Rev. 9/2025- Services

Request for Proposal No. ISD126-ADM-6361 Countywide Security Assessment and Risk

Analysis

San Bernardino County Innovation and Technology Department

851 East Cooley Drive Colton, CA 92324

July 2nd, 2026

Innovation and Technology Department

Request for Proposal Countywide Security

Assessment and Risk Analysis

No. ISD126-ADM-6361

I. INTRODUCTION

A. Purpose The San Bernardino County, Innovation and Technology Department (County), is seeking Proposals from interested and qualified Proposers to provide San Bernardino County with a comprehensive information security/cybersecurity security assessment and HIPAA risk analysis and gap analysis (SARA). The SARA utilizes a three-prong approach, will span multiple years and is detailed in the Scope of Work in Section V. and further detailed in the Exhibits. The number of awards will be determined by the quality of the proposals received.

B. RFP Contact All correspondence, including Proposals and questions (not bid questions), must be submitted to the person identified below (RFP Contact):

San Bernardino County Innovation and Technology Department Attn: Christine Onyango 851 East Cooley Drive Colton, CA 92324

(909) 388-5943 Christine.Onyango@itd.sbcounty.gov

Secondary RFP contract:

Innovation and Technology Department Attn: Jeremiah Thomas 851 East Cooley Drive Colton, CA 92324

(909) 388-0641 Jeremiah.Thomas@itd.sbcounty.gov

Proposals will not be accepted by email or facsimile. Proposals must be submitted electronically through the County Electronic Procurement Network (ePro). All Proposers must register with the ePro system prior to the date and time to submit the proposal, or they will be disqualified.

C. Budget The County estimates a budget of $1,066,750 for completion of this work.

D. Contract Term

Services to be provided under this Request for Proposals (RFP) are outlined under Section V, Scope of Work and the Exhibits. The Contract period will be for a maximum of five (5) years. The Contract period will allow for the option of up to two (2) additional years following a mandatory three (3) year term.

E. Location of Services Services are to be provided, completed and managed at multiple County locations. See Section V. and Exhibit B – Health Care Component (HCC) Department Locations for a complete listing of the County Departments/Facilities, including associated locations addresses.

The Proposer must include in its Proposal, Attachment E - Cost, all transportation, lodging, and per diem costs sufficient to pay its personnel and travel to the aforementioned locations.

F. Assistance to Proposers with a Disability mailto:Christine.Onyango@itd.sbcounty.gov mailto:Jeremiah.Thomas@itd.sbcounty.gov

Department

Request for Proposal Countywide Security

Assessment and Risk Analysis

Proposers with a disability may request accommodation regarding the means of communicating this RFP or participating in the procurement process. For more information, contact the RFP Contact no later than ten (10) days prior to the Deadline for Proposals.

II. PROPOSAL TIMELINE

Release of RFP July 2nd, 2026

Mandatory Virtual Proposal Conference July 16th, 2026 10:00 AM (PDT)

Deadline for Submission of Questions July 23rd, 2026, 1:00 PM (PDT)

Deadline for Proposals August 6th, 2026, 4:00 PM (PDT)

Presentation/Demonstration (Virtual) August 24th, 2026 – August 28th, 2026

Date for Tentative Contract Award TBD

Proposal Conference:

A mandatory virtual Proposal Conference will be held. The virtual meeting link will be provided in an amendment in ePro.

Thursday, July 16th, 2026 10:00 AM Pacific Daylight Time (PDT)

Please join the mandatory virtual Proposal Conference via the hyperlink below:

Microsoft Teams meeting Join: https://teams.microsoft.com/meet/252093549823762?p=PijcLG29aar8DOpZdd Meeting ID: 252 093 549 823 762 Passcode: Ua6LF3Md

Attendance at the virtual conference is mandatory. No Proposal will be accepted from any Proposer who fails to attend the virtual Proposal Conference.

Questions regarding the contents of this RFP must be submitted in writing in ePro on or before the Deadline for Submission of Questions. All questions will be answered, and both the question and answer will be posted as an Addendum to the RFP in ePro.

III. DEFINITIONS

Capitalized terms used in this RFP shall have the meanings given to them in the RFP and as defined below:

Board: The San Bernardino County Board of Supervisors.

Chief Information Security Officer (CISO): A senior executive responsible for an organization's information, data, and cybersecurity strategy including but not limited to governance, policy, standards, and processes.

Countywide Information Security Program (CISP): This is a formalized cybersecurity program that incorporates governance, policies, protocols, standards, and industry-proven practices to promote a holistic risk-based and collaborative approach to mitigate high-risk vulnerabilities that potentially leads to security incidents and breaches.

Contract: The Contract between the County and the Proposer resulting from the award issued pursuant to this RFP to the successful Proposer.

Contractor: Any individual, company, firm, corporation, partnership or other organization to whom a contract award is made by the County.

https://teams.microsoft.com/meet/252093549823762?p=PijcLG29aar8DOpZdd

Department

Request for Proposal Countywide Security

Assessment and Risk Analysis

Criminal Justice Information Services (CJIS): A federal agency that provides a range of state-of-the-art tools and services to law enforcement, national security and intelligence community partners, and the general public.

