External Information Security Audit (α´ Model) Outsourcing Services

External Information Security Audit (α´ Model) Outsourcing Services Nagaoka City Public Notice No. 191 Regarding the Implementation of Restricted Public Competitive Bidding (Announcement) In accordance with the provisions of Article 234, Paragraph 1 of the Local Autonomy Act (Showa 22, Act No. 67) and Article 129, Paragraph 1 of the Nagaoka City Financial Regulations (Heisei 3, Nagaoka City Ordinance No. 15), a restricted public competitive bidding will be conducted, and notice is hereby given as follows. July 24, Reiwa 8 Mayor of Nagaoka City, Tatsunobu Iso 1. Outline of Outsourcing (1) Service Name: External Information Security Audit (α´ Model) Outsourcing Services (2) Contract Period: From the date of contract signing to January 31, Reiwa 9 (3) Outsourcing Period: November 1, Reiwa 8 to January 31, Reiwa 9 (4) Scope of Work: External Information Security Audit (α´ Model) Outsourcing Services, as per the specifications (hereinafter referred to as "Specifications"). 2. Bidding Eligibility Requirements Bidders must meet all of the following requirements: (1) Have headquarters, branches, or business offices (hereinafter referred to as "Headquarters, etc.") within Niigata Prefecture. (2) Meet the following contractor requirements: A. The contractor must be registered in the Information Security Service Standards Compliant Service List (specifically the part related to security audit services). B. The contractor must have obtained ISO/IEC 27001 (JIS Q 27001) certification or Privacy Mark certification. C. Form an audit team composed of an audit manager, auditors, audit assistants, advisors, etc. D. Establish an audit quality management system, such as an audit quality manager and audit quality administrator, to maintain audit quality. E. The audit team must include at least one person who possesses the knowledge and experience necessary for information security audits (experience in information security audits for local governments) and holds one of the following qualifications: - System Auditor - Certified Information Systems Auditor (CISA) - Certified Systems Auditor - ISMS Lead Auditor - ISMS Auditor - Certified Information Security Lead Auditor - Certified Information Security Auditor F. The audit team must include at least one expert with experience (practical experience) in one of the following to ensure audit efficiency and quality: - Information security audits - Information security consulting - Consulting (including support) for the creation of information security policies G. Members of the audit team must not be involved in the management of information assets to be audited or in the planning, development, operation, or maintenance of information systems related to those information assets. (3) Must not fall under any of the following: A. Persons falling under the provisions of Article 167-4 of the Local Autonomy Act Enforcement Regulations (Showa 22, Cabinet Order No. 16). B. Persons who are delinquent in paying city taxes owed to Nagaoka City. C. Persons who are delinquent in paying corporate tax, consumption tax, or local consumption tax owed to the national government. D. Persons who have been subject to suspension of bidding by Nagaoka City during the period from the date of this announcement to the bid submission deadline. 3. Submission of Bid Participation Application Those wishing to participate in this bid must submit the following documents: (1) Submitted Documents: A. Application for Participation in Public Competitive Bidding B. Certified copy of the corporate registry or certificate of registered matters (copy acceptable, issued within 3 months) C. Certificate of no outstanding city tax (copy acceptable, issued within 3 months). This certificate proves that there are no outstanding city taxes owed to this city. If the applicant has no tax obligation in this city, submit a letter of reason (any format) stating, for example, "No business office in Nagaoka City," signed and sealed. D. Certificate of tax payment (copy acceptable, issued within 3 months, Form 3-3 issued by the competent tax office). This certificate proves that there are no outstanding corporate tax, consumption tax, or local consumption tax owed to the national government. E. Balance sheet, income statement, and statement of changes in net assets for the most recently concluded fiscal year (copy acceptable). F. Documents proving headquarters, etc., are located within Niigata Prefecture (e.g., certificate of registered matters, lease agreement, certificate of tax payment for fixed assets tax, etc.; copy acceptable). G. Documents proving fulfillment of contractor requirements (copy acceptable). H. Power of attorney, if the representative delegates contract-related authority to a branch manager, etc. I. Pledge of non-eligibility