Proposal for Contract Work for Penetration Testing Services for External Systems and Internal Networks

Announcement of Procedures for Public Proposal Method We hereby request the submission of proposals as follows. October 1, Reiwa 8 Setagaya Ward 1. Business Overview: (1) Title: Contract Work for Penetration Testing Services for External Systems and Internal Networks (2) Business Description, etc.: The business operator shall conduct penetration testing by performing simulated attacks from the outside and simulated attacks originating from terminals mimicking malware infection against the Ward's external systems and internal network environment, to verify and evaluate the possibility of external intrusion and the possibility of damage expansion within the internal network. The contractor for the penetration testing services will be selected through a public proposal method. ① Penetration Testing Content: The tests will be verified and evaluated from the following perspectives. *This business aims to evaluate the possibility of external intrusion and damage expansion within the internal network, and does not necessarily require obtaining administrator privileges or exfiltrating information as a mandatory verification target. *Social engineering techniques will not be used. a. Penetration testing against external systems: *Possibility of penetrating the target system from the outside. *Presence of public setting, access control, or other configuration errors. *Possibility of exploiting known vulnerabilities, etc. *Possibility of reaching important information or functions. *Effectiveness of security measures such as detection and defense. b. Internal lateral movement test originating from an infected terminal: *Possibility of lateral movement to other terminals or servers. *Effectiveness of network segmentation, communication control, and access control. *Possibility of acquiring authentication information or other information within the terminal, and accessing internal systems using them. *Possible range of damage expansion within the internal network. *Effectiveness of detection, defense, and blocking. ② Implementation Period (Scheduled): February Reiwa 9. (3) Period of Performance: From the contract date to March 31, Reiwa 9. 2. Participation Qualification Requirements: All of the following conditions must be met by the deadline for submission of the participation statement. (1) Must be registered in the Setagaya Ward competitive bid participant list by the deadline for submission of the participation statement. (2) Must not fall under the provisions of Article 167-4, Paragraph 1 of the Local Government Act (Ordinance No. 16 of 1947) (including cases where applied mutatis mutandis under Article 167-11, Paragraph 1). (3) Must not be within the period of suspension of bidding participation or designation suspension measures from Setagaya Ward. (4) Must not have filed for commencement of rehabilitation proceedings under the Corporate Reorganization Act (Act No. 172 of 1952) or for commencement of rehabilitation proceedings under the Civil Rehabilitation Act (Act No. 225 of 1999). (5) Must not be in arrears of prefectural tax or municipal tax. (6) Must have obtained certification under the "Privacy Mark" by the Japan Information Economy Society Promotion Association or the "Information Security Management System (ISMS) Conformity Assessment Scheme" which is the evaluation standard for ISO/IEC27001 or JIS Q 27001 (including renewals and change applications). (7) Must not be a yakuza, a yakuza member as defined in Article 2, Item 2 or 6 of the Act on Prevention of Unjustifiable Acts by Boryokudan Members, etc. (Act No. 77 of 1991), or a related party. (8) In the past 5 years, the participating business operator or a cooperating business operator participating in the implementation structure of this business must have experience in penetration testing or TLPT (Threat-Led Penetration Testing). Such experience may include information systems or network environments with equivalent security requirements and scale, not limited to public institutions (national government, local governments, independent administrative agencies, etc.). If the experience of a cooperating business operator is used to meet the participation qualifications, it is assumed that the cooperating business operator will participate in the implementation of this business, and their roles and responsibilities must be clearly stated in the proposal. (9) Must not be a business where a member of the "Selection Committee for Contract Work for Penetration Testing Services for External Systems and Internal Networks" serves as the principal, executive, consultant, or is affiliated. The composition of the committee is as follows: Chairperson: Masanobu Soma, Director, DX Promotion Department Member: Yuzo Hidaka, Head, DX Promotion Department Member: Masanori Nakazawa, Deputy Counselor, DX Promotion Department (Common Infrastructure) *Please attach documents proving that conditions (5), (6), and (8) are met. If condition (8) is met using the experience of a cooperating business operator, please also submit documents confirming the cooperating business operator's work experience and their role in this business. 3. Criteria for Selecting Proposal Submitters: In this project, selection of submitters will not be performed; only confirmation of participation qualifications will be conducted. 