Electronic Personal Health Information (ePHI): Electronic Protected Health Information, which is individually identifiable health information created, stored, transmitted, or received electronically and protected under

HIPAA.

Facilitator: A County Purchasing Department buyer or designated individual tasked with managing the processes of the evaluation panel.

Family Educational Rights and Privacy Act (FERPA): A U.S. federal law that protects the privacy of student education records and grants specific rights to parents and eligible students.

Health Insurance Portability and Accountability Act (HIPAA): A federal law designed to provide privacy and information security standards to protect patients’ medical records and other health information provided to health plans, doctors, hospitals, and other health care providers. (45 C.F.R. Parts 160 and 164)

International Organization for Standardization (ISO): ISO is the short name for this organization; it’s not an acronym. ISO is an independent, non-governmental international organization that develops and publishes voluntary standards to ensure the quality, safety, and efficiency of products, services and systems. They incorporate a multitude of sectors (e.g., IT and related technologies, security and risks, and engineering), using a consensus-based standards development process.

National Institute of Standards and Technology (NIST): A Federal agency that develops measurement standards and promotes innovation and industrial competitiveness.

Personally Identifiable Information (PII): All information/data that directly or indirectly links to a person, one's name, email address, phone number, bank account number, and government-issued ID number etc.

Proposal: The offer to provide specific goods or services at specified prices and/or other conditions specified in the RFP.

Purchasing Agent: The Director of the County Purchasing Department.

Request for Proposal (RFP): The request for an offer from Proposers interested in providing the identified services sought to be procured by the County. The RFP specifies the evaluation factors to be used and contain or incorporates by reference contractual terms and conditions applicable to the procurement.

Security Assessment and Risk Analysis (SARA): A critical process that evaluates an organization’s security posture, identifies vulnerabilities, assesses risk levels, and provides actionable recommendations to mitigate potential threats. This includes a HIPAA risk analysis under 45 CFR Section 164.308(a)(1)(ii)(A) and a HIPAA gap analysis.

Services: The requested services described in this RFP.

Subcontractor: An individual, company, firm, corporation, partnership or other organization, not in the employment of or owned by Contractor who is performing services on behalf of Contractor under the Contract or under a separate contract with or on behalf of Contractor.

IV. PROPOSAL CONDITIONS

A. Authorized Signatures

Department

Request for Proposal Countywide Security

Assessment and Risk Analysis

All proposals must be signed by an individual authorized to bind the Proposer to the provisions of the

RFP.

B. Term of Offer

Proposals shall remain open, valid and subject to acceptance anytime within nine (9) months after the Proposal submission.

C. Required Review Proposers should carefully review this RFP for defects and questionable or objectionable material.

Comments from Proposers concerning defects and objectionable material in this RFP must be made in writing and received by the RFP contact prior to the deadline for submission of questions identified in Section II or at least ten (10) calendar days before the Deadline for Proposals (whichever occurs last).

This will allow issuance of any necessary amendments or addendums to the RFP. It will also help prevent the opening of a defective RFP and exposure of Proposals upon which an award could not be made.

Protests based on any omission or error, or on the content of this RFP, may be disallowed if not submitted in writing to the attention of the RFP Contact, prior to the deadline for submission of questions identified in Section II or at least ten (10) calendar days before the Deadline for Proposals (whichever occurs last).

D. Incurred Costs

The County is not obligated to pay any costs incurred by Proposer in the preparation of a Proposal in response to this RFP. Proposers agree that all costs incurred in developing a Proposal are the Proposer’s responsibility.

E. Amendments/Addendums to RFP The County reserves the right to issue amendments or addendums to this RFP if the County considers that changes are necessary or additional information is needed.

Changes to a Proposal or withdrawal of a Proposal will only be allowed if a request is received prior to the Deadline for Proposals. No amendments or withdrawals will be accepted after the Deadline for Proposals.

F. Best Value Evaluation As established in this RFP, the County realizes that criteria other than price are important and will award contract(s) based on the Proposal that best meets the needs of the County. The County seeks the optimal combination of quality, price, and various qualitative elements of the required Services that will provide the County the greatest or best value for its money.

G. Right of Rejection Offers must comply with all of the terms of the RFP, and all applicable local, state, and federal laws, codes, and regulations. The County may reject as non-responsive any Proposal that does not comply with all of the material and substantial terms, conditions, and performance requirements of the RFP.

Further, the County may reject a proposal from any entity that is a parent, affiliate, or subsidiary, or that is under common ownership, control, or management with any other entity submitting a Proposal in response to this RFP.

A Proposer may not qualify the Proposal nor restrict the rights of the County. If Proposer does so, the Proposal may be determined to be a non-responsive counter-offer and the Proposal may be rejected.

