be completed outside of normal business hours, 6:00PM to 7:00AM.(or as directed by the agency) Scan activity must be coordinated with the ESRMO prior to it being initiated. Conduct penetration testing for publicly accessible systems when initial vulnerability scanning identifies potential high impact vulnerabilities. AGENCY and the Vendor together will select the systems for penetration testing during the security assessment engagement. In the event penetration testing gains access to a system, the testing should assess the ability of the attacker to leverage the system for access to additional systems and networks. Conduct web application testing based on the current OWASP top 10 listing. There are approximately xx web servers. An inventory of all applications, data storage devices and systems, and identification and authentication measures. An inventory of all agency hardware and its operating systems and network management systems. The existing network infrastructure and configuration, including all interconnectivity and supported protocols and network services offered. Publicly-available information and data accessible via agency Web sites. The vendor shall perform a security Assessment against approximately xx web sites that are part of a software as a service deployment with ___________________. Gaps in IT security governance - Review and make recommendations on AGENCY incident management plan. Current vulnerabilities - Review current vulnerability and patching process. Specifics to be supplied to vendor at start of engagement. Make recommendations on best practices to better secure the state. Existing security systems and components, including antivirus, firewalls, and network monitoring. Vendor shall assess current network security capabilities and their ability to identify and potentially stop cyber-attacks, data loss, and misuse of IT resources. These network security resources include firewalls, Intrusion Prevention Systems and end point security applications. Proposal Materials to be Submitted At a minimum, the Proposal shall include the following items in this specific order and Vendor’s clearly marked as such: A description of the to the assessment so the desired results can be Vendor’s approach achieved, including how they will run their on-site kick-off meeting which will be held in CITY in an AGENCY conference room at a mutually agreed upon date between AGENCY and the awarded Vendor. Resumes of all personnel assigned to perform the assessment. The Vendor shall include the qualifications of the personnel and explain why this is a good match. A resume shall not exceed three pages in length.
be completed outside of normal business hours, 6:00PM to 7:00AM.(or as directed by the agency) Scan activity must be coordinated with the ESRMO prior to it being initiated. Conduct penetration testing for publicly accessible systems when initial vulnerability scanning identifies potential high impact vulnerabilities. AGENCY and the Vendor together will select the systems for penetration testing during the security assessment engagement. In the event penetration testing gains access to a system, the testing should assess the ability of the attacker to leverage the system for access to additional systems and networks. Conduct web application testing based on the current OWASP top 10 listing. There are approximately xx web servers. An inventory of all applications, data storage devices and systems, and identification and authentication measures. An inventory of all agency hardware and its operating systems and network management systems. The existing network infrastructure and configuration, including all interconnectivity and supported protocols and network services offered. Publicly-available information and data accessible via agency Web sites. The vendor shall perform a security Assessment against approximately xx web sites that are part of a software as a service deployment with ___________________. Gaps in IT security governance - Review and make recommendations on AGENCY incident management plan. Current vulnerabilities - Review current vulnerability and patching process. Specifics to be supplied to vendor at start of engagement. Make recommendations on best practices to better secure the state. Existing security systems and components, including antivirus, firewalls, and network monitoring. Vendor shall assess current network security capabilities and their ability to identify and potentially stop cyber-attacks, data loss, and misuse of IT resources. These network security resources include firewalls, Intrusion Prevention Systems and end point security applications. Proposal Materials to be Submitted At a minimum, the Vendor’s Proposal shall include the following items in this specific order and clearly marked as such: A description of the Vendor’s approach to the assessment so the desired results can be achieved, including how they will run their on-site kick-off meeting which will be held in CITY in an AGENCY conference room at a mutually agreed upon date between AGENCY and the awarded Vendor. Resumes of all personnel assigned to perform the assessment. The Vendor shall include the qualifications of the personnel and explain why this is a good match. A resume shall not exceed three pages in length.