RFP CIT Cybersecurity Audit Re-Bid

The Coquille Indian Tribe has issued a Request for Proposals (RFP) for a comprehensive Cybersecurity Audit Re-Bid, seeking qualified cybersecurity firms to conduct an extensive security assessment of their IT infrastructure. The procurement targets a thorough evaluation of the tribe's current cybersecurity posture, with specific focus on identifying vulnerabilities and providing actionable recommendations aligned with NIST 800 standards. The scope of work is extensive, encompassing network and system assessments, social engineering testing, policy and governance review, and comprehensive reporting across multiple IT systems including servers, endpoints, network devices, mobile devices, web applications, and cloud platforms. Key deliverables include internal and external penetration testing, phishing campaigns, phone-based and in-person social engineering tests, and detailed technical and executive reports. The RFP was released on September 18, 2025, with proposals due on October 21, 2025, at 2:00 PM PST, and potential vendor interviews scheduled for October 28-29, 2025. The project is slated to commence on December 1, 2025, with draft recommendations due by February 13, 2026, a Tribal Council review in early March 2026, and a final draft submission by March 31, 2026.

The RFP demonstrates a strong preference for Indian Owned Businesses (IOB), with a particular emphasis on working with CIT-owned businesses and qualified Tribal Members. Vendor qualifications are critical, with requirements including extensive experience working with tribal governments and relevant cybersecurity certifications. The tribe has budgeted $100,000 for the audit and subsequent solution implementation. Insurance requirements are comprehensive, mandating various coverage types with specific minimum limits. Contractors will be required to execute a Non-Disclosure Agreement (NDA) prior to commencing work. While no incumbent vendors are explicitly mentioned, the RFP suggests a robust existing IT infrastructure that requires sophisticated cybersecurity assessment and potential remediation. The selection process will likely prioritize vendors demonstrating technical expertise, tribal government experience, and a clear understanding of the unique cybersecurity challenges faced by tribal organizations.