OT Cybersecurity Risk Assessment

Background
The Colorado River Commission of Nevada (CRC) is seeking proposals for IT Cybersecurity Risk Assessment services. Established in 1935, the CRC's mission is to safeguard and manage Nevada’s water and hydropower resources. This solicitation aims to identify, evaluate, and prioritize potential threats and vulnerabilities within the Commission's information systems to mitigate risks and protect critical data.

Work Details
The contractor will perform a comprehensive cybersecurity risk assessment of the CRC's IT network, which includes two main networks (SilverNet and CoxNet) and three VLAN networks (Guest Wi-Fi, IoT Network, Surveillance Camera). The scope of work includes:

1) Preliminary Network Mapping;
2) Penetration Testing;
3) Perimeter Testing;
4) Vulnerability Assessment of internal and external networks;
5) User Privilege Escalation testing;
6) Segmentation Testing;
7) Wireless Scanning;
8) Application Vulnerability Scanning;
9) Brute Force Attack testing for weak passwords;
10) Social Engineering assessments via phone and email.

Deliverables include a Cybersecurity Risk Assessment Report with an executive summary, detailed assessment results, recommendations for immediate and long-term remedies, a project plan, and network mapping documentation.

Period of Performance
The contract is expected to have a term of four years, starting from the estimated contract start date of March 5, 2025.

Place of Performance
The services will be performed at the Colorado River Commission's main office located in Las Vegas, NV.