No Proposal shall be rejected, however, if it contains a minor irregularity, defect or variation. If the irregularity, defect or variation is considered by the County to be immaterial or inconsequential, the County may choose to accept the Proposal.

Minor irregularities may be waived by the Purchasing Agent when they are any of the following:

1. Do not affect responsiveness;

Department

Request for Proposal Countywide Security

Assessment and Risk Analysis

2. Are merely a matter of form or format;

3. Do not change the relative standing or otherwise prejudice other offers;

4. Do not change the meaning or scope of the RFP;

5. Are trivial, negligible, or immaterial in nature;

6. Do not reflect a material change in the work; or

7. Do not constitute a substantial reservation against a requirement or provision.

In such cases the Proposer will be notified of the deficiency in the Proposal and given an opportunity to correct the irregularity, defect or variation or the County may elect to waive the deficiency and accept the Proposal. The decision to provide a waiver shall in no way modify or compromise the overall purpose of the submittal, nor excuse the Proposer from compliance with all requirements if awarded a Contract.

This RFP does not commit the County to award a contract. The County reserves the right to reject any or all Proposals if it is in the best interest of the County to do so. The County also reserves the right to terminate this RFP process at any time.

H. Local Preference

The San Bernardino County has adopted a Local Preference Policy. A local preference of five percent (5%) shall be applied in the cost evaluation of proposals or bids for goods, services, equipment, or a minor public work project, unless an exemption applies. In a price-based bid, five percent (5%) will be deducted from the local vendor’s proposed cost for the purpose of comparison when the local vendor’s proposed cost is not the lowest. If the local vendor’s bid is equal to or lower than the price of an otherwise successful non-local vendor after the 5% preference is applied, the local vendor will be given the opportunity to match the lowest quoted price. In a best value evaluation, five percent (5%) of the awardable points for cost will be added to the local vendor’s score. If the local vendor’s overall score is equal to or lower than that of an otherwise successful nonlocal vendor, the local vendor will be recommended for award.

“Due to the evaluation of qualitative elements along with cost in a best value evaluation, application of local preference for cost proposals may not result in award to a local vendor with the lowest cost after applying local preference.”

Local Vendor - A local vendor is any vendor, contractor or consultant (hereafter “vendor”) that meets all of the following requirements:

1. Vendor’s main office (headquarters) or a major regional office is located within the County;

2. Vendor employs a minimum of 25% of the vendor’s full-time management employees and 25% of its full-time regular employees working from the San Bernardino County location(s);

3. Vendor employs one full-time or two part-time employees with primary residence in the County;

4. Vendor’s “point of sale” for purposes of reporting sales tax to the State Board of Equalization is within the boundaries of the County. The payment of any local share of sales tax must go to the County or a city within the County. If the local business has more than one sales office in the State of California, the office located in the County shall be the point of sale for sales tax calculation;

5. Vendor is not delinquent in any taxes or other payments to the County;

6. Vendor possesses a valid and verifiable business license (if required);

7. Vendor has been open and established for at least six months prior to the issuance of the solicitation;

8. Vendor can demonstrate on-going business activity in the field of endeavor on which they are proposing from that office during the preceding six months;

9. Vendor has not within five years prior to the solicitation admitted guilt or been found guilty by any court or state or federal regulatory enforcement agency of violation of any criminal law or any law or regulation regarding fraud;

10. Vendor is not federally debarred; and

11. Vendor is not suspended or debarred from participation in doing business with the County, in

Department

Request for Proposal Countywide Security

Assessment and Risk Analysis the scope of work that is the subject of the solicitation.

12. Local Vendor Self-certification – Documentation provided

Local Vendor self-certification form is required for any bid or proposal when a local preference is claimed affirming that it meets each of the above stated criteria, and signed by a vendor representative with the authority to obligate the company under penalty of perjury. (See Attachment)

I. Clarification of Offers In order to determine if a Proposal is reasonably susceptible for award, communications by the Facilitator for the evaluation panel are permitted with a Proposer to clarify uncertainties or eliminate confusion concerning the contents of a Proposal. Clarifications may not result in a material or substantive change to the Proposal. The evaluation by the panel may be adjusted as a result of a clarification under this section.

J. Public Records Act All Proposals and other material submitted become the property of the County and are subject to release according to the California Public Records Act (Government Code § 7920.000). All Proposal information, including cost information, will be held in confidence during the evaluation and negotiation process.

Thereafter, Proposals are subject to becoming a non-exempt public record.

If a Proposer believes that any portion of its Proposal is exempt from public disclosure, it must indicate the specific portions believed to be confidential and not subject to disclosure on Attachment I - Public Records Act Exemptions. The Proposer also must include a brief description that sets out the reasons for exemption from disclosure. Each stated exemption must include a citation to supporting legal authority, including statutory authority or case law, to support exemption from the Public Records Act. Requested exemptions that do not meet the requirements of this section will not be considered.

The County will use reasonable means to ensure that such information is safeguarded, but will not be held liable for inadvertent disclosure of the information. Proposals marked “Confidential” in their entirety will not be honored, and the County might not deny public disclosure of any portion of Proposals so marked.

By submitting a Proposal with portions identified in Attachment I as “Confidential,” Proposer represents that it has a good faith belief that such portions are exempt from disclosure under the California Public Records Act. Proposer may be requested to obtain legal protection from disclosure should a Public Records Act request be received. In the event the County does not disclose the information marked “Confidential,” Proposer agrees to reimburse the County for, and to indemnify, defend (with counsel approved by County) and hold harmless the County, its officers, employees, agents, and volunteers from and against any and all claims, damages, losses, liabilities, suits, judgments, fines, penalties, costs and expenses, including without limitation, attorneys’ fees, expenses and court costs of any nature arising from or relating to the County’s non-disclosure of any such designated portions of a Proposal.

K. Employment of Former County Officials Information must be provided in Attachment G regarding former County Administrative Officials (as defined below) who are employed by or represent Proposer. The information provided must include a list of former County Administrative Officials who terminated County employment within the last five years and who are now officers, principals, partners, associates or members of Proposer and should also include the employment and/or representative capacity and the dates these individuals began employment with or representation of Proposer. For purposes of this section, “County Administrative Official” is defined as a member of the Board of Supervisors or such member’s staff, CEO or member of such officer’s staff, CISO, assistant department or group head, or any employee in the Exempt Group, Management Unit or Safety Management Unit.

Failure to provide this information may result in the Proposal being deemed non-responsive.

Department

Request for Proposal Countywide Security

Assessment and Risk Analysis

L. Iran Contracting Act of 2010

In accordance with Public Contract Code section 2204(a), the Proposer certifies upon submission that the Proposer signing the Proposal is not identified on a list created pursuant to subdivision (b) of Public Contract Code section 2203 (https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement- Division-Resources-List-Folder/List-of-Ineligible-Businesses)as a person (as defined in Public Contract Code section 2202(e)) engaging in investment activities in Iran described in subdivision (a) of Public Contract Code section 2202.5, or as a person described in subdivision (b) of Public Contract Code section 2202.5, as applicable.

Proposers are cautioned that making a false certification may subject the Proposer to civil penalties, termination of an existing contract, and ineligibility to bid on a contract for a period of three (3) years in accordance with Public Contract Code section 2205. Proposer agrees that signing the Proposal shall constitute signature of this Certification.

M. Disclosure of Criminal and Civil Proceedings The County reserves the right to request the information described herein from the Proposer selected for Contract award. Failure to provide the information may result in a disqualification from the selection process and no award of Contract to the Proposer. The County also reserves the right to obtain the requested information by way of a background check performed by an investigative firm. The selected Proposer may also be asked to provide information to clarify initial responses. Negative information provided or discovered may result in disqualification from the selection process and no award of Contract.

The selected Proposer may be asked to disclose whether the firm, or any of its partners, principals, members, associates or key employees (as that term is defined herein), within the last ten years, has been indicted on or had charges brought against it or them (if still pending) or convicted of any crime or offense arising directly or indirectly from the conduct of the firm’s business, or whether the firm, or any of it partners, principals, members, associates or key employees, has within the last ten years, been indicted on or had charges brought against it or them (if still pending) or convicted of any crime or offense involving financial misconduct or fraud. If the response is affirmative, the Proposer will be asked to describe any such indictments or charges (and the status thereof), convictions and the surrounding circumstances in detail.

In addition, the selected Proposer may also be asked to disclose whether the firm, or any of its partners, principals, members, associates or key employees, within the last ten years, has been the subject of legal proceedings as defined herein arising directly from the provision of services by the firm or those individuals. “Legal proceedings” means any civil actions filed in a court of competent jurisdiction, or any matters filed by an administrative or regulatory body with jurisdiction over the firm or the individuals. If the response is affirmative, the Proposer will be asked to describe any such legal proceedings (and the status and disposition thereof) and the surrounding circumstances in detail.

For purposes of this provision “key employees” includes any individuals providing direct service to the County. “Key employees” do not include clerical personnel providing service at the firm’s offices or locations.

N. Debarment and Suspension; California Secretary of State Business Entity Registration.

Proposer certifies in Attachment D that neither it nor its principals or subcontractors are presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from participation in this transaction by any federal department or agency. (See Attachment D and the following United States General Services Administration’s System for Award Management website https://www.sam.gov). Proposer also certifies in Attachment D that if it or any of the subcontractors listed in the Proposal are business entities that must be registered with the California Secretary of State, they are registered and in good standing with the Secretary of State.

https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-Resources-List-Folder/List-of-Ineligible-Businesses https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-Resources-List-Folder/List-of-Ineligible-Businesses https://www.sam.gov/

Department

Request for Proposal Countywide Security

Assessment and Risk Analysis

O. Unsatisfactory Performance

Proposer affirms that it has no record of unsatisfactory performance with the County in the twenty-four

(24) month period immediately preceding the date of issuance of this RFP.

