How To Write A Pnetration Testing Rfp

REQUEST FOR SUBMITTAL OF PROPOSALS

FOR

PENETRATION TESTING SERVICES

FOR

BOONE COUNTY FAMILY RESOURCES

IN COLUMBIA, MISSOURI

SEPTEMBER 22, 2014

SUBMISSION DEADLINE

INDEX OF RFP DOCUMENTS

For

PENETRATION TESTING SERVICES

TABLE OF CONTENTS

Invitation for Submittal of Bids Page 3

General Requirements Page 4

Bid Form Proposal Page 7

General Background Page 8

Specifications & Requirements Page 8

Required Information Page 8

Evaluation Page 10

Signature and Identity of Respondent Page 11

Statement of Respondent’s Qualifications Page 12

Respondent’s Acknowledgement Page 13

Anti-Collusion Statement Page 14

INVITATION FOR

SUBMITTAL OF PROPOSALS

Sealed proposals will be received by Boone County Family Resources, at 1209 East Walnut Street, Columbia,

MO. 65201, on October 17, 2014 until 3:00 p.m. (Central Time) for the RFP described herein. Proposals will be opened publicly and read aloud at the Boone County Family Resources offices at 3:00 p.m. Bids received after said time will be returned unopened.

Project Title: PENETRATION TESTING RFP

Project Summary: The successful Respondent will prove through its response that it possesses the qualifications

necessary to implement a plan for the assessment, analysis, and evaluation of the security and vulnerability of the Agency’s IT system. The selected Respondent will be responsible for testing the described systems and reporting to the Agency on its vulnerabilities, weaknesses, strengths, and recommend improvements to strengthen the security of the systems as detailed in the scope of work. Work is to be completed by November 21, 2014. Owner intends to issue a Notice to Proceed on or before October 31, 2014.

The RFP package and documents are available from Boone County Family Resources, 1209 E. Walnut, Columbia, Missouri 65201 beginning September 22, 2014.

Contract completion date: Friday, November 21, 2014

Contact Person: If you have questions, or if you wish to be notified of changes or amendments to this RFP,

please contact Michael Gibson, Information Systems Director, 1209 E. Walnut, Columbia, MO 65201, 573-874-1995, extension 212 or [email protected].

All responses must be signed and dated; if a joint venture is submitting the proposal, each joint vendor must sign the proposal. BCFR reserves the right to reject any or all Proposals and to waive any informalities in the best interest of the Agency. No Proposal may be withdrawn for a period of forty-five (45) days subsequent to the specified time for receipt of Proposals.

The RFP will remain open for the period specified, must be independently arrived at, and be prepared in accordance with the instructions to Bidders.

GENERAL REQUIREMENTS

Boone County Family Resources, hereinafter “BCFR or Agency,” is seeking proposals from qualified information technology entities to perform testing to assess, analyze and evaluate the security of the Agency’s information systems and to make recommendations for improvements to the IT environment.

1.2 Schedule of Activities

BCFR plans to follow the schedule provided below in the processing of this RFP. It should be noted that the dates listed are estimated and may be changed based on the needs of BCFR. Changes in dates will be issued via an addendum to this solicitation.

Availability of RFP Package Monday, September 22, 2014 Deadline for Submission of Questions or Monday, September 29, 2014 Requests for Additional Information

Issuance of Response to Questions (Addendum) Friday, October 3, 2014 Or Requests for Additional Information

Proposal Due Date and Time Friday, October 17, 2014; 3:00 p.m. CDT

1.3 Due Dates for Proposals

The Solicitation of Proposals will be available online athttp://www.bcfr.org/bid-solicitations/, or may be picked up at 1209 E. Walnut, Columbia MO between 8:00 a.m. and 5:00 p.m. Monday through Friday beginning

September 22, 2014. Proposals may be submitted in a sealed envelope to Boone County Family Resources, at 1209 East Walnut Street, Columbia, MO 65201, until Friday, October 17, 2014 at 3:00 p.m. (Central Time) for the Request for Proposals (RFP) described herein. Fax or email responses will not be accepted. Responses received after said time will be returned unopened. An original and two copies of the proposal shall be submitted and should be clearly marked on the envelope “Penetration Testing RFP.”

