without waiver of, its other rights and remedies under the

Agreement or applicable law.

I. Limita0on of This Exhibit. Nothing in this Exhibit shall negate, abridge, or reduce the Proposer’s responsibili$es or liabili$es under the Agreement or applicable law, the meaning and effect of the provisions of this Exhibit being limited to seSng out the Proposer’s express obliga$ons with respect to insurance.

J. Professional Liability (aka "Errors and Omissions") insurance with a combined single limit of not less than

$1,000,000, on a claims-made basis, for indemnity of the insured for liability claims arising from or due to the negligence in the performance of professional services under an awarded contract.

As evidence of adequate insurance coverage and prior to contract execu$on, the selected Contractor(s) will provide to the

CIT cer$ficates of insurance lis$ng the “Coquille Indian Tribe” as a cer$ficate holder.

The cer$ficate(s) shall provide that the Selected Contractor's insurance shall not be terminated or cancelled without thirty

(30) days prior wriFen no$ce to CIT. Insuring companies or en$$es are subject to CIT's acceptance and must be licensed to provide insurance in the State of Oregon. Contractor's insurance shall be primary insurance, and any commercial insurance or self-insurance maintained by the Coquille Indian Tribe and/or CIT shall not contribute to it.

Part 2 Scope of Services

Statement of Work

Cybersecurity Audit Scope:

A. Conduct a Pre-Audit Planning mee$ng with Key stakeholders, reviewing exis$ng IT policies, procedures, and documenta$on

B. Technical Assessment

a. Perform vulnerability scanning and penetra$on tes$ng

b. Assess network architecture, firewalls, and endpoint security

c. Evaluate cloud services, remote access, and mobile device security

C. Policy and Compliance Review

a. Review of cybersecurity policies and procedures

b. Assess compliance with NIST, HIPAA, PCI-DSS, CJIS, and other relevant standards

c. Evaluate incident response and disaster recovery plans

D. Social Engineering Assessment

Page | 6

a. Conduct phishing simula$ons and/or social engineering tests.

b. Evaluate employee awareness and training effec$veness

E. Repor$ng and Recommenda$ons

a. Provide a detailed report of findings, including risk ra$ngs

b. Deliver priori$zed recommenda$ons for remedia$on

c. Present findings to Tribal Leadership and IT Staff

Part 3 Submission Requirements

General

Proposals submiFed in response to this RFP shall be of sufficient length and detail to demonstrate that the Proposer has a thorough understanding of the needs of the Project described in this RFP. Proposals should address the submiFal requirements of this RFP in a clear, succinct, and direct manner. Proposals submiFed in response to this RFP will be evaluated in accordance with the following SubmiFal Requirements and Evalua$on Criteria. Please organize the proposal corresponding to the order of the sec$ons below.

Responses should be of sufficient length and detail to demonstrate the Proposer's understanding of the requirements described in Part 2 of this RFP, "Scope of Services."

Content Specifica"ons

A selec$on commiFee will assess each proposal as to completeness, qualifica$ons, experience, project understanding, and approach. CIT may waive informali$es and accept any given proposal as submiFed and/or request further informa$on.

CIT’s decision will be final and is not subject to appeal.

Prerequisites: In order to be considered, Proposer must:

A. Be a legal en$ty that has the authority to transact business in the State of Oregon.

B. Provide adequate proof of insurance, as set forth in Part 1 of this RFP, “Contract Requirements.”

C. Execute, provide, and comply with the Proposer’s Cer$fica$on (AFachment A).

D. Provide a proposal sheet, including a rate sheet as outlined in “Cost Proposal and Fee Schedule.”

To be considered for selec$on, submit the below informa$on, clearly labeled, and in the following order. The consultant shall submit one (1) digital copy of the submission in pdf format.

1. Cover Le;er

The cover leFer should include a brief history of your firm, a short biography of the lead or primary person and descrip$on of the services your firm proposes to provide CIT. Summarize in a concise manner the proposer’s understanding of the scope of work and proposed approach, ac$vi$es, and deliverables to meet the scope of work.

Addi$onally, include the mailing address, phone/fax numbers and email address of the individual signing the cover leFer, as well as contact informa$on for your firm's primary contact(s) for this RFP, if different.

2. Cybersecurity Team

A. Narra$ve and/or graphic that iden$fies the key personnel at the corporate and field levels that will be assigned to this project. Describe their relevant experience, responsibili$es, and approximate amount of

$me each will devote to this project during each phase.

