IT Cybersecurity Risk Assessment

The Colorado River Commission of Nevada (CRCNV) is soliciting proposals for a comprehensive IT Cybersecurity Risk Assessment through Solicitation 69CRC-S3063. The procurement seeks a vendor to perform an extensive cybersecurity evaluation of the Commission's information systems, with the primary objective of identifying, evaluating, and prioritizing potential threats and vulnerabilities. The scope of work includes detailed network mapping, penetration and perimeter testing, application vulnerability scanning, user privilege escalation testing, segmentation testing, wireless scanning, and social engineering assessments. Key deliverables include a comprehensive Cybersecurity Risk Assessment Report with an executive summary, detailed assessment results, immediate and long-term remediation recommendations, and a strategic implementation plan. The assessment must align with the National Institute for Standards and Technology (NIST) Cyber Security Framework, covering approximately 85 internal IPs, 1 external IP, and environments including Windows, Mac, Linux, and mobile devices across virtualized and segmented networks. Proposals are due by December 17, 2024 at 2:00 pm PT, with vendor questions accepted until November 18, 2024. The evaluation will be conducted from December 16, 2024, through January 13, 2025, using a 100-point scale weighted across Scope of Work (50 points), contractor experience (35 points), example deliverables (5 points), cost (8 points), and contract redlines (2 points).

The solicitation offers a 5% preference to Nevada-based businesses and applies an inverse preference to vendors from states with in-state preferences not afforded to Nevada vendors. International and Canadian vendors are eligible to bid, with no specific set-aside designations for disadvantaged enterprises mentioned. The CRCNV intends to award a single contract with an estimated four-year term, subject to Board of Examiners approval, with an anticipated contract start date of March 5, 2025. Vendors must maintain comprehensive insurance coverage, including technology errors and omissions, network security, and privacy liability insurance. The project environment includes Microsoft Office 365 cloud services, five applications (three commercial and two in-house web applications), and approximately three IT staff members. While specific budget ranges are not explicitly stated, the solicitation allows for pricing to be submitted as either hourly rates or a package with hourly rates. Vendors are required to provide a minimum of three business references from similar projects performed within the last five years, and all data must be encrypted in transit and at rest, with State data assets maintained within the United States.