Cyber Security Assessments Services

The Vendor is required to provide comprehensive cybersecurity assessment and penetration testing services.
- The objective of these engagements is to identify and validate the City’s cybersecurity risks, including vulnerabilities, misconfigurations, and potential attack paths, through realistic threat-based testing methodologies.
- These assessments are intended to provide a clear understanding of the City’s security posture, including both strengths and areas for improvement, and to support informed decision-making through prioritized, actionable recommendations.
- Provide a purely automated or checklist-based assessment.
- Must demonstrate a methodology that incorporates a high degree of manual testing, analysis, and validation to simulate real-world attack scenarios.
- Automated tools may be used to support the assessment; however, all findings must be reviewed, validated, and contextualized by qualified security professionals.
- External Asset Discovery and Enumeration
•    Identify and enumerate Internet-facing assets associated with the organization, including:
o    Public IP address ranges.
o    Domains and subdomains.
o    Internet accessible City assets.
•    Perform discovery using both:
o    Information provided by the organization.
o    Independent reconnaissance techniques.
•    Identify unknown or unmanaged (“shadow IT”) assets and exposures.
- External Vulnerability Identification and Validation
•    Perform vulnerability scanning and manual validation of external assets.
•    Identify and assess:
o    Known vulnerabilities (CVEs).
o    Misconfigurations.
o    Weak or deprecated encryption protocols and ciphers.
o    Insecure services and exposed administrative interfaces.
•    Validate findings through controlled exploitation where feasible to:
o    Confirm exploitability.
o    Determine real-world impact.
•    Clearly distinguish between:
o    Theoretical vulnerabilities.
o    Successfully validated/exploited findings