B. Provide proof of valid State of Oregon licensure for all team members required to be licensed by state law.

C. State whether any member of the team is currently, or has been during the last five years, involved in defending, nego$a$ng, media$ng, or li$ga$ng any claims, liens, or allega$ons of theL rela$ng to or arising from cybersecurity services, data breaches, security incidents, or failure to meet contractual obliga$ons in

Page | 7 informa$on security or privacy-related engagements. Provide a brief descrip$on of the circumstances that led to the claim(s) and the final resolu$on(s).

3. Experience of Cybersecurity Team

Describe capabili$es for the following:

A. Company background and qualifica$ons

B. Experience with tribal governments or similar organiza$ons

C. References from past clients

4. Cost Proposal and Fee Schedule

Provide Not-to-Exceed Cost for items outlined in Part 2 “Scope of Services”.

A. Provide Standard Fee Schedule for field technical service including travel and incidental expenses.

B. Describe payment terms, including travel and incidental expenses.

5. Tribal Preference/Tribal Employment

Any proposals submiFed by an Indian Owned Business (IOB) will be priori$zed. Contractor shall work with CIT to set forth preferences in employment and contrac$ng u$lizing CIT owned business and qualified Tribal Members to provide labor and supplies for the construc$on of the project.

Proposal Prepara"on and Submission Instruc"ons

All proposals must comply with the following instruc$ons. Failure to comply with these instruc$ons will result in the disqualifica$on of the proposal.

Proposal Due Date/Proposals must be received by CIT no later than August 26, 2025, at 2:00 p.m.

Proposals and ques$ons should be submiFed electronically and addressed to:

Russell Crochetiere

IT Director

Office of Strategic Operations

Coquille Indian Tribe projects@coquilletribe.org

Respondents are responsible to ensure receipt of electronic submission by the specified due date.

There will be no public opening of the proposals.

Part 4 Proposal Evalua"on and Award

Evalua"on Process

A Selec$on CommiFee will be formed to evaluate responsive proposals and shall apply the evalua$on criteria set forth below. The CommiFee will determine which proposals are in the compe$$ve range. CIT may, in its sole discre$on, find that proposals not adhering to all terms and condi$ons of this RFP, or that are otherwise non-responsive, do not meet the minimum requirements and may be rejected or given a low ra$ng in the evalua$on process.

The following process will be generally followed for the evalua$on and award of a contract:

A. Determine if proposals meet minimum requirements.

B. Evaluate proposals.

Page | 8

C. Determine which proposals are in the compe$$ve range.

D. Selec$on of candidate.

Evalua"on Criteria

The Tribe will evaluate respondents based upon the written response to this RFP and any other information requested by

The Tribe.

Criteria Description

Approach

Consultant’s understanding of and approach in providing RFP services. Responsiveness and completeness of the proposal and any value-added component. The degree to which the proposal offers a clear, comprehensive, and collaborative process.

Cost Overall cost, cost effectiveness, and resource allocation.

Experience Working with Tribes

Demonstrated qualifications and experience working with other tribal communities

Project Management Consultants' experience with similar projects and references from their clients. Ability to perform and complete the work in a professional and timely manner.

Tribally Owned Business Preference is given to firm/consultant owned or operated by Coquille Tribal members or other tribal or indigenous owned businesses.

Women, Veteran, and

Minority-Owned Business

Preference is given to firm/consultant owned or operated by minority, veteran, or women-owned or designated DBE.

CIT reserves the right to inves$gate the qualifica$ons of all Proposers under considera$on and to confirm any part of the informa$on furnished by a Proposer, or to require addi$onal evidence of managerial, financial, technical, or other capabili$es that are considered necessary for the successful performance of the work.

Award of Contract

A. CIT reserves the right to select for contract award the Proposer that offers the best overall value, benefit, convenience, and service to CIT, taking into account the cost. However, cost is only one of several evalua$on and selec$on criteria, and on its own, is not determina$ve of the best overall value, benefit, and service to CIT.

B. ALer comple$on of the evalua$on process, CIT will name an "apparent successful Proposer" and issue a "No$ce of Intent to Award" a contract to this Proposer.

Part 5 Clarifica"ons

Requests of Informa"on

All requests for clarifica$on or change regarding any technical, procedural, contractual or insurance requirement(s), or any other maFer regarding this RFP must be submiFed in wri$ng via e-mail to projects@coquilletribe.org. All requests for clarifica$on or change must be submiFed by August 19, 2025. CIT will consider all $mely-received ques$ons and requests for change and, if reasonable and appropriate, will issue an addendum via e-mail to all recipients to clarify or modify this

RFP.

