Information Technology Security Audit

Northwestern Michigan College seeks a qualified vendor to perform a comprehensive IT Security Audit of its enterprise environment, covering external and internal penetration testing, CIS Level 1 controls review, and a full set of deliverables for executive and technical audiences. The audit must assess up to 50 external and 250 internal IP addresses, evaluate asset inventories, data protection, configuration management, account and access controls, vulnerability management, backup capabilities, network monitoring, incident response, and provide a remediation action plan. The contractor will present findings to the Board, the IT Security team, and produce a public‑facing opinion letter. • External Penetration Test of up to 50 IPs with lateral movement and privilege escalation. • Internal Penetration Test of up to 250 IPs with similar depth. • Review of CIS Controls v8 Level 1 (C01, C02, C03, C04, C05, C06, C07, C11, C13, C17, C18). • Deliverables include executive summary, detailed technical report, remediation recommendations, board presentation, IT team walkthrough, and a public opinion letter. • Proposals must include detailed pricing, company qualifications, past higher‑education cybersecurity experience, and sample redacted reports.