P. Final Authority The final authority to award a contract(s) as a result of this RFP rests solely with the County Board of Supervisors, or as delegated by the Board of Supervisors.

V. SCOPE OF WORK

A. BACKGROUND INFORMATION

San Bernardino County encompasses 20,105 square miles, consisting of a land area of 20,057 square miles and water area of 48 square miles, and is the largest county in the continental United States. It borders Los Angeles, Riverside, Orange, Inyo and Kern counties and the states of Arizona and Nevada.

The County’s Innovation and Technology Department is responsible for providing a variety of information technology (IT) services to all County departments, Board Governed Special Districts, and other federal, state, and local government agencies.

ITD’s Office of the CISO supports the departments and agencies of San Bernardino County, enhancing the businesses and services provided to residents and our workforce. The CISP ensures security measures are consistent and in place to protect data, detect attacks, and respond promptly to incidents, for the mitigation of cyber threats.

B. PROJECT DESCRIPTION

This project is to provide the County with a comprehensive information security/cybersecurity security assessment and risk analysis (SARA) utilizing a three-prong approach over multiple years. Proposals should detail how the Proposer will meet the following requirements:

PRONG-ONE: Countywide SARA

• Conducted during first year of engagement

• Scan of every County internet protocol (IP) address

• Follow-up health checks occurring between six (6) and eighteen (18) months after completion of the SARA and reports have been delivered. This is to identify and quantify areas that have been mitigated or resolved.

• All forty-seven (47) County Departments, Divisions, Agencies and Separate Legal Entities are included in this project (* denotes a designated Health Care Component of the County, †denotes separate legal entity), they are:

1. Aging and Adult Services*

2. Agriculture/Weights & Measures

3. Airports

4. Arrowhead Regional Medical Center*

5. Assessor-Recorder-County Clerk

6. Auditor-Controller/Treasurer/Tax Collector*

7. Behavioral Health*

8. Board of Supervisors*

9. Child Support Services

10. Children and Family Services

11. Children’s Network

12. Clerk of the Board

Department

Request for Proposal Countywide Security

Assessment and Risk Analysis

13. Community Development & Housing

14. County Administrative Office*

15. County Counsel*

16. County Fire* †

17. District Attorney

18. Economic Development

19. First 5†

20. Fleet Management

21. Health and Human Services Administration*

22. Human Resources*

23. In-Home Supportive Services Public Authority

24. Innovation and Technology*

25. Inland Counties Emergency Medical Agency – ICEMA†

26. Labor Relations

27. Land Use Services

28. Library

29. Museum

30. Office of Emergency Services

31. Office of Homeless Services

32. Performance, Education, and Resource Center

33. Preschool Services

34. Probation*

35. Project & Facilities Management

36. Public Defender

37. Public Health*

38. Public Works

39. Purchasing*

40. Real Estate Services

41. Regional Parks

42. Registrar of Voters

43. Risk Management*

44. Sheriff-Coroner-Public Administrator*

45. Transitional Assistance

46. Veterans Affairs

47. Workforce Development

• For purposes of this RFP the County Departments, Divisions, Agencies and Separate Legal

Entities will be collectively referred to as “Departments,” unless specifically stated otherwise.

The County reserves the right to modify the department list above to include additional departments or agencies that are denoted as HIPAA covered.

1. Countywide SARA Services and Activities

The SARA must be conducted in accordance with the National Institute of Standards and Technology (NIST) Special Publications 800-30, 800-37, and 800-53, International Standards Organization (ISO) and consists of the following components that must be performed within the continental United States:

a. Manual Testing. Test each Department’s ability to prevent and/or identify an ongoing attack through a targeted attack simulation initiated from external network attack vectors (i.e., blind test) and from pre-determined internal network footholds (i.e., intelligent test). Proposers should indicate how they will assist the Department with:

Department

Request for Proposal Countywide Security

Assessment and Risk Analysis

i. Validating existing controls and processes implemented to identify a targeted attack;

ii. Obtaining an understanding of its ability to detect and effectively respond to an attack;

iii. Obtaining an understanding of the Department’s ability to hinder an attacker from obtaining confidential or sensitive data, including electronic Personal Health

Information (“ePHI”) as defined under HIPAA, Personally Identifiable Information

(“PII”) as defined under California law, financial data, privileged communications, and employee data; and,

iv. Understanding the effectiveness of attack scenarios modeled after real world threat intelligence.

b. External (Internet) Network Penetration Testing. Test web applications, firewalls, remote access (e.g., VPN and RDP), Internet accessible servers, and Internet postings, and take action to evade a Department’s efforts to respond to any detection that may occur. This will include attempts to obtain confidential customer data, sensitive employee data, and other sensitive data from external sources using penetration techniques based on real world threat intelligence. Testing includes, but is not limited to, web applications, firewalls, remote access