Proposer Offer, Withdrawal, and Modifica"on

Any proposal submiFed in response to this RFP will be regarded by CIT as a binding offer by the Proposer to complete the work described above for a period of ninety (90) calendar days from the date proposals are due. This period may be

Page | 9 modified upon the mutual agreement between CIT and Proposer. Proposals may be withdrawn or modified prior to the date and $me proposals are due by wriFen request. Proposals may not be withdrawn or modified aLer the date and $me proposals are due unless agreed to by CIT in wri$ng.

Part 6 Reserva"ons of Rights The Coquille Indian Tribe reserves all rights (which may be exercised by The Tribe in its sole discre$on) available to it under applicable laws, including without limita$on, and with or without cause and with or without no$ce, the right to:

A. Cancel this RFP in whole or in part, at any $me before the execu$on of a contract by The Coquille Indian Tribe, without incurring any cost, obliga$ons, or liabili$es.

B. Issue addenda, supplements, and modifica$ons to this RFP.

C. Revise and modify, at any $me before the RFP submiFal due date, the factors and/or weights of factors The Tribe will consider in evalua$ng RFP submiFals and revising or otherwise expanding its evalua$on methodology as set forth herein.

D. Extend the RFP submiFal due date.

E. Inves$gate the qualifica$ons of any firm under considera$on and require submiFal confirma$on of informa$on furnished by a firm.

F. Require addi$onal informa$on from a firm concerning the contents of its RFP un$l such $me as The Tribe declares, in wri$ng, that a par$cular stage or phase of its review of the responses has been completed or closed.

G. Reject at any $me, any or all submiFals, responses, and RFP submiFals received.

H. Terminate, at any $me, evalua$ons of responses received.

I. Appoint an evalua$on commiFee to review RFP submiFals or responses, make recommenda$ons, and seek the assistance of outside technical experts and consultants in RFP submiFal evalua$on.

J. Hold interviews and conduct discussions and correspondence with one or more of the firms responding to this

RFP to seek an improved understanding and evalua$on of the responses to this RFP.

K. Seek or obtain data from any source that has the poten$al to improve the understanding and evalua$on of the responses to this RFP.

L. Waive deficiencies in an RFP submiFal, accept and review a non-conforming RFP submiFal or seek clarifica$ons or supplements to an RFP submiFal.

M. The Tribe reserves the right to terminate this process or to cancel or modify this solicita$on process at any $me.

In no event will The Tribe or any of its respec$ve agents, representa$ves, consultants, directors, officers, or employees, be liable for, or otherwise obligated to reimburse the costs incurred in prepara$on for this RFP or any other related costs. The prospec$ve firms shall be fully responsible for all costs incurred in the prepara$on and/or presenta$on of the RFP submiFals. The RFP submiFals will become the property of The Tribe.

N. The Tribe reserves the right to reject any or all proposals submiFed or make modifica$ons to the scope of work, subject to appropriate nego$a$on, during the design process.

O. The final decision is the sole decision of The Tribe, and the respondents to this formal request have no appeal rights or procedures guaranteed to them.

Page | 10

Exhibit 3 – Example Contract

Page | 11

Page | 12

Page | 13

Page | 14

ATTACHMENT A - PROPOSERS CERTIFICATION

A. The undersigned acknowledges receipt of Addendum numbers ______ through ______ or N/A.

B. Proposer cer$fies it is an independent contractor as defined by ORS 670.600 and under penalty of perjury is, to the best of the undersigned's knowledge, not in viola$on of any local, state, or federal tax law.

C. Proposer cer$fies this proposal is genuine and not made in the interest of or on behalf of any undisclosed person, firm, or corpora$on; Proposer has not induced any person, firm, or corpora$on to refrain from proposing; and

Proposer has not sought by collusion or fraud to obtain for itself any advantage over any other Proposer or over

CIT.

D. Proposer cer$fies that the firm has no business or personal rela$onships with any other company or person that could be considered a conflict of interest or poten$al conflict of interest to CIT.

E. Proposer agrees to make their proposal a binding offer to CIT for a period of ninety (90) calendar days from the date proposals are due.

F. The undersigned warrants that he/she is an authorized representa$ve of the Proposer; has read, understands and agrees to be bound by all RFP instruc$ons, insurance requirements and contract terms and condi$ons contained herein (including all addenda issued for this RFP); that the informa$on provided in this proposal is true and accurate; and that providing incorrect or incomplete informa$on may be cause for proposal rejec$on or contract termina$on.

Legal Business Name:

Mailing Address:

Contact Person Printed Name & Title:

Phone Number: Email:

Federal Tax Iden$fica$on Number (FEIN):

Signature: Date: