Specifications include, but are not limited to: Vendor shall supply all labor, tools, transportation, materials, equipment and permits as necessary and required to perform services as described herein. Vendor shall provide Security Compliance, Penetration Testing, and remediation services available to all State Agencies. The resulting contract shall be used mainly for PCI-DSS penetration and segmentation testing and not necessarily for any regulatory obligations. All testing shall target social engineering tests tailored to the specific risk situations and compliance considerations of the State. The State requires that all testing must be done from within the United States; access will not be provided to foreign IP addresses. The penetration tester(s) assigned to conduct the testing shall be located within the United States. All testing is typically performed remotely, however agencies with internal Cardholder Data Environments (CDE) have been tested onsite from one location. Agencies shall submit a pre-engagement checklist to the Vendor. Before testing can begin, the Vendor and the State shall hold a preengagement meeting and agree upon the types of testing (i.e., internal, external, application-layer or network-layer) to be performed, how testing will be performed, and what the testing will target. The Vendor shall provide a testing questionnaire and test-authorization form to be completed. The pre-engagement checklist and meeting shall clearly identify, but not limited to, the following: • Whether the services are for a PCI or non-PCI security engagement; • What is in scope, including internally and externally; • Details about any devices in scope; • Products and versions of any cybersecurity technologies and vulnerability management tools in scope; • IP information in scope; • Infrastructure information in scope as the State has a combination of hosted and on-premises environments for its production environments; • Information about regular security assessments performed on a routine basis by independent 3rd parties or their federal counterparts, if applicable and available;