1.4 Questions/Clarifications of the RFP

All questions concerning the solicitation and specifications shall be submitted in writing by email or fax to: Michael Gibson, Information Systems Director

573-874-1995 extension 212 phone 573-443-2864 fax

[email protected].

Any oral responses shall be unofficial and nonbinding on the Agency. An addendum to this RFP providing the Agency’s official response shall be issued and posted online if necessary to all known potential respondents.

1.5 Validity of Proposals

Responses shall be firm for acceptance a minimum of (45) forty-five days from the date responses are due.

1.6 Rejection of Proposals

BCFR reserves the right to cancel this RFP or to reject in whole or in part, any and all proposals received in response to this Request for Proposals, upon its documentation that cancellation or rejection is in the best interest of BCFR. No contractual right shall arise out of this process of negotiation until such time as BCFR and the selected Respondent have signed an Agreement.

1.7 Modification/Withdrawal of Proposals

1.8 Response Material Ownership

All material submitted in response to this RFP becomes the property of the Agency. Any person may review proposals after the “Notice of Intent to Award Letter” has been issued.

1.9 Anti-Collusion Clause

Any agreement or collusion among Respondents to illegally restrain competition to fix prices or otherwise will render the proposals of such Respondents void.

1.10 Tax Exemption

The Agency is funded by public funds and has been approved by the State of Missouri for sales/use tax exempt status. Upon request, the Agency will issue a Project Exemption Certificate and Missouri taxpayer identification number to the successful Respondent. No sales tax may be charged to Agency for any work performed in connection with this Award.

1.11 Applicable Law

The laws of the State of Missouri and applicable federal law shall govern this agreement. Any litigation related to this agreement shall take place in the courts of the State of Missouri.

1.12 Contract Documents

The final contract between BCFR and the Respondent will include by reference Respondent’s Proposal and the Specifications contained in this RFP. Any changes, additions, or modifications hereto will be in writing.

1.13 Assignment

The successful Respondent shall not assign, subcontract, or transfer any interest in the agreement without prior written approval of BCFR.

1.14 Responsibility

BCFR reserves the right to require the apparent successful Respondent to file proof of ability to perform the contract, together with its record of successful completion in the analysis and testing of systems of a similar type, scale, complexity and status. The award of this contract will be contingent upon the providing of proof and record of performance.

1.15 Termination for Default

If, through any cause, the Firm shall fail to fulfill, in a timely and appropriate manner, its obligation under the Contract, or if the Firm shall violate any conditions of the Contract, BCFR shall have the right to terminate this Contract for cause by giving written notice of its intent to terminate and giving not less than five (5) days to cure the default. Notwithstanding the above, BCFR shall be entitled to damages for any breach by the Firm.

1.16 Nondiscrimination in Employment

In connection with the furnishing of supplies or performance of work under this contract, Contractor agrees to comply with the Fair Labor Standards Act, Fair Employment Practices, Equal Opportunity Employment Act, and all other applicable federal and state laws and further agrees to insert the foregoing requirements in any subcontract awarded hereunder.

1.17 Insurance Requirements

Contractor’s Insurance Requirements: The Contractor shall not commence work under this contract until it has

Commercial General Liability Insurance: The Contractor shall take out and maintain during the life of this

contract, such comprehensive general liability insurance as shall protect them and any subcontractor performing work covered by this contract, from claims for damages for personal injury including accidental death, as well as from claims for property damages, which may arise from operations under this contract, whether such operations be by themselves or for any subcontractor or by anyone directly or indirectly employed by them. The amounts of insurance shall be not less than $1,000,000.00 combined single limit for any one occurrence covering both bodily injury and property damage, including accidental death. If the Contract involves any underground/digging operations, the general liability certificate shall include X, C, and U (Explosion, Collapse, and Underground) coverage. If providing Comprehensive General Liability Insurance, then the Proof of Coverage of Insurance shall also be included.

Proof of Carriage of Insurance: The Contractor shall furnish the Agency with Certificate(s) of Insurance which

name Boone County Family Resources as additional insured in an amount as required in this contract, contain a description of the project or work to be performed, and requiring a thirty (30) day mandatory cancellation notice. In addition, such insurance shall be on occurrence basis and shall remain in effect until such time as the Agency has made final acceptance of the contracted project.

