Answer: No Will the Risk Assessment deliverable(s) be provided for review? Prior to submission of our proposal? What elements of the Risk Assessment were most valuable to ESU #3? What elements of the Risk Assessment were considered least valuable to ESU #3? If a Risk Assessment is to be performed by the selected vendor, is there a preference for a Validated Risk Assessment vs. an Inherent Risk Assessment? Answer: No Please provide an Org chart for the organization that describes the business units that will be considered in-scope Answer: http://www2.esu3.org/esu3/C360/documents/Organizational_Flow_Chart.pdf Does ESU #3 centrally manage all, some, or none of the information systems infrastructure for the departments? Please describe. Firewall(s) Answer: All Wireless Answer: All Email system(s) Answer: All Email filtering system(s) Answer: All Internet/browser proxies Answer: We do not utilize local proxies Centralized authentication/identity management Answer: All Other Please describe the extent to which the information systems for the in-scope departments are interconnected vs. isolated from one another. Answer: All are interconnected Does ESU #3 have a comprehensive list of Internet facing systems? Answer: This information is not available at this time, but may be provided prior to testing If yes, does it include: IP address? Operating system? Key function(s)? Application(s)? If yes, will this list be provided for review prior to testing? Please describe the number of external (Internet) facing network address spaces/subnets, along with the number of IP addresses in each, and approximate number of IPs with live systems. Answer: It is planned to have 40 IP addresses externally scanned. More details will be provided prior to testing Will network diagrams for each of the in-scope department be provided? Prior to submission of the proposal? Answer: Network diagrams may be provided prior to testing. These will not be provided prior to the submission of the proposal. Please describe the number of internal network addresses spaces/subnets
Answer: No Will the Risk Assessment deliverable(s) be provided for review? Prior to submission of our proposal? What elements of the Risk Assessment were most valuable to ESU #3? What elements of the Risk Assessment were considered least valuable to ESU #3? If a Risk Assessment is to be performed by the selected vendor, is there a preference for a Validated Risk Assessment vs. an Inherent Risk Assessment? Answer: No Please provide an Org chart for the organization that describes the business units that will be considered in-scope Answer: http://www2.esu3.org/esu3/C360/documents/Organizational_Flow_Chart.pdf Does ESU #3 centrally manage all, some, or none of the information systems infrastructure for the departments? Please describe. Firewall(s) Answer: All Wireless Answer: All Email system(s) Answer: All Email filtering system(s) Answer: All Internet/browser proxies Answer: We do not utilize local proxies Centralized authentication/identity management Answer: All Other Please describe the extent to which the information systems for the in-scope departments are interconnected vs. isolated from one another. Answer: All are interconnected Does ESU #3 have a comprehensive list of Internet facing systems? Answer: This information is not available at this time, but may be provided prior to testing If yes, does it include: IP address? Operating system? Key function(s)? Application(s)? If yes, will this list be provided for review prior to testing? Please describe the number of external (Internet) facing network address spaces/subnets, along with the number of IP addresses in each, and approximate number of IPs with live systems. Answer: It is planned to have 40 IP addresses externally scanned. More details will be provided prior to testing Will network diagrams for each of the in-scope department be provided? Prior to submission of the proposal? Answer: Network diagrams may be provided prior to testing. These will not be provided prior to the submission of the proposal. Please describe the number of internal network addresses spaces/subnets