Municipal Cybersecurity Assessment Services

The Vendor is required municipal cybersecurity assessment services to conduct a discrete, one-time comprehensive cybersecurity assessment engagement of the Municipality's information technology environment.
• To evaluate the Municipality’s cybersecurity posture, identify vulnerabilities and risks, assess compliance with applicable standards and best practices, and provide actionable recommendations to improve cybersecurity resilience.
• Municipality operates a variety of systems supporting municipal operations, including but not limited to:
• Administrative systems
• Public safety systems
• Utility systems
• Financial and payroll systems
• Public-facing web applications
• Email and collaboration platforms
• Network infrastructure
• Cloud-based applications and services
• Perform a comprehensive assessment designed to:
• Identify cybersecurity vulnerabilities and risks
• Evaluate the effectiveness of current cybersecurity controls
• Assess compliance with cybersecurity best practices and applicable standards
• Evaluate governance, policies, and procedures
• Review incident response readiness
• Provide prioritized recommendations for remediation and improvement
• Cybersecurity Program Review
• Cybersecurity governance structure
• Information security policies and procedures
• Security awareness and training programs
• User access management practices
• Third-party/vendor management practices
• Incident response procedures
• Disaster recovery and business continuity planning
• Data classification and retention practices
• Change management processes
• Technical Security Assessment
• Network Security
• Firewall configurations
• Network segmentation
• Wireless security
• Remote access controls
• VPN security
• Intrusion detection/prevention systems
• Endpoint Security
• Antivirus/endpoint protection
• Patch management
• Endpoint detection and response (EDR)
• Device management
• Workstation security configurations
• Server and Infrastructure Security
• Server hardening
• Active Directory review
• Privileged account management
• Backup systems and configurations
• Virtualization infrastructure
• Cloud and SaaS Security
• Microsoft 365 or Google Workspace security
• Cloud access controls
• Multi-factor authentication (MFA)
• Conditional access policies
• Cloud application security settings