Hold Harmless Agreement: To the fullest extent permitted by law, Contractor shall indemnify, hold harmless and

BID FORM PROPOSAL

Boone County Family Resources 1209 East Walnut

Columbia, Missouri 65201

For: PENETRATION TESTING

The undersigned as Bidder represents and warrants that Bidder has examined all Specifications and all other

proposed Contract Documents as well as all other factors and conditions affecting or which may be affected by the work and hereby submits this Bid at the prices stated below. These prices are to cover all expenses incurred in performing the work required under the Contract Documents. The prices stated herein are firm and exclude Missouri Sales and Use Tax.

Bidder understands that the Owner reserves the right to reject any or all bids and to waive any informalities in the bidding and to accept such proposal as it deems in its best interest.

Bidder agrees to hold open the Bid for forty five (45) days from the date shown above.

Bidder agrees to accept and accomplish the Work in accordance with the Bid Documents, including the Specifications and any Addenda issued, receipt of which is hereby acknowledged.

Addendum #_______________________ Date______________________________

Bidder agrees to enter into and execute an Agreement, if notified of acceptance of this Bid, on the basis of this Bid and to furnish required Bonds, if any, and to complete the Work by November 21, 2014. The Contractor further agrees that, should he fail to complete work in the time specified or such additional time as may be allowed by the Owner under this Contract, he shall allow a deduction of $100.00 dollars per day from the final payment as liquidated damages for each day that completion is delayed beyond the specified completion date.

To perform the required work for the lump sum price of: $____________________________________.

Firm Name: By:

(Signature)

(Print or Type Name) Title:

Address:

City, State, Zip: Phone:

GENERAL BACKGROUND

Boone County Family Resources (BCFR) is a statutorily created entity, governed by a nine member board of directors, providing services to persons with developmental disabilities, including residential services, in Columbia, MO. BCFR is a covered entity as defined by HIPAA, with thirty (30) IP addresses.

SPECIFICATIONS AND REQUIREMENTS

This security assessment covers the remote penetration testing of BCFR servers and IP addresses. This assessment is to be carried out from a black box perspective, with the only supplied information being IP addresses. This security assessment is being conducted to gauge the security posture of BCFR’s Internet facing systems. The result of the assessment is to be analyzed for vulnerabilities. Any computers or devices found will be scanned for

vulnerabilities using a variety of tools and techniques. The tools and techniques used will be consistent with current industry standards regarding exploitation of vulnerabilities. The scope shall include the following: 1) testing of identified IP addresses to attempt to gain access: 2) performance of broad scans to identify potential areas of exposure and services that may act as entry points; 3) identification of vulnerabilities; 4) performance of targeted scans and manual investigation to validate vulnerabilities; 5) identification of issues of immediate consequence and recommended solutions; and 6) ranking of vulnerabilities based upon threat level, loss potential and likelihood of exploitation.

3.2 Responsibilities

This security assessment will include a report of penetration attempts, an external port scan, and a vulnerability assessment of the reachable servers and devices of BCFR. The report will include methodology used, detailed findings, and will document and record each step of the process. The report will include any data obtained from the network, and any information regarding exploitation of found vulnerabilities in the attempt to gain access to

sensitive data. Social engineering and physical security control testing are not included in this scope of work. The report distribution will be in hard copy and delivered by hand or via priority mail to Michael Gibson,

Information Systems Director. Contractor will conduct a post-testing conference call with BCFR staff to review and clarify findings and recommendations.

When the report has been generated and the testing complete, the tester will permanently delete all soft data documenting the test, access, and any vulnerability and shred any hard copy data. The test results and report will remain confidential and not be used by the Contractor for any other purpose than that stated in this scope of work.

3.3 Timeline

Tests are to be conducted outside of normal business hours (8-5 M-F). The start and end dates of the test must be specified. The period of the test is not to exceed 10 days.

