The State Entity is seeking proposals from qualified cybersecurity firms to conduct a comprehensive security audit of its information systems, applications, and network infrastructure. This audit is a critical component of the State Entity’s efforts to enhance its cybersecurity posture and align with the goals outlined in the Statewide Cybersecurity Strategic Plan.

Scope of Work
The successful vendor will be responsible for the following tasks:

a. Conduct a thorough assessment of the State Entity’s current cybersecurity practices, policies, and procedures.
b. Identify potential vulnerabilities and threats to the State Entity’s information systems, applications, and network infrastructure.
c. Perform penetration testing and ethical hacking exercises to evaluate the effectiveness of existing security controls.
d. Assess the State Entity’s compliance with relevant cybersecurity standards and best practices, including the NIST Cybersecurity Framework.
e. Evaluate the State Entity’s ability to detect, respond to, and recover from cybersecurity incidents.
f. Review the State Entity’s continuity of operations and disaster recovery plans related to cybersecurity incidents.
g. Provide a detailed report outlining the findings of the audit, including prioritized recommendations for mitigating identified risks and vulnerabilities.
h.Develop a roadmap for implementing the recommendations, including timelines and resource requirements.

Proposal Requirements
Interested vendors should submit a concise detailed proposal that includes the following:
1. The cover sheet contained herein shall be completed and submitted with the proposal.
2. Company profile, including relevant experience in conducting security audits for government agencies.
3. Proposed methodology and approach to conducting the security audit.
4. Project timeline and key milestones.
5. Qualifications and experience of the project team members.
6. Detailed cost proposal, including hourly rates and any additional expenses.
7. References from previous clients for similar projects.
8. Compliance with relevant industry certifications and standards.