(e.g., VPN and RDP), Internet accessible servers, and Internet postings. Specifically, testing should include:

i. Penetration Testing (i.e. blind and intelligent)

ii. Vulnerability Assessment

iii. Potential risks to those identified information assets (to include potential costs of privacy or security breaches and other information security threats), and associated with how the Department collects, uses, manages, stores, maintains, discloses, and disposes of information.

iv. Physical assessment of technical infrastructure

v. Identification of potential risks to those identified information assets (to include potential costs of privacy or security breaches and other information security threats), and associated with how the Department collects, uses, manages, stores, maintains, discloses, and disposes of information

vi. Review of existing privacy and security measures and report on the effectiveness of those measures

vii. Identification of potential gaps or deficiencies in maintenance, protection, and utilization of the information assets

viii. Internal/external networks (including penetration tests)

ix. Internet/intranet vulnerability test

x. Internet, Extranet and Intranet applications

xi. Servers and data storage.

xii. Workstations and peripheral endpoints

xiii. Virtual Private Network and remote access infrastructure

c. Internal Network Penetration Testing. This will include attempts to obtain confidential customer information (e.g., PII), sensitive employee data, and other sensitive data from internal network sources using penetration techniques based on real world threat intelligence.

Department

Request for Proposal Countywide Security

Assessment and Risk Analysis

Testing should include servers, workstations, Intranet sites, peripheral endpoints, network devices, storage devices, encryption, and password strength (e.g., password cracking). The

Consultant will be expected attempt to avoid detection during this phase of testing.

Additionally, Consultant must take actions to evade the Department’s efforts to respond to any detection that may occur.

Internal testing should be performed utilizing the following pre-determined network foothold assumptions:

• Access from a physical network port without network credentials; and

• Access from an authenticated workstation, simulating a Trojan or successful phishing attack.

The Consultant shall perform internal penetration testing and vulnerability scans of the Department’s internal network to include those items listed under 1.b. above.

d. Physical Assessment. Review the physical security controls for the information assets that create, receive, maintain or transmit electronic PII to validate the Department’s current procedure to safeguard sensitive and secure areas and the equipment therein from unauthorized physical access, tampering, theft, and physical elements. Consultant shall perform:

i. Physical assessment of technical infrastructure.

ii. A systematic and thorough identification and evaluation of the County’s information assets (data, information systems, and information processing facilities) which create, receive, maintain, or transmit PII.

e. Wireless Penetration Testing. Attempt to obtain confidential member data, sensitive employee data, and other sensitive data from network sources accessible via the wireless network(s). Consultant must attempt to gain access to the Department’s password protected wireless network(s). Consultant shall also test the segmentation of the guest (Internet only) wireless network(s). Consultant must attempt to avoid detection during this phase of testing.

Additionally, Consultant must take actions to avoid the Department’s efforts to respond to any detection that may occur. Specifically, Consultant will test wireless networks, including, but not limited to, secure and guest Wi-Fi access points.

f. Firewall Review. Firewall review must analyze firewall configurations and access rules of key firewalls for security vulnerabilities and weaknesses. Specifically, Consultant shall review firewall diagnostics.

g. Mobile Device. Consultant will review and analyze security controls implemented for mobile devices that access regulated data (e.g., PII).

h. Social Testing. Attempt to obtain confidential customer data, sensitive employee data, and other sensitive data from employees using social attack techniques based on real world threat intelligence. Types of social attacks will include phishing (e.g., spear), phone call impersonation, physical impersonation, piggybacking, dumpster diving, etc. Consultant must attempt to avoid spam filters, antivirus and other detection mechanisms during this phase of testing.

i. Security Architecture and Configuration Review. Services will include review and analysis of security controls implemented in the IT environment by the Department. Additionally, a

Department

Request for Proposal Countywide Security

Assessment and Risk Analysis skills assessment and correlation to their existing IT security staff must be generated for each.

The objective is to address but are not limited to: illustrate knowledge gaps with information security practices and protocols, quantification of time spent on security matters (e.g., previous incident response), and quantifying the number of staff with a shared responsibility of security and IT responsibilities.

j. Automated Testing. Consultant must test the effectiveness of the County’s vulnerability and patch management programs against known vulnerabilities. The overall objective is to help each Department:

i. Identify known vulnerabilities, currently present within their environment;

ii. Obtain an understanding of the implications of the vulnerabilities identified;

iii. Where possible, without causing disruption, validate scan results; and

iv. Provide a filtered end product, which helps management prioritize their remediation efforts.

Consultant shall focus on the following:

i. Vulnerability scanning;

ii. Validation and Prioritization results.

k. Vulnerability scanning. Consultant shall help each department, as applicable, to identify known and detectible vulnerabilities present in the external and internal network infrastructure. Vulnerability scanning shall be performed on servers, workstations, web-based applications, and other general devices to provide management with an understanding of the

Department’s exposure to preventable security flaws.

Consultant shall utilize various automated tools, such as vulnerability scanners to perform the network security review. The tools must be configured not to cause system disruptions or degradation of service. Consultant will be expected to work with the CISO or designee, including each department’s IT leadership to discuss the specific tools that will be used and the timing for running the tests to minimize any potential impact.

