IT Security Audit RFP 2025

Here is a summary of the RFP document: **Project Overview** The City of Durango, Colorado, is seeking proposals from qualified firms to conduct an IT Security Audit. The audit aims to identify security vulnerabilities, assess the effectiveness of current security measures, and provide recommendations for mitigation. **Scope of Work** The selected vendor will conduct the security audit in two phases: 1. External Assessment: Perform external vulnerability scanning, penetration testing, and risk assessment across public IP addresses. 2. Internal Assessment: Conduct internal vulnerability scanning, penetration testing, and risk assessment across internal network segments. **Requirements** The selected vendor must: * Have at least 5 years of experience performing similar vulnerability assessments * Hold OSCP/OSCE certifications * Provide a detailed description of the proposed audit methodology * Include examples of previous IT security audits performed, including outcomes and client references * Provide a proposed timeline and estimated cost for the audit **Proposal Guidelines** Proposals must be submitted electronically via the Rocky Mountain E-Purchasing System website by December 16, 2025, at 3:00 PM MDT. Proposals must be a maximum of 30 pages in a minimum 12-point font. The City of Durango reserves the right to reject any and all proposals. **Evaluation Criteria** The City of Durango will evaluate proposals based on the following criteria: * Company history and areas of expertise * Proposed audit methodology * Examples of previous IT security audits performed * Proposed timeline and estimated cost * Client references **Contract Terms** The successful bidder must provide all equipment and personnel necessary to perform the required services. The City of Durango reserves the right to negotiate any and all elements of the proposal. The contract will be awarded to the bidder deemed to be in the best interest of the City. **Timeline** The proposed schedule is as follows: * November 7, 2025: RFP publication * November 20, 2025: Questions due * December 4, 2025: Final addendum issued * December 16, 2025: Proposals due * January 2026: Interviews (if necessary) * February 2026: Notice of award and notice to proceed