IT General Controls and Cybersecurity Audit

Background

City Colleges of Chicago (CCC) is a system comprising seven community colleges and five satellite locations within Chicago, governed by a seven-member board appointed by the Mayor. The Chancellor oversees the system, with each college having its own President and administrative staff. The purpose of this RFP is to solicit proposals for audit services that will strengthen the reliability and integrity of CCC’s core systems, improve control over access to critical systems and data, and reduce risks associated with IT changes and operational processes.

Work Details

The selected vendor will conduct an internal audit focusing on IT General Controls (ITGC) and cybersecurity governance. Key components include: 1. Overall Assurance Governance: Risk-based audit planning aligned with CCC’s objectives; evaluation of design and operating effectiveness of controls. 2. Information Technology General Controls: Evaluation using COBIT 2019 across domains such as IT Governance, Access Management, Change Management, IT Operations, and Interface Controls. 3. Cybersecurity Governance: Assessment using the NIST Cybersecurity Framework covering governance, risk management, protection mechanisms, detection capabilities, incident response readiness, and recovery preparedness. 4. Deliverables include an Audit Workplan, Fieldwork Documentation, Draft Internal Audit Report, Final Internal Audit Report, and periodic status updates throughout the engagement.

Period of Performance

The contract will be for a duration of twelve months or until completion of the required services.

Place of Performance

The services will be performed at various locations associated with City Colleges of Chicago in Chicago, Illinois.

Bidder Requirements

Vendors must demonstrate experience in internal audit assurance engagements aligned with Global Internal Audit Standards (GIAS). They should evaluate controls using COBIT 2019 and NIST CSF frameworks while maintaining independence in auditing practices without conflicts of interest. Additionally, vendors must provide evidence of insurance coverage including worker's compensation and professional liability insurance with specified limits. Compliance with MBE/WBE participation requirements is necessary if subcontracting.