Consultant shall document all automated and manual tools utilized including the identification if they are commercial, proprietary, or open source throughout these assessments.

l. Validation and Prioritization of Results. Assessment of the vulnerability scanning results.

Consultant shall assist the Department with validating, eliminating false positives, filtering and prioritizing the scan output to provide management with relevant scan results detailing known vulnerabilities, which Consultant believes pose a significant risk to the selected systems for focused remediation.

The output of the review shall be filtered to include critical, high, and moderate issues. Raw scan output shall also be provided in the event management would like to review all issues identified by Consultant’s vulnerability scanning tools during the assessment. Scan results shall be provided in native, unfiltered reports and prioritized and curated issues to be included as part of Consultant’s Assessment report.

m. Knowledge Sharing. Consultant shall provide each Department’s technical team, and the

County CISO or designee, as applicable, with a detailed, step-by-step dissection of

Consultant’s attack methodology, key learning points, and live demonstrations of select activities and exploitation performed during project execution.

Department

Request for Proposal Countywide Security

Assessment and Risk Analysis

Consultant should expect to schedule weekly meetings and/or conference calls with the department to:

i. Report on the status of the project work plan and timeline;

ii. Re-schedule tasks as necessary;

iii. Discuss major open issues/risks and develop strategies to address them; and,

iv. Review next steps.

PRONG-TWO: HIPAA Gap and Risk Analysis Prong-Two involves conducting a HIPAA and the Health Information Technology for Economic and

Clinical Health Act of 2009 (HITECH) gap and risk analysis, including:

1. A gap and risk analysis for Covered Departments (see previous section for an asterisk as an indicator) will occur every two (2) years via a County coordinated effort to provide a holistic, consistent risk measurement process, and aggregated reporting.

2. HIPAA Covered Departments may engage the Consultant during the off-years from the

County-coordinated process, as needed for additional gap and risk analysis services.

1. HIPAA Risk Analysis Services and Activities

Specific to County Fire and HIPAA Covered Departments where they are part of the County’s Health Care Component (HCC) (those noted with an * in the list above). All sections referenced below are derived from Title 45 of the CFR.

HIPAA Risk Analysis (45 CFR §164.308(a)(1)(ii)(A))

The HIPAA Risk Analysis must be conducted in accordance with the National Institute of Standards and Technology (NIST) Special Publication 800-53, International Standards Organization (ISO) and consist of the following components for County Fire and each HCC Department. Separately for County Fire and each HCC Department, the Consultant must conduct and document an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI), which shall include, at a minimum, the following:

a. Data Discovery. For County Fire and each separate HCC Department (department designated by an asterisk) the Consultant must identify where ePHI is stored, received, maintained or transmitted. The Consultant shall complete this process by any reasonable means, including reviewing past and/or existing projects, performing interviews, reviewing documentation, or using other data gathering techniques. The location of where ePHI is maintained must be documented. In addition, Consultant shall develop an understanding of business relationships, contractual arrangements, and agreements in place that may handle or process PHI data on behalf of County Fire and the County HCC Departments. This will include discussions with key personnel and a review of documentation around business processes that involve PHI data.

b. Identify and Document Potential Threats and Vulnerabilities. For County Fire and each separate HCC Department, the Consultant must identify and document reasonably anticipated threats to ePHI. The Consultant must identify different threats that are unique to the circumstances of the respective department. The Consultant must also identify and document vulnerabilities which, if triggered or exploited by a threat, would create a risk of inappropriate access to or disclosure of ePHI.

Department

Request for Proposal Countywide Security

Assessment and Risk Analysis

c. Assess Current Security Measures. The Consultant should assess and document the security measures that County Fire and each HCC Department use to safeguard ePHI, whether security measures required by the Security Rule are in place, and if security measures are configured and used properly. At a minimum, the Consultant must perform the following:

i. Manual Testing. Test County Fire and the HCC Department’s ability to prevent and/or identify an ongoing attack through a targeted attack simulation initiated from external network attack vectors (i.e., blind test) and from pre-determined internal network footholds

(i.e., intelligent test). Assist County Fire and the HCC Department with:

1. Validate existing controls and processes implemented to identify a targeted attack;

2. Obtain an understanding of its ability to detect and effectively respond to an attack;

3. Obtain an understanding of County Fire and the HCC Department’s ability to hinder an attacker from obtaining confidential or sensitive data (e.g., ePHI, PII, financial, privilege, and employee); and,

4. Understand the effectiveness of attack scenarios modeled after real world threat intelligence.

ii. External (Internet) Network Penetration Testing. This will include attempts to obtain confidential customer data, sensitive employee data, and other sensitive data from external sources using penetration techniques based on real world threat intelligence.

Testing includes, but is not limited to, web applications, firewalls, remote access (e.g., VPN and RDP), Internet accessible servers, and Internet postings. Consultant will attempt to avoid detection during this phase of testing. Additionally, the Consultant will take action to avoid the HCC Department’s efforts to respond to any detection that may occur.

