The Retirement Systems of Alabama

The buyer is seeking cybersecurity consulting and testing services for its retirement systems and health insurance plan. Services include penetration testing, vulnerability assessments, and security reviews of networks and applications. The buyer requires a vendor with extensive experience in cybersecurity to perform various assessments and provide best practice consulting. The contract period is for five years, starting October 1, 2024.

• 8/30/2024 - Deadline for receipt of proposer questions
• 9/5/2024 - Responses to questions posted
• 9/12/2024 - Proposal Due Date
• 9/16/2024 - Discussions with Proposers
• 9/30/2024 - Award Contract
• 10/1/2024 - Contract Start Date

• Proposing firm must have been in business for minimum of five years
• Firm must NOT be a current tenant of RSA
• Assigned personnel must have minimum 5 years' experience in security design and testing
• Firm personnel must be able to pass a national background check
• Firm must sign PEEHIP's standard HIPAA Business Associate Agreement

• Perform remote blackbox penetration tests against target IP addresses
• Conduct blackbox web-application security reviews for specific applications
• Perform social engineering assessments
• Provide wireless security testing services
• Deliver daily reports of ongoing tests to the Security Manager
• Provide retesting services within 3 months of initial test
• Offer general cybersecurity best practice consulting as requested