REQUIRED INFORMATION

SUBMISSION DEADLINE: October 17, 2014 @ 3:00 p.m. Facsimile and electronic mail responses will not

Michael Gibson, Information Systems Director

Attn: “SECURITY PENETRATION TESTING” Boone County Family Resources

1209 E. Walnut Columbia, MO 65201

BCFR will not make the respondent’s submissions public until such time as an award is made. All submissions will become the property of BCFR and shall be retained by BCFR.

4.2 Required Documents

Each Respondent shall complete the following forms: 1) Bid Form Proposal; 2) Signature and Identity of Respondent; 3) Statement of Respondent’s Qualifications; 4) Respondent’s Acknowledgment; 5) Bid Form Proposal; 6) Work Authorization Certification and 7) Anti-Collusion Statement.

 Respondents’ Experience: Provide information on up to three (3) covered entities of similar size if possible in which the respondent has conducted similar testing. Provide three references including the entity’s name and mailing address as well as the contact person’s name, email address and telephone number for the projects described in response.

 The Required Forms, attached to the RFP, must be signed and submitted as the Respondent’s formal Submittal.

 The Required Forms shall be completed in full and in strict conformance with the documents contained in or referred to in the Documents.

 Each Response must show the full legal name and business address of the Respondent, including its street address if it differs from the mailing address.

 Each Response must be complete and free from ambiguity and signed by an individual authorized to bind the Respondentand if submitted by a partnership or joint venture, a list showing the full names and addresses of all partners or joint ventures must be provided.

 Any interlineation, alteration or erasure must be initialed by the signer of the Response.

4.3 Respondent’s Representations

Each Respondent by submitting a Response represents and warrants that:

 Respondent has read and understands the Documents.

 Respondent assumes ultimate responsibility for ensuring that he has obtained all documents and that all documents are complete.

 Respondent certifies that Respondent and each of its principals are not suspended or debarred from contracting with the federal government.

 Respondent warrants that to the best of its knowledge and belief, it has no organizational conflict of interest such that Respondent has an unfair competitive advantage or that its objectivity in performing the work may be impaired.

 The successful Respondent shall obtain all required permits and licenses for performance of the work.

 The successful Respondent shall provide reports as required by BCFR to comply with applicable federal, state and local laws and regulations.

4.4 Question or Clarifications

If a prospective Respondent discovers discrepancies, errors or omissions in the Documents or is in doubt as to the true meaning of any part of the Documents, the Respondent should immediately contact the Owner’s

Respondents may submit questions for clarification or interpretation of the Documents by making a written request to Owneron or before Monday, September 29, 2014.

Any interpretation, clarification or change in the Documents will be made by Addendum and will be made available to all Respondents. Any interpretations, clarifications, or changes made in any other manner will not be binding and Respondents shall not rely on such. Any addenda issued during the time of bidding are to be covered in the proposal, and in closing a contract they will become a part thereof.

S

IMATED DATE

EVALUATION

 BCFR shall have the right to reject any or all Responses, to reject a Response not accompanied by data required by the Documents, or to reject a Response which is in any way incomplete or irregular and to re-advertise the work at a later date if all Responses are rejected.

 BCFR may make any investigation of a Respondent as it deems necessary to determine the ability of a Respondent to perform the work. The Owner reserves the right to reject any Response if the evidence submitted by, or other investigation of, the Respondent fails to satisfy BCFR that the Respondent is qualified to perform the work.

 BCFR reserves the right to waive any informality or irregularity, or the failure of any Respondent to comply therewith, if it is in its interest to do so.

 BCFR will notify the Respondent if it objects to any such persons or entities proposed to furnish and perform the work. If BCFR objects to any such proposed person or entity, the Respondent may, at his option, withdraw his Response or submit an acceptable substitute person or entity.

 It is the intent of BCFR to award the Contract to the most qualified Respondent; however, BCFR reserves the right to accept the Response which, in its judgment, is in the best interest of and most advantageous to BCFR.

 BCFR will reject the qualifications of any Respondent suspended and/or debarred by HUD from providing services to public housing authorities and reserves the right to reject the proposal of any Respondent who has previously failed to perform any contract.

 A preference will be given to all firms, corporations, or individuals doing business as Missouri firms, corporations, or individuals, or which maintain Missouri offices or places of business, when the quality of performance promised is equal or better and the price quoted is the same or less.

