Seeking a Qualified Cybersecurity Assessment Provider for an Independent Assessment of the External and Internal Perimeters of the SE «ICC» Critical Information Infrastructure

CRDF Global, with support from the United States Department of State, implements the Cybersecurity
Improvement Grants (CySIG) program, a competitive program that strengthens the cybersecurity and
resilience of central governmental institutions and state-owned critical infrastructure enterprises of Ukraine.
Under this program, CRDF Global seeks a qualified and independent cybersecurity assessment provider to
perform a comprehensive assessment of the external and internal security perimeters of the State Enterprise
«Information and Computing Center of the Ministry of Social Policy, Family and Unity of Ukraine» (SE
«ICC»). SE «ICC» is the Administrator of the Unified Information System of the Social Sphere (UISSS)
and operates critical information infrastructure that processes large volumes of sensitive personal and
social-protection data. This solicitation is organized in four technical tasks: Task One, an external perimeter
assessment, including web application and API security testing; Task Two, an internal perimeter
assessment; Task Three, a cyber-defense maturity gap analysis against NIST CSF 2.0, CIS Controls v8.1,
and ISO/IEC 27001:2022, culminating in a risk-based, prioritized remediation roadmap; and Task Four,
validation retesting of remediated vulnerabilities. A fifth task covers coordination and reporting. Offerors
must propose for all tasks.

The selected contractor will provide an objective, evidence-based picture of the current security posture of
the critical information infrastructure administered by SE «ICC». The external assessment will identify how
the organization appears to, and can be attacked by, an external adversary. The internal assessment will test
the resilience of the internal environment, including network segmentation, privileged access, Active
Directory, endpoint detection and response (EDR) coverage, and the completeness of security monitoring.
The maturity gap analysis will measure cyber-defense maturity against NIST CSF 2.0, CIS Controls v8.1,
and ISO/IEC 27001:2022 and translate the combined findings into a risk-based, prioritized, vendor-neutral
remediation roadmap. Finally, validation retesting will confirm whether the vulnerabilities identified have
been effectively remediated. The assessment is not intended to serve as the external cyber-protection
assessment under CMU Resolution No. 1799 of 31 December 2025.

Indicative Scope: based on information provided by SE «ICC», the assessment is expected to cover
approximately at least 45 public IP addresses, 1 primary domain, 100 web resources, 150 APIs, 35 physical
and 450 virtual servers, approximately 120 workstations, 1 Active Directory domain, and 2 infrastructure
hosting sites, including nine core UISSS component deployments across the two sites. These figures are
indicative and will be confirmed at kickoff. Detailed asset lists and infrastructure information will be
provided to the selected contractor after signing a non-disclosure agreement (NDA).

CRDF Global anticipates executing a three-party agreement among CRDF Global, the selected contractor,
and SE «ICC». All testing will be performed only within a scope and under rules of engagement approved
in writing by SE «ICC». Completion of each deliverable will be confirmed by an acceptance certificate
signed by SE «ICC» and approved by CRDF Global. CRDF Global reserves the right to make no award.

Each proposal must include:
Proposed Technical Approach and Project Team
● Methodology for each task, including tools, testing techniques, safeguards for production availability, and the approach to the NIST CSF 2.0 and CIS Controls v8.1 assessment.
● Outline of the proposed rules of engagement and of the data handling plan for findings, evidence,
and personal data.
● CVs and certifications for all key personnel, with each person’s role, level of effort, and citizenship.
● List of recent, relevant experience with at least [three (3)] references, with past performance clearly included.
● 15-page limit, excluding CVs, sample report, and cost proposal

Written Acceptance of Terms and Conflict of Interest Disclosure
● Written acknowledgment and acceptance of the Assessment Conduct, Data Protection, and Compliance Terms and of the three-party agreement structure; disclosure of any relationship with SE «ICC»; and a self-certification that the offeror is not excluded from U.S. federal awards and complies with the Section 889, Kaspersky, and sanctions requirements. A proposal that does not accept these terms may be found non-responsive.

Cost Proposal in USD
○ NOTE: Offerors are required to submit a firm fixed price for each task using the format in the RFP attached below or a template following the same structure, supported by the number of people, level of effort, and daily rate. Prices must be quoted in U.S. dollars exclusive of VAT (see the tax exemption provision above) and valid for at least [90] days from the submission deadline. Travel and other direct costs must be listed separately. Prices must include all testing tool licenses; SE «ICC» will not procure or license any tools. Offerors may add rows to show cost-sharing, leveraged resources, or in-kind contributions; all additions
should be clearly labeled.