Specs - Network Assemt. Testing Specs 3.29.24 bm.pdf
PDF 401 KB Posted
- Solicitation number
- 24-691ISAC-GENCO-B-42439
- Issued by
- Lake County, Illinois
About this file
This document is a Request for Quote (RFQ) from the Illinois Student Assistance Commission (ISAC) for Network Security Assessment and Penetration Testing services. ISAC is seeking a qualified IT vendor/consultant to perform network security assessments, including external and internal network assessments, network architecture and configuration review, firewall security review, IDS/IPS security review, social engineering testing, database security assessment, operating system scanning, and Active Directory review. The vendor is also required to perform external and web application penetration tests, as well as a risk assessment based on the NIST risk management framework. The vendor must have a minimum of 5 years of experience performing information security reviews, including 2 years of IT network security assessment and external penetration testing. The vendor must submit resumes and documentation of previous relevant assignments. The work is expected to be completed within 3-4 weeks, with a target completion date prior to the end of May 2024.
The RFQ specifies the pricing terms, including that quoted prices must be valid for the term of the contract, include shipping and handling, and cannot be increased. ISAC reserves the right to reject any offers, award based on the lowest price, and modify quantities. The vendor must provide all the necessary security tools, as ISAC does not have access to commercial security tools. The vendor is not required to divulge specific client names if non-disclosure agreements prevent it, but should provide the company's general industry and description instead.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Taxpayer ID page.docx | DOCX document | |
| standard-terms-and-conditions~12.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Notes to Vendor: All Quoted prices must be valid for term of contract. All prices must include shipping and handling charges. No price increase will be accepted. In the event of a price decrease, the agency is guaranteed to receive the lowest price. We reserve the right to reject all offers; to reject individual offers for failure to meet any requirement; to award based on lowest price by item, part or portion of an item, group of items, or total; to waive minor defects; and to modify quantities prior to ordering. Vendor may attach separate page describing his proposal for equipment or services.
Illinois Student Assistance Commission
Specs for Network Security Assessment and Penetration Testing
Ref #: GS-2024-251
Submission Deadline: See "Bid Opening Date" in Bidbuy for submission due date AGENCY: Illinois Student Assistance Commission ADDRESS: 1755 Lake Cook Road CITY: Deerfield, IL 60015
CONTACT: Bianca Morales
PHONE: 847-831-6748
EMAIL: Bianca.Morales@illinois.gov
Specifications and Requirements:
The Illinois Student Assistance Commission (ISAC) is seeking a qualified Information Technology vendor /consultant to perform the following Network Security Assessment and Penetration Tests during April, 22 -May 17, 2024. Resume(s) and documentation of IT audit/penetration testing assignments must be attached in BidBuy to bid # 24-691ISAC-GENCO-B-42439.
Network Security Assessment:
• External Network Assessment
• Internal Network Assessment
• Network Architecture and configuration review
• Firewall security review
• IDS/IPS security review
• Social engineering testing
• Database security assessment
• Operating system scanning
• Active directory review
Penetration tests:
• External Penetration tests
• Web application scanning and testing
Risk Assessment:
• Conduct a risk assessment based on National Institute of Standards and Technology (NIST) risk management framework. List of applications will be provided.
The vendor/consultant must have all the following qualifications:
1. A minimum of 5 years of experience performing information security reviews, including at least 2 years performing IT network security assessment and external penetration tests.
2. A Bachelor’s degree (Master’s preferred) in Computer Science and a certification in information systems audits such as Certified Information System Auditor (CISA), Certified Ethical Hacker etc. highly preferred.
Please attach a resume in Bidbuy.
3. Three (3) assignments completed within the past 2 years that include performing the activities listed under
Network Security Assessment and Penetration Tests above.
Submit documentation for each assignment, in Bidbuy, containing the following information*:
- Company name
- Dates of assignment
- A detail description of the responsibilities performed during the assignment, including assessments type and test performed.
mailto:Lisa.Sayers@illinois.gov BMorales Highlight
BMorales Highlight
BMorales Highlight
Illinois Student Assistance Commission
Request for Quote for Network Security Assessment and Penetration Testing, Ref #: GS-2024-251
Notes to Vendor: All Quoted prices must be valid for term of contract. All prices must include shipping and handling charges. No price increase will be accepted. In the event of a price decrease, the agency is guaranteed to receive the lowest price. We reserve the right to reject all offers; to reject individual offers for failure to meet any requirement; to award based on lowest price by item, part or portion of an item, group of items, or total; to waive minor defects; and to modify quantities prior to ordering. Vendor may attach separate page describing his proposal for equipment or services.
- Audit findings identified during the assignment.
- A company contact name, email and telephone number.
* If non-disclosure agreements do not allow for divulging specific client information/name, please provide the company’s general industry and description in lieu of the specific name.