5.2 Evaluation

Each Response will be evaluated by member(s) of an evaluation team comprisedof Agency staff. Factors to be considered in evaluation of the Responses will include, but are not limited to:

1. Pricing and

2. Quality of references.

5.3 Selection of Contractor

SIGNATURE AND IDENTITY OF RESPONDENT

The undersigned states that the correct LEGAL NAME and ADDRESS of (1) the individual Respondent, (2) each partner or joint venture (whether individuals or corporations, and whether doing business under fictitious name), or (3) the corporation (with the state in which it is incorporated) are shown below; that (if not signing with the intention of binding himself to become the responsible and sole Contractor) he is the agent of, and duly authorized in writing to sign for the Respondent or Respondents; and that he is signing and executing this (as indicated in the proper spaces below) as the proposal of a:

( ) sole individual ( ) partnership ( ) joint venture ( ) corporation, incorporated under laws of the state of

Dated , 20

Name of individual, all partners, or joint

venturers: Address of each:

doing business under the name of:

Address of principal place of business in Missouri:

(If using a fictitious name, show this name above in addition to legal names.)

(If a corporation - show its name above) ATTEST:

(Secretary) (Title)

STATEMENT OF RESPONDENT’S QUALIFICATIONS

Each Respondent shall submit with its Response the data requested in the following schedule of information. Failure to comply with this instruction may be regarded as justification for rejecting the Response.

1. Name of Bidder: 2. Business Address: 3. When Organized: 4. When Incorporated:

5. If not incorporated, state type of business and provide your federal tax identification number:

6. Number of years engaged in contracting business under present firm name:

7. If you have done business under a different name, please give name and location:

8. Percent of work done by own staff:

9. Have you ever failed to complete any work awarded to your company? If so, where and why?:

10. Have you ever defaulted on a contract?

11. List of contracts completed within the last four years, including value of each:

12. List of projects currently in progress:

* Attach additional sheets as necessary *

The undersigned hereby authorizes and requests any person, firm or corporation to furnish any information requested by the Owner to verify the recitals comprising this Statement of Bidder’s Qualifications.

Name of Bidder: Date:

RESPONDENT’S ACKNOWLEDGMENT

(Complete and fill out all parts applicable, and strike out all parts not applicable.)

State of County of

On this day of , 20

before me appeared to me personally known, who,

being by me first duly sworn, did say that he executed the foregoing Bid with full knowledge and understanding of all its terms and provisions; that the correct legal name and address of the Bidder(including those of all partners of joint ventures if fully and correctly set out above; that all statements made therein by or for the Respondent are true; and

(if a sole individual) acknowledged that he executed the same as his free act and deed.

(if a partnership or joint venture) acknowledged that his executed same, with written authority from, and as the free act and deed of, all said partners or joint ventures.

(if a corporation) that he is the

President or other agent

of ; that the above Bid was signed and sealed

on behalf of said corporation by authority of its board of directors; and he acknowledged said proposal to be the free act and deed of said corporation.

Witness my hand and seal at , the day and year first above written. Notary Public

ANTI-COLLUSION STATEMENT

STATE OF ________________) ) ss COUNTY OF ______________)

_________________________________________________, being first duly sworn, deposes and states: That in connection with this Request for Bids:

1. All statements made and facts set out in the Bid for the above project are true and correct;

2. The Bidder (person, firm, association, or corporation making said Bid) has not, either directly or indirectly, entered into any agreement, participated in any collusion, or otherwise taken any action in restraint of free competition in connection with said Bid or any contract which may result from its acceptance.

3. Bidder is not financially interested in, or financially affiliated with, any other Respondent for the above project.

The undersigned further states that:

1. He/she is the person in the Bidder’s organization responsible within that organization for the responses herein and that he/she has not participated and will not participate in any action contrary to the statements set forth above; OR

2. He/she is not the person in the Bidder’s organization responsible for the decision as to the Bids herein but that he/she has been authorized in writing to act as agent for the person responsible for such decision in certifying that such persons have not participated and will not participate in any action contrary to the above statements.

It is expressly understood that the foregoing statements and representations are made as a condition to the right of the Bidder to contract under any award made hereunder.