as a gangster exclusion target (Not required for those registered in the Nagaoka City Bidder Qualification List or those who have submitted a pledge to Nagaoka City within the last 2 years). (2) Submission Period: From Friday, July 24, Reiwa 8, to Friday, August 14, Reiwa 8 (excluding Saturdays and Sundays), from 8:30 AM to 5:15 PM. (3) Submission Location: DX Promotion Department, 5th Floor, Otedori Government Building, 2-6 Otedori, Nagaoka City, Nagaoka City, 940-0062. (4) Submission Method: In person or by mail. If by mail, use registered mail with return receipt requested (clearly mark "Application for Participation in Public Competitive Bidding for External Information Security Audit (α´ Model) Outsourcing Services" in red on the envelope). Ensure it arrives by the deadline. Please contact us by phone to confirm submission. (5) Notification of Results: The results of the bid participation qualification screening will be notified by email by 5:00 PM on Wednesday, August 19, Reiwa 8, to all applicants who submitted the application. (6) Distribution of Work Specifications, etc.: Application forms for public competitive bidding, work specifications, etc., can be downloaded from the Nagaoka City website under "Industry/Business - Bidding and Contract Information - Public Bidding Announcements - Public Bidding Announcements (Other Departments)" on the page for "External Information Security Audit (α´ Model) Outsourcing Services." 4. Inquiries Regarding Work Specifications, etc. (1) Deadline for Acceptance: Noon on Friday, August 28, Reiwa 8. (2) Acceptance Method: Accepted via FAX or email using any format. After sending, please contact the DX Promotion Department (Direct line: 0258-39-2205). (3) Submission Address: FAX: 0258-39-2254, Email: joshisu@city.nagaoka.lg.jp (4) Response Method: Answers to inquiries will be sent by email to all applicants deemed qualified by 5:00 PM on Wednesday, September 2, Reiwa 8. 5. Date and Time of Bidding and Opening of Bids (1) Bidding Date and Time: Friday, September 4, Reiwa 8, 2:00 PM. (2) Opening of Bids: Immediately after the bid deadline. (3) Location: Bidding Room, 8th Floor, Otedori Government Building, 2-6 Otedori, Nagaoka City. 6. Amount of Bid Bond and Contract Deposit (1) Bid Bond: Exempt. (2) Contract Deposit: Exempt. 7. Other (1) Bid Amount: The successful bid amount will be the amount stated in the bid form plus 10% of that amount (rounded down to the nearest yen). Therefore, bidders should state the amount excluding consumption tax and local consumption tax in their bid forms. (2) Invalid Bids: Bids submitted by persons who do not meet the necessary qualifications or bids that violate the bidding conditions will be considered invalid. (3) Handling of Submitted Documents, etc.: A. The cost of preparing submitted documents, etc., will be borne by the applicant. B. Submitted documents, etc., will not be used for purposes other than the bid participation qualification screening. C. Submitted documents, etc., will not be returned. (4) Other: In addition to the provisions of this announcement, the bidding for this service will be conducted in accordance with the Nagaoka City Financial Regulations, "Bidders' Guidelines for Construction Work, etc." (Showa 6, Nagaoka City Public Notice No. 92), "Re-bidding Procedures for Construction Work, etc." (Showa 6, Nagaoka City Public Notice No. 91), and related laws and regulations. External Information Security Audit (α´ Model) Outsourcing Services Specifications 1. Service Name: External Information Security Audit (α´ Model) Outsourcing Services 2. Purpose: This service is to conduct an external audit, as required by the Ministry of Internal Affairs and Communications and the Local Government Information Systems Organization, for the city which is implementing the α´ model. Furthermore, based on the results, we will identify issues, consider and advise on improvement methods. 3. Contract Period and Outsourcing Period: Contract Period: From the date of contract signing to January 31, Reiwa 9 Outsourcing Period: November 1, Reiwa 8 to January 31, Reiwa 9 4. Place of Performance: Within Nagaoka City Hall. 5. Schedule: To be determined in consultation with the contracting party. 6. Audit Target: The network related to the city's α´ model. (System user departments and individual networks are not included in the audit scope. The specific scope will be instructed separately to the contractor.) 