External IT Security Assessment Service

The government authority located in Columbus, Ohio is seeking an independent external assessment of its information technology security program. The agency needs to evaluate its IT security governance, program structure, and alignment to the National Institute of Standards and Technology Cybersecurity Framework 2.0. This assessment must address how the agency's people, processes, and technology support business objectives as well as regulatory and oversight expectations. The scope of work requires program discovery, data collection, and mapping to the NIST CSF 2.0 to identify gaps, strengths, and areas for improvement. The selected vendor must validate the agency's current-state assessment where available and provide an independent view of risks, assumptions, and material exposures. Additionally, the project covers the creation of a security program maturity roadmap, a gap analysis with risk considerations and recommendations, and the delivery of an executive readout and leadership workshop. Bidders must be onshore organizations based solely in the United States. The agency expects the performance of all work to occur offsite. Regarding budget, the agency is looking for proposals to define the cost of the services. Bidders must submit all questions no later than June 30, 2026.