Question & Answer
1) What is the location for this project? Can the work be done remotely?
Our main office is in Deerfield. The person does not have to be here for the entire duration. A significant portion of the work can be done remotely (access can be provided thru VPN if required and approved). Some on-site work with the ISAC team may be needed to discuss network topography and discovery.
2) What is the specific environment/needs for the assessment/testing?
Environments to be Penetration tested – All public facing transaction processing platforms (web based). Examples are GAP Access (https://isacportal.isac.org), Student Portal (https://studentportal.isac.orgt) , , www.isac.org and more.
a) How many end points?
VM’s - 135 VM’s in DMZ – 10 Desktops/Laptops – 275 Web Domains – 58 (mostly static) Web transaction processing domains (all HTTPS) – 8
b) External Network Assessment – number of external IPv4/IPv6 addresses that would need to be tested/scanned?
IPv4 only – Range includes 128 IP’s
c) Internal Network Assessment – number of internal IPv4/IPv6 addresses that would need to be tested/scanned?
IPv4/IPv6 (enabled by default) - 500
d) How many servers are in the network? Physical servers - 17
e) Who is the network vendor and what applications are in the landscape of this request?
CISCO is the network equipment vendor.
The applications include mainframe, client/server and web applications.
f) Network Architecture and configuration review - Can we get details about Network Infrastructure?
Number of locations - 3 Number of devices - 21 Make/model of each device - CISCO
g) Firewall security review – how many firewall and model?
Number of firewalls - 5 Make/model – CISCO
h) IDS/IPS architecture and configuration review – make/model, number of sensors, instances, events per second?
Make/model of IPS’s - CISCO Number sensors - 2 Number instances 1 Number of events per second -Plan per the configuration specified above.
i) Social Engineering Testing – How many users use agency phone or email?
Number of users that use agency Phone - 275 Number of users that use agency Email - 325
j) Database Security Assessment – Is this centered on Data Discovery or DB Architecture/Connectivity Security?
Centered on Both http://www.isac.org/gap-access https://studentportal.isac.orgt/ http://www.isac.org/
Illinois Student Assistance Commission
Request for Quote for Network Security Assessment and Penetration Testing, Ref #: GS-2024-251
Notes to Vendor: All Quoted prices must be valid for term of contract. All prices must include shipping and handling charges. No price increase will be accepted. In the event of a price decrease, the agency is guaranteed to receive the lowest price. We reserve the right to reject all offers; to reject individual offers for failure to meet any requirement; to award based on lowest price by item, part or portion of an item, group of items, or total; to waive minor defects; and to modify quantities prior to ordering. Vendor may attach separate page describing his proposal for equipment or services.
Question & Answer What is the type/size of databases? DB2, IMS, SQL server, MySQL (size varies)
k) Operating system scanning – for Vulnerability scanning, please provide details on the number of Internal IPs.
See question and answer 2 c, above.
l) AD Domain Review – how many domains, OUs, Users, Groups?
Domains - 1 OUs - 15 Users - 500 Groups - 3000
m) Penetration tests – how many web applications?
External - 15
n) Is code review required? On a very small sample set. If this is going to be manual, it can be excluded.
o) Is a scan and manual vulnerability identification sufficient or do you require manual verification/exploitation of vulnerabilities?
A scan and manual vulnerability identification are sufficient.
3) Does ISAC have access to commercial security tools (such as IBM AppScan) or will the vendor be expected to provide all tools as part of the service?
The vendor must provide the security tools.
4) Most penetration testers are constrained by non-disclosure agreements from divulging specific client names, although they can provide general industry and company description is that sufficient?
If specific client information/name cannot be disclosed, then please provide the company’s general industry and description in lieu of the specific name.
5) The areas you outline for scope are pretty broad and would likely involve more than one resource for the engagement. What number of consultants are you looking for?
We did not have a specific number, but you may need one or more resources to complete the assignment.
6) How many resumes can we submit? The number of resumes should be equal to the number of consultants assigned to complete the project.
7) What is the duration of the project?
a) Is this expected to be a 3- or 6-month contract, as the size of the network is not indicated?
b) Is this a full or part time position? Are the hours flexible?
c) When is the expected start date?
It is expected to take approximately 3-4 weeks to complete the project. This is not a full or part time position; it is a contract for completion of the Network Security Assessment and External Penetration Testing. The expected start date is such that the Assessment and Testing Results Report can be completed prior to end of May, 2024.
8) Is a range acceptable for an estimate (to be refined through scope clarification and discovery)?
No, as the scope has been clarified, an actual hourly rate and an estimated number of hours are required.
9) Is the attached document the only file that needs to be prepared?
The hourly rate estimated number of hours and the documentation requested in the Specifications and Requirements is all that needs to be submitted.
File details come from the government source that posted it. Updated .