Specifically, this will include:

1. Penetration Testing (i.e., blind and intelligent)

2. Vulnerability Assessment

3. Potential risks to those identified information assets (to include potential costs of privacy or security breaches and other information security threats) and associated with how County Fire and the HCC Department collects, uses, manages, stores, maintains, discloses, and disposes of information.

4. Physical assessment of technical infrastructure

5. Identification of potential risks to those identified information assets (to include potential costs of privacy or security breaches and other information security threats), and associated with how County Fire and the HCC Department collects, uses, manages, stores, maintains, discloses, and disposes of information

6. Review existing privacy and security measures and report on the effectiveness of those measures

7. Identification of potential gaps or deficiencies in maintenance, protection, and utilization of the information assets

8. Internal/external networks (including penetration tests)

9. Internet/intranet vulnerability test

10. Internet, Extranet, and Intranet applications

11. Servers and data storage.

12. Workstations and peripheral endpoints

13. Virtual Private Network and remote access infrastructure

iii. Internal Network Penetration Testing. This will include attempts to obtain confidential customer data ePHI, sensitive employee data, and other sensitive data from internal

Department

Request for Proposal Countywide Security

Assessment and Risk Analysis network sources using penetration techniques based on real world threat intelligence.

Testing includes, but is not limited to, servers, workstations, Intranet sites, peripheral endpoints, network devices, storage devices, encryption, and password strength (e.g., password cracking). Consultant will attempt to avoid detection during this phase of testing.

Additionally, Consultant must take actions to evade the Department’s efforts to respond to any detection that may occur.

Internal testing will be performed utilizing the following pre-determined network foothold assumptions:

• Access from a physical network port without network credentials; and

• Access from an authenticated workstation, simulating a Trojan or successful phishing attack.

The Consultant shall perform internal penetration testing and vulnerability scans of County Fire and the HCC Department’s internal network to include those items listed under c(ii).

above.

iv. Physical Assessment. This will review the physical security controls for the information assets that create, receive, maintain or transmit electronic ePHI to validate County Fire and the HCC Department’s current procedure to safeguard sensitive and secure areas and the equipment therein from unauthorized physical access, tampering, theft, and physical elements. Consultant shall perform:

1. Physical assessment of technical infrastructure;

2. A systematic and thorough identification and evaluation of the County’s information assets (data, information systems, and information processing facilities) which create, receive, maintain, or transmit ePHI.

v. Wireless Penetration Testing. This will include attempts to obtain confidential workforce member’s data, sensitive employee data, and other sensitive data from network sources accessible via the wireless network(s). Consultant must attempt to gain access to County

Fire and the HCC Department’s password protected wireless network(s). Consultant shall also test the segmentation of the guest (Internet only) wireless network(s). Consultant must attempt to avoid detection during this phase of testing. Additionally, Consultant must take action to avoid County Fire and the HCC Department’s efforts to respond to any detection that may occur. Specifically, Consultant will test wireless networks, including, but not limited to, secure and guest Wi-Fi access points.

vi. Firewall Review. Firewall review must analyze firewall configurations and access rules of key firewalls for security vulnerabilities and weaknesses. Specifically, Consultant shall review firewall diagnostics.

vii. Mobile Device. Consultant will review and analyze security controls implemented for mobile devices that access ePHI.

viii. Social Testing. This will include attempts to obtain confidential customer data, sensitive employee data, and other sensitive data from employees using social attack techniques based on real world threat intelligence. Types of social attacks will include spear phishing, phone call impersonation, physical impersonation, piggybacking, dumpster diving, etc.

Department

Request for Proposal Countywide Security

Assessment and Risk Analysis

Consultant must attempt to avoid spam filters, antivirus, and other detection mechanisms during this phase of testing.

ix. Security Architecture and Configuration Review. Consultant must review and analyze security controls implemented in the IT environment by the HCC Department.

x. Automated Testing. Through this phase, Consultant must test the effectiveness of the

County’s vulnerability and patch management programs against known vulnerabilities.

The overall objectives are to help County Fire and each HCC Department:

1. Identify known vulnerabilities, currently present within their environment;

2. Obtain an understanding of the implications of the vulnerabilities identified;

3. Where possible, without causing disruption, validate scan results; and

4. Provide a filtered end product, which helps management prioritize their remediation efforts.

Consultant shall focus on the following:

1. Vulnerability scanning;

2. Validation and Prioritization results.

xi. Vulnerability Scanning. Consultant shall help County Fire and HCC Departments identify known and detectible vulnerabilities present in the external and internal network infrastructure. Vulnerability scanning shall be performed on servers, workstations, web-based applications, and other general devices to provide management with an understanding of County Fire and the HCC Department’s exposure to preventable security flaws.

Consultant shall utilize various automated tools, such as vulnerability scanners to perform the network security review. The tools must be configured not to cause system disruptions or degradation of service.