4. Evaluation Criteria for Identifying Proposals: (1) Technical Proposal (Attack Scenarios/Methods) (2) Track Record (Content of Similar Projects) (3) System (Personnel Skills) (4) Implementation Plan (Safety/Feasibility) (5) Deliverables (Reporting/Improvements) (6) Price 5. Procedures, etc.: (1) Contact Department: DX Promotion Department, DX Promotion Division 2-23-1 Tsurumaki, Setagaya-ku, Tokyo 154-0016 (Administrative Center) Phone: 03-3439-1511 FAX: 03-3439-2541 (Excluding Saturdays, Sundays, and holidays; 9:00 AM - 5:00 PM). (2) Period, Place, and Method of Distribution of Specifications: ① Period: October 1, Reiwa 8 (Thursday) to October 15, Reiwa 8 (Thursday), 5:00 PM. ② Place: Same as 5(1). ③ Method: Available for pickup at the counter in 5(1) or download from the Ward's website. (Page ID: 36049) Top Page → Ward Administration Information → Contracts and Bidding Information → Procurement Information → Current Proposal Information → Others / Regarding Ward Administration. (3) Deadline, Place, and Method of Submission of Participation Statement: ① Submission Deadline: October 15, Reiwa 8 (Thursday), 5:00 PM (must arrive by this time). ② Submission Place: Same as 5(1). ③ Submission Method: Submit by hand delivery to the counter after prior contact, or by mail. (If submitting by mail, it must arrive at the administrative center by the submission deadline and be limited to registered mail or private courier services that can confirm delivery). (4) Deadline, Place, and Method of Submission of Proposals: ① Submission Deadline: November 19, Reiwa 8 (Thursday), 5:00 PM (must arrive by this time). ② Submission Place: Same as 5(1). ③ Submission Method: Submit by email. The email address will be separately notified by the Ward along with the confirmation of participation qualifications and the sending of the invitation notice. 6. Other: (1) Language and currency to be used in procedures: Japanese and Japanese currency only. (2) Contract security: Exempt. (3) Requirement for contract creation: Required. (4) Whether there is a plan to conclude a discretionary contract with the other party of this commissioned work contract for other directly related work: No. (5) Contact for obtaining related information: Same as 5(1). (6) Cost Burden: Setagaya Ward will not bear any costs incurred by the business operator for the preparation and submission of participation statements and proposals. (7) Handling of Submitted Documents: Documents submitted by the business operator during the selection process will not be returned. (8) Ensuring Transparency and Fairness: From the perspective of ensuring transparency and fairness, the trade name/name of the business operator that has expressed participation in this project and submitted a proposal, as well as the reasons for selecting the proposal (examination process, etc.), may be disclosed to third parties in accordance with the provisions of the Setagaya Ward Information Disclosure Ordinance (March 13, Reiwa 13, Setagaya Ward Ordinance No. 6). (9) Contract: After the selection of the business operator, the final specifications will be determined through consultation between the Ward and the selected party, and a contract will be concluded at a later date. (10) Minimum Labor Remuneration: Contract work contracts with the Ward for commissioned work exceeding 20 million yen per fiscal year are subject to the minimum labor remuneration stipulated by the Setagaya Ward Public Contract Ordinance. This project is subject to this, so please refer to the attached document for details. (11) Business Details: Details are in the specifications. 1. Specifications for Contract Work for Penetration Testing Services for External Systems and Internal Networks 1. Purpose: In recent years, cyberattacks such as targeted attacks and ransomware have become more sophisticated and insidious. Intrusion due to vulnerabilities or configuration errors in external systems, or the expansion of damage within internal networks originating from terminals infected with malware, can cause serious disruptions to municipal operations, such as information leakage or business suspension. This business aims to verify the following by conducting penetration tests from an attacker's perspective against the Ward's external systems and internal network environment: (1) To confirm the possibility of intrusion by exploiting public setting errors or known vulnerabilities through simulated attacks against external systems. (2) To confirm the possibility of acquiring authentication information or other data within terminals, the possibility of accessing internal systems using them, and the possibility of lateral movement to other terminals or servers, by conducting simulated attacks originating from terminals mimicking malware infection, and to evaluate the effectiveness of network segmentation, communication control, etc. Through these verifications, the effectiveness of current security measures will be evaluated, and concrete proposals will be obtained to clarify issues and facilitate improvements. This business requires advanced technical capabilities and specialized knowledge based on actual attack scenarios, not just simple vulnerability identification. Therefore, in selecting the contractor, a public proposal method will be used to select the most appropriate business operator by comprehensively evaluating not only price but also technical capabilities, implementation system, and track record. In this proposal, emphasis will be placed on the feasibility, specificity, and effectiveness of the proposed content, and proposals that can safely and reliably execute the business while minimizing the impact on the Ward's operations are sought. 2. Title of Business: Contract Work for Penetration Testing Services for External Systems and Internal Networks. 