IT General Controls and Cybersecurity Audit RFP

City Colleges of Chicago is requesting proposals for internal audit assurance services evaluating IT General Controls and cybersecurity governance across its seven-college district under RFP NC2615-ITGC and Cybersecurity Audit, with proposals due July 17, 2026 at noon Central Time. The RFP carries MBE and WBE participation goals of 25% and 7%, respectively; proposers must actively engage certified minority and women-owned firms in substantive roles aligned with audit deliverables, and responses lacking sufficient participation or an approved waiver will be deemed non-responsive.

The engagement encompasses evaluation of IT governance, access management, change management, IT operations, and interface controls using the COBIT 2019 framework; cybersecurity governance, risk management, and resilience using the NIST Cybersecurity Framework; and penetration testing aligned to PTES or NIST SP 800-115 methodologies. Deliverables include audit workplan, fieldwork documentation, draft and final internal audit reports suitable for board reporting, and periodic status updates. The scope includes risk-based audit planning, design and operating effectiveness testing, and scoped penetration testing with external perimeter testing and limited internal validation of two critical applications.

Proposers must demonstrate experience performing internal audit assurance engagements under Global Internal Audit Standards; substantive experience auditing IT General Controls using COBIT 2019; experience assessing cybersecurity using NIST CSF; prior IT and cybersecurity internal audit experience in higher education environments; and ability to maintain independence and objectivity. Professional liability insurance of not less than $5 million, cyber liability coverage of $5 million, commercial liability of $5 million, and workers' compensation insurance are required. Contractors must comply with Chicago Mayoral Executive Order 2014-1 regarding minimum wage and Illinois Prevailing Wage Act requirements if applicable.

The contract term is twelve months or until completion, beginning upon execution of the professional service agreement and issuance of a purchase order. No total contract value is specified. The pre-proposal conference is June 23, 2026 at 11:00 a.m. via Zoom. Questions are due June 26, 2026 by noon Central Time. Intent to submit is due July 15, 2026 by noon Central Time.