Mitre ATT&CK assessment

The South Carolina Department of Revenue (SCDOR) is seeking a comprehensive MITRE ATT&CK Assessment through a Request for Proposal (RFP) issued by the State Fiscal Accountability Authority. The procurement aims to conduct three cybersecurity assessments over a five-year contract period to identify security gaps, evaluate Security Operations Center (SOC) capabilities, and inform security architecture decisions. Key deliverables include developing threat modeling skillsets, creating frameworks to quantify cyber risk, assessing security tool coverage, and providing eight hours of onsite training on MITRE ATT&CK methodology for approximately 20 security team members. Mandatory qualifications require offerors to have successfully completed at least three previous MITRE ATT&CK assessments. The solicitation timeline includes a pre-proposal teleconference on August 10, 2021, at 10:00 AM ET, with vendor questions due by 4:00 PM ET the same day. Proposals are due September 3, 2021, at 11:00 AM ET, with an anticipated award date of October 20, 2021. The evaluation criteria will be weighted as follows: Corporate/Team Experience and Qualifications (40%), Project Plan (35%), and Business Proposal (25%).

The solicitation does not specify any specific set-aside designations or restrictions for disadvantaged enterprises. The SCDOR infrastructure consists of approximately 800 servers running Windows Server and Linux-based systems, with Active Directory installed on-premises in the state datacenter and limited Software as a Service (SaaS) usage restricted to fewer than 20 users. There is no incumbent contractor for this engagement. The assessment will be conducted primarily off-site, with only an initial kickoff meeting and final executive review occurring on-site at 300A Outlet Pointe Boulevard in Columbia, SC. Travel and subsistence expenses will be reimbursable within GSA guidelines, including actual lodging costs and meals not to exceed $35 per day within South Carolina. While no specific budget was disclosed, the contract will span an initial one-year term with four potential one-year renewals, allowing for a maximum contract period of five years. Contractor personnel will be required to complete SCDOR's Non-Disclosure Training and submit necessary forms prior to commencing services, with the State reserving the right to review and reject proposed project team members.