Request for Information Information Technology Audit of Voice over Internet Protocol (VOIP) System. City of Tulsa-Internal Auditing Department

Transcription

1 Request for Information Information Technology Audit of Voice over Internet Protocol (VOIP) System City of Tulsa-Internal Auditing Department Issued: October 31, 2013 Responses Due: December 4, 2013

2 Introduction The City of Tulsa is soliciting responses to this Request for Information (RFI) from the appropriate consulting companies qualified to provide an audit of the City s Voice Over Internet Protocol (VOIP) phone system. Information provided as a response to this RFI will be used in the preparation of a Request for Proposal for the required services. Primary services required of a vendor in the future will include the development of an audit plan for Internal Auditing s approval, conduct of the audit with personnel possessing requisite levels of IT and telecommunications expertise and experience, and presenting a written report of the audit results. For the scope area audited, the use of the Control Objectives for Information and Related Technology (COBIT) 5 framework is required. In general, it is the intent of the City to review the responses to this RFI and consider them in the development of a fair, thorough Request for Proposal, which facilitates the competitive bidding process. This is an opportunity for respondents to have input in the development of the specifications from which sealed bids will be solicited, and a contract(s) executed, for the provision of the primary services above, for the City of Tulsa Internal Auditing Department. Information Response Submissions Responses are due by 5:00 p.m. on December 4, 2013, and may be mailed or delivered to: City Clerk s Office City Hall 175 East 2 nd Street S# 260 Tulsa, Oklahoma

3 Overview of the City s VOIP System The main PBX (private branch exchange) system is an Avaya (Blue) product. It is the CS1000E on Release 7.5. The upgrade from a CS1000M Release 5.0 occurred in April The system consists of: CS1000E Release 7.5 Provides core control elements and uses geographically-split processors on proprietary hardware Call Pilot Release 5.0 Runs voice mail applications and uses Windows Server 2003 R2 Standard on proprietary hardware Avaya Aura Contact Center Release 6.2 Provides call center applications and uses Windows Server 2008 R2 Standard on a DL380 G7 server. Other Avaya components include (2) System Manager (1) Presence Server (3) Session Manager (1) MAS Server (10) Signaling Server (2) Remote Media Gateway Non-Avaya products include: Telstrat Call Recorder records call audio and computer screens for call center agents. PCI Compliance rules are followed. VeraMark VeraSmart Call Accounting standard call detail register system that tracks call activity and long distance usage. Conveyant Sentry E911 provides location information for VoIP phones when they call 911. It also alerts City Security with the same location information.

4 Goals, Objectives and Conduct of the VOIP System Audit The objective of the audit is to identify any significant risks posed by the VOIP system s configuration. This centers on risks creating potential for the compromise of City data security or disruption of critical service delivery. Specific to these risks, system level configuration and architecture of the components listed above will need to be evaluated. The selected firm will be responsible for performing the audit as well as providing complete audit documentation to the Internal Auditing department, including: audit project plans expected timelines initial data and access requests estimates of time needed from City IT personnel planned test procedures test results workpaper documentation and report findings The timing of vendor selection and contract award is anticipated to be in the City s fiscal th quarter, which commences April 1, Upon final contract award, the selected firm will then be required to begin the audit process within 30days. Qualifications and experience levels of key personnel ultimately working on the audit must be the equivalent of personnel profiled in work proposals; further, the City will reserve right of refusal if staffing substitutions are made which do not achieve the expertise levels originally proposed by the firm. Additionally, standard City contract terms do not allow subcontractors to be used to perform work. RFI Submission The overall goal of this RFI is to aid in the collection of sufficient information to facilitate the development of fair and open specifications for the subsequent proposal for primary services. The above areas of interest have been identified to date, but other pertinent information provided will also be considered. RFI response formats are at the discretion of the respondent, but should contain the following: Overview of the proposed audit. Description of the approach to conducting the audit. Discussion of the key components of the goals and objectives section: Specific experiences with IT security and/or telecommunications audits at the system (rather than process or policy) levels. In addition to any specific recommendations you choose to make, provide examples of bid invitations (or requests for proposal), contracts, terms and conditions, or other documents that address the topic. Include the names and locations of facilities where similar services have been provided.

5 Special Terms & Conditions 1. All material submitted as part of the response to this Request for Information shall be considered the property of the City of Tulsa. 2. The respondent will not be compensated for any expenses incurred in the process of responding to the RFI or, if requested, in submitting further information. Timeline RFI Issued: October 31, 2013 Deadline for Written Questions: November 20, :00 PM (CST) Responses Due: December 4, 2013 Project Manager: Mary Vassar (Contact ref. Onsite or other questions) City of Tulsa 175 East 2 nd Street S# 665 Tulsa, OK mvassar@cityoftulsa.org