The government authority in Alaska is seeking vendors to conduct cybersecurity assessments of select state IT systems. The assessment should be performed using the National Institute of Standards and Technology (NIST) Cybersecurity Framework and Center for Internet Security (CIS) controls. The security review will cover the infrastructure supporting key systems, the types and extent of data processed within those systems, and associated database structures.

Vendors will be responsible for analyzing statewide IT security training policies, particularly their effectiveness in countering phishing schemes. This evaluation is to encompass all relevant policies, not only those tied to the specific systems under review. Additionally, vendors must develop a comprehensive, classification-based inventory of all relevant assets and data flows. The scope includes identifying, validating, and prioritizing threats and vulnerabilities across the specified IT systems and their supporting infrastructure. Application-level security controls will also be evaluated.