Sound Transit Biddingo #RP 0075-21

Sound Transit Seeks Information Security Audit and Assessment Services

Sound Transit, the regional transit agency for King, Pierce, and Snohomish counties in Washington, is seeking proposals for comprehensive Information Security Audit Services. - Government Buyer: - Sound Transit (Central Puget Sound Regional Transit Authority) - Scope of Services: - Annual ISO 27000 series maturity assessments (not certification) - PCI DSS assessments of a segmented Fare Collection network - 150 endpoints, 1 public IP, 120-140 ticket vending machines, 25 servers, 75 network devices, 1 database - Web application penetration testing (approx. 5,000 dynamic pages, 15 APIs) - Network penetration testing (2,300 internal IPs, 250 external IPs) - Wireless security testing (2 SSIDs, radius authentication) - Firewall audits - Technical testing and compliance evaluations - Reporting and presentations to stakeholders - Notable Requirements: - Qualified Security Assessor (QSA) certification required for key staff - Work may be performed onsite and remotely - Compliance with Equal Employment Opportunity laws - Submission of a staffing plan with demographic information - No DBE or Small Business participation goals - OEMs and Vendors: - No specific OEMs or product manufacturers are named in the solicitation - Contract Details: - Base term of one year, with up to four one-year extensions (potential total of five years) - Estimated contract value: $500,000 to $999,999 over five years

Description

Sound Transit is soliciting proposals from firms to provide a range of Information Security Audits and Assessments. The services include ISO 27000 series maturity assessments, PCI DSS assessments, and various technical testing. The contract term begins in 2021 and may last through 2026, with a base term of one year and up to four one-year extensions at Sound Transit's discretion. The scope of work and additional details are provided in the attached documents.

View original listing