RFP, RFI & Bid Requests

Please select this link for active investment searches.

Invitation To Bid

Information Security Assessment Services

July 16, 2021

The Teachers’ Retirement System of the State of Illinois (the System or TRS) is requesting proposals to provide information security assessment services. The objective of this Request for Proposal is to solicit competitive proposals from qualified vendors in sufficient detail to permit objective evaluation of all proposals which may result in a contract to provide information security assessment services to the Teachers’ Retirement System.

TRS is committed to increasing racial, ethnic, and gender diversity in all aspects of its utilization of vendors to provide goods and services to the System, to the greatest extent feasible, and within the bounds of financial and fiduciary prudence. To that end, the System strongly encourages qualified minority, female, disabled, and veteran-owned vendors to submit proposals to this RFP.

A proposer’s preparation and submittal of a proposal or subsequent participation in presentations or contract negotiations creates no obligation on the System to award a contract or to pay any associated costs. All proposals and related materials will be retained by the System and will be subject to disclosure as required in accordance with the Illinois Freedom of Information Act.

Proposal packets are available below. Proposals must be submitted in writing and delivered to the above address by hand delivery, certified mail, or overnight delivery between 8:30 a.m. and 4:30 p.m. Monday through Friday.  All proposals must be received no later than 2 p.m. CDT on August 4, 2021.  Proposals received after this deadline will not be considered. TRS will publicly open and announce the names of the proposers immediately after the above-specified deadline. TRS reserves the right to reject any and all proposals or to waive any irregularity in the Request for Proposal process.

Questions and Responses

1. External Vulnerability and Penetration Test
   • RFP mentioned "fewer than 45 total systems", what is the total external IP space or ranges?
     TRS has one public subnet that would be included in this external engagement; 12.104.218.0/24
   • Is there a web application hosted on an external interface?
     Yes, TRS has one primary/custom web application hosted on an external interface.
   • Will the testing be performed via authenticated or unauthenticated means?
     TRS expects this to be an unauthenticated test.
   • Is detailed application layer testing (of the web apps) in scope for this engagement?
     No, detail app layer testing is not required.
   • Are detailed configuration reviews in scope for the technologies listed?
     No, detailed configuration review is not required.
      
2. Internal Vulnerability and Penetration Test
   • How many locations in scope?
     Two locations, Springfield, IL and Lisle, IL.
   • Are all locations accessible in the same network?
     Yes, they are both accessible from same network.  Internal testing could occur at Springfield location exclusively, that would allow testing both locations from a central point.  Provisions could be made to allow remote testing to occur, if necessary.
   • How many IPs are active within each location?
     Roughly 550 IPs active across both networks.
   • What operating systems are in use?
     TRS has a mix of Windows OS and Linux.
      
3. Wireless Network Vulnerability and Penetration Test
   • How many physical locations?
     One location.
   • How many SSIDs within each location?
     4 SSIDs.
   • Are guest wireless networks in use?
     Yes, there are guest networks.
   • Can we conduct the onsite wireless testing remotely?
     No, if you chose to bid on the wireless component, it would require onsite.
      
4. Social Engineering
   • How many employees within scope/in the environment?
     TRS has roughly 200 employees. It is understood that not all 200 will be targeted but that is total available to target. Both email and phone calls are available options, allowing for vendor preferred testing method. This would be a one-time engagement/exercise.
   • For the Social Engineering exercise is this intended to be a one time exercise? If not can you specify number of times to execute throughout a year’s engagement?
     This would be a one-time engagement/exercise.
   • For the Social Engineering exercise do you want this administered entirely as a service or would TRS like the capability to manage and initiate an exercise independently?
     Executed as a one-time engagement.
      
5. Periodic External Assessment
   • How many web applications (domains) are in-scope for the periodic external assessment?
     There is one public network space that would be periodically scanned (12.104.218.x/24).  Periodic can be loosely defined based on vendor recommendation (monthly or quarterly at minimum are preferred). Automated tools can be used for periodic vulnerability assessments.

6. Security Gap Analysis
   • Provide a list security technology that is in-scope for the Security Controls Gap Analysis.
     It is the goal of the Security Control Gap Analysis to be a review of the existing technologies, policies and procedures currently implemented within TRS to find gaps that can be prioritized and implemented that will improve the security posture of TRS. We typically do not share that information prior to NDAs and contracts in place, as we prefer that to not be public disclosure.
   • Is TRS using any cyber security framework?
     Yes, TRS currently aligns with the CIS Critical Controls.
   • If the CIS Top 18 framework is selected, which Implementation Group(s) will be tested?
     CIS Implementation group IG1 is expected.
   • How many total policies will be assessed during the analysis?
     TRS expects 10 or fewer policies/procedures to be assessed.

7. Cloud Testing
   • Is there any cloud environments in scope for testing?
     No cloud environments are included in scope for testing.