7. Scope of Work: (1) Creation of Audit Implementation Plan: Develop an audit implementation plan detailing the specific implementation content, implementation structure, and implementation schedule. (2) Conduct Audit Briefing Session. (3) Audit Application Standards: A. "Nagaoka City Information Security Policy" (Revised April 1, Reiwa 8) B. "Guidelines for Information Security Policies in Local Governments" (Ministry of Internal Affairs and Communications, Revised March 28, Reiwa 7) C. "Guidelines for Information Security Audits in Local Governments" (Ministry of Internal Affairs and Communications, Revised March 28, Reiwa 7) (hereinafter referred to as "Audit Guidelines") (4) Conduct Preliminary Survey: Conduct preliminary surveys as necessary to efficiently proceed with this audit. Preliminary surveys will be conducted through data exchange. (5) Conduct External Audit: The audit items shall include the following items specified in the attached "List of Audit Items for Municipalities Adopting the α´ Model," and will be conducted through review of audit materials and interviews with audited departments. A. Audit items unique to the α´ model: "3.11 Additional Audit Items When Adopting the α´ Model" in the Audit Guidelines (17 items). B. Audit items common to α´ model, β model, and β´ model: Audit items related to organizational and human measures in the Audit Guidelines, which are mandatory for adopting the α´/β/β´ models (23 items). (6) Preparation of Audit Records: After conducting the audit, prepare and submit audit records to the city. The city will review the content and instruct on necessary revisions. (7) Preparation of Audit Report: The report shall include the following items. The audit results will be determined after factual confirmation with the city. A. Specific details of any findings. B. Proposed improvement plans for any findings. (8) Place of Implementation, etc.: The external audit (4) will be conducted within the city hall. Other meetings may be held online. 8. Contractor Requirements: (1) The contractor must be registered in the Information Security Service Standards Compliant Service List (specifically the part related to security audit services). (2) The contractor must have obtained ISO/IEC 27001 (JIS Q 27001) certification or Privacy Mark certification. (3) Form an audit team composed of an audit manager, auditors, audit assistants, advisors, etc. (4) Establish an audit quality management system, such as an audit quality manager and audit quality administrator, to maintain audit quality. (5) The audit team must include at least one person who possesses the knowledge and experience necessary for information security audits (experience in information security audits for local governments) and holds one of the following qualifications: A. System Auditor B. Certified Information Systems Auditor (CISA) C. Certified Systems Auditor D. ISMS Lead Auditor E. ISMS Auditor F. Certified Information Security Lead Auditor G. Certified Information Security Auditor (6) The audit team must include at least one expert with experience (practical experience) in one of the following to ensure audit efficiency and quality: A. Information security audits B. Information security consulting C. Consulting (including support) for the creation of information security policies (7) Members of the audit team must not be involved in the management of information assets to be audited or in the planning, development, operation, or maintenance of information systems related to those information assets. 9. Deliverables: Submit electronic data of the following deliverables by their respective deadlines and obtain confirmation from the contracting party. Also, attach materials prepared during the preliminary survey, interviews, and on-site inspection as needed. Data format and size will be determined in consultation with the contracting party. 10. Delivery Location of Deliverables: DX Promotion Department, Nagaoka City. 11. Ownership of Deliverables: All deliverables and accompanying materials shall belong to the contracting party, and shall not be disclosed, transferred, lent, or used by others without the written consent of the contracting party. However, copyrights that the contractor held prior to this work regarding the deliverables and accompanying materials shall be retained by the contractor, and the contracting party may use them freely within the scope of the purpose of this work. 12. Provision of Materials: Necessary materials and data will be provided by the contracting party to the extent deemed appropriate for the execution of this work. The contractor shall store materials provided by the contracting party appropriately, with strict security measures for personal information and information system security. Upon completion of the contract, all materials collected for this audit shall be promptly returned to or destroyed by the contracting party. Deliverables | Submission Deadline Audit Implementation Plan | To be determined in consultation Audit Checklist, etc. | To be created during the audit | To be determined in consultation Audit Report | | 13. Other: Matters not described in these specifications shall be determined through consultation with the contracting party.