Name of Firm: __________________________________________________________________________

Signature and Title of Bidder

_________________________________________________________________

_________________________________________________________________

1209EASTWALNUT,COLUMBIAMO65201 Robyn Kaufman, Executive Director

573-874-1995 TEL | 573-443-2864 FAX | 573-443-2841 TDD

WWW.BCFR.ORG

INSTRUCTIONS FOR COMPLIANCE WITH VERIFICATION OF EMPLOYMENT ELIGIBILITY

Missouri law requires that Boone County Family Resources (BCFR) verify that a contractor of the agency has a program to verify the lawful presence of its employees when the contract exceeds $5,000, and to verify the lawful presence in the U.S. of individuals when contracting for work/services. BCFR is required to obtain a sworn affidavit and documentation affirming the contractor’s enrollment and participation in a federal work authorization program. To obtain additional information on the Department of Homeland Security's E-Verify program, go to:

http://www.uscis.gov/e-verify

If you are a business entity as defined in Section 285.525 RSMo, please complete and return form Affidavit of

Participation in Work Authorization Program and Verification of Employment Eligibility Pursuant to 285.530 RSMo if your contract amount is in excess of $5,000.

If you are a self-employed individual with no employees, please complete Certification of Individual

AFFIDAVIT OF PARTICIPATION IN WORK AUTHORIZATION PROGRAM AND VERIFICATION OF EMPLOYMENT ELIGIBILITY

PURSUANT TO 285.530.2 RSMo

(FOR CONTRACTS IN EXCESS OF $5,000.00)

County of )

)ss

State of )

Now on this day of , 20 the undersigned, being first duly sworn, hereby makes the following statements under oath:

 I am more than 18 years of age.

 I make this Affidavit from my personal knowledge of the facts stated herein or upon information and facts available to me as a duly authorized owner, partner, corporate of LLC office or Human Relations Director of

(name of corporation, LLC, sole proprietorship or partnership).

 I state and affirm that (name of

business entity, same as above) is enrolled and participates in E-Verify, a federal work authorization program or another equivalent electronic verification or work authorization program operated by the U.S. Department of Homeland Security for all employees working in conjunction with the contracted services provided to Boone County Family Resources.

 Further, (name of

business entity, same as above) does not knowingly employ any person that is an unauthorized alien in conjunction with the contracted services.

 Any and all subcontractors working on this contract shall be required to provide a similar affidavit to the contractor or subcontractor at the time the subcontractor is hired. The term “subcontractor” does not include a business entity that merely supplies good or materials to a contractor or subcontractor hired by the contractor to perform services to perform a contract with Boone County Family Resources.

I certify under penalty of perjury that the statements above are complete, true and accurate to the best of my knowledge and belief.

Authorized Agent, Partner, Owner, Officer or Date Human Relations Director

Printed Name

Subscribed and sworn to before me this day of , 20 . _________________________________________ My commission expires:

Notary Public

CERTIFICATION OF INDIVIDUAL BIDDER/CONTRACTOR

Pursuant to Section 208.009 RSMo, any person applying for or receiving any contract for services who is over 18 must verify their lawful presence in the United States. Please indicate compliance below.

1. I have provided a copy of documents showing citizenship or lawful presence in the United States. (Such proof may be a Missouri driver’s license, U.S. passport, birth certificate, or immigration documents.)

2. I do not have the above documents, but provide an affidavit (below) that may allow for temporary 90 day qualification. (If this option is chosen, you must complete the Affidavit below.)

3. I have provided a completed application for a birth certificate pending in the State of __________________. Qualification shall terminate upon receipt of the birth certificate or determination that a birth certificate does not exist because I am not a United States citizen.

Applicant Date Printed Name

AFFIDAVIT

State of Missouri ) SS County of ____________ )

I, the undersigned, being at least eighteen years of age, swear upon my oath that I am either a United States citizen or am classified by the United States government as being lawfully admitted for permanent residence.

Signature Print Name

Social Security Number or Other Federal ID Number Date

On the date above written, ________________________ appeared before me and swore that the facts contained in the foregoing affidavit are true according to his/her best knowledge, information and belief.

_________________________________________ My Commission expires: ______________. Notary Public