3. Business Overview: Penetration testing will be conducted by performing simulated attacks from the outside and simulated attacks originating from terminals mimicking malware infection against the Ward's external systems and internal network environment, to verify and evaluate the possibility of external intrusion and the possibility of damage expansion within the internal network. Penetration Testing Content: The tests will be verified and evaluated from the following perspectives. *This business aims to evaluate the possibility of external intrusion and damage expansion within the internal network, and does not necessarily require obtaining administrator privileges or exfiltrating information as a mandatory verification target. *Social engineering techniques will not be used. (1) Penetration testing against external systems: Simulated attacks will be conducted against systems accessible from the internet, primarily verifying and evaluating the following: ① Possibility of penetrating the target system from the outside. ② Presence of public setting, access control, or other configuration errors. ③ Possibility of exploiting known vulnerabilities, etc. ④ Possibility of reaching important information or important functions through intrusion or exploitation of vulnerabilities, etc. ⑤ Effectiveness of security measures such as detection and defense. (2) Internal lateral movement test originating from an infected terminal: Simulated attacks will be conducted originating from a verification terminal prepared by the Ward, mimicking a malware-infected state, primarily verifying and evaluating the following: ① Possibility of lateral movement to other terminals or servers. ② Effectiveness of network segmentation, communication control, and access control. ③ Possibility of acquiring authentication information or other information within the terminal, and accessing internal systems using them. ④ Possible range of damage expansion within the internal network. ⑤ Effectiveness of detection, defense, and blocking against lateral movement and other attacks. *Details will be provided in the specifications sent after participation statement submission. 4. Specific Reasons for Adopting Proposal Method: This business involves conducting penetration tests against external systems and internal lateral movement tests originating from infected terminals to verify the effectiveness of the Ward's security measures. The implementation of this business requires not only vulnerability assessment but also advanced technical knowledge and practical experience, including the formulation of attack scenarios from an attacker's perspective, penetration testing methods, safe management considering business impact, evaluation of detection status, and improvement proposals. Furthermore, even when achieving the same objective, there are significant differences in attack scenarios, verification methods, implementation systems, safety management measures, and deliverables among business operators. Therefore, selecting a business operator based solely on price is not appropriate. For this reason, a public proposal method is adopted to select the contractor candidate by comprehensively evaluating technical capabilities, track record, implementation system, implementation plan, and effectiveness of deliverables, not solely on price. In this proposal, emphasis will be placed on the feasibility, specificity, and effectiveness of the proposed content, and proposals that can safely and reliably execute the business while minimizing the impact on the Ward's operations are sought. 5. Period of Performance: From the contract date to March 31, Reiwa 9. 3. Participation Qualification Requirements: All of the following conditions must be met by the deadline for submission of the participation statement. (1) Must be registered in the Setagaya Ward competitive bid participant list by the deadline for submission of the participation statement. (2) Must not fall under the provisions of Article 167-4, Paragraph 1 of the Local Government Act (Ordinance No. 16 of 1947) (including cases where applied mutatis mutandis under Article 167-11, Paragraph 1). (3) Must not be within the period of suspension of bidding participation or designation suspension measures from Setagaya Ward. (4) Must not have filed for commencement of rehabilitation proceedings under the Corporate Reorganization Act (Act No. 172 of 1952) or for commencement of rehabilitation proceedings under the Civil Rehabilitation Act (Act No. 225 of 1999). (5) Must not be in arrears of prefectural tax or municipal tax. (6) Must have obtained certification under the "Privacy Mark" by the Japan Information Economy Society Promotion Association or the "Information Security Management System (ISMS) Conformity Assessment Scheme" which is the evaluation standard for ISO/IEC27001 or JIS Q 27001 (including renewals and change applications). (7) Must not be a yakuza, a yakuza member as defined in Article 2, Item 2 or 6 of the Act on Prevention of Unjustifiable Acts by Boryokudan Members, etc. (Act No. 77 of 1991), or a related party. (8) In the past 5 years, the participating business operator or a cooperating business operator participating in the implementation structure of this business must have experience in penetration testing or TLPT (Threat-Led Penetration Testing). Such experience may include information systems or network environments with equivalent security requirements and scale, not limited to public institutions (national government, local governments, independent administrative agencies, etc.). If the experience of a cooperating business operator is used to meet the participation qualifications, it is assumed that the cooperating business operator will participate in the implementation of this business, and their roles and responsibilities must be clearly stated in the proposal. 8.