IT General Controls and Cybersecurity Audit Service

The government authority located in Chicago, Illinois is seeking an independent internal audit to evaluate its IT general controls and cybersecurity governance, risk management, and resilience practices. The agency needs to ensure that key IT general controls supporting its critical systems are designed appropriately and operating effectively in practice. Through this engagement, the agency aims to improve leadership visibility of cybersecurity risks, reduce operational disruptions from IT changes, and assess its preparedness to detect, respond to, and recover from cybersecurity incidents. The scope of work covers risk-based audit planning aligned to strategic, operational, and technology objectives, alongside evaluations of logical access controls to ensure access is restricted to authorized users. The selected partner must assess controls over IT changes and operations to minimize unintended impacts, validate that cybersecurity controls work in practice, and provide actionable insights that support continuous improvement. The project also requires enabling clear ownership, remediation tracking, and governance follow-up to ensure consistent control execution across all systems. Eligible bidders must be onshore organizations located in the United States. The agency allows the performance of the work to be conducted offsite, and bidders must submit their proposals digitally via email or online. The agency is looking for proposals to determine the budget for this engagement. The agency will hold a pre-bid meeting on June 23, 2026. Bidders must submit all questions regarding this opportunity no later than June 26, 2026.