Below and attached are the documents/quotes we received from the two security vendors that were solicited based on the OTS report (and whom OTS recommended). A 3rd vendor (Veracode) was explored, but were found to be more of a tools provider rather than a consultancy that could assess architectural aspect of FOLIO’s software.

My recommendation is to go with NCC. They were more responsive by far, and generally seemed more hungry for the deal. Technically both appeared to have sufficient expertise - and neither stood out from the other.

NCC quoted $32,400 for 14 person days of effort. Bishop Fox quoted $37,680 for 157 hours of effort (note the typo in their email - the numbers add to 157 and the price equates to 157). Since their quotes are generally in the same ballpark I will approach the FOLIO Stakeholders about funding this audit. In the mean time we can discuss which vendor the overall TC recommends, and what, if anything, we want to have changed with their proposals.

Thanks.

-mdg

From: Nicole Walker <nwalker@bishopfox.com>
Subject: RE: Index Data _ Bishop Fox Intro Call
Date: April 15, 2019 at 8:32:23 AM EDT
To: "mdg@indexdata.com" <mdg@indexdata.com>
Cc: Britt Gray <bgray@bishopfox.com>

Good morning Mike, 
 
I apologize for the delay in getting this quote to you. Below is the quote for both the Hybrid Application Assessment of the FOLIO Application and a Cloud Deployment Review. I have also attached our testing methodology for our Hybrid Application Assessment, a sample Comprehensive report, and the out Letter of Assessment FAQ. 
 
Hybrid Application Assessment – FOLIO – 111 hours
Cloud Deployment Review – 34 hours
Remediation – 12 hours
Deliverables: 
  • Status Updates
  • Comprehensive Report
  • Report Walkthrough
  • Letter of Assessment
  • Remediation Validation Report
Total Hours – 147 x $240 hourly rate = $37,680
 
We are happy to offer Index Data a discounted rate of $240 per hour. This is a 13% discount off of our standard hourly rate of $275. 
 
Please feel free to reach out if you have any questions. I will follow up with a SOW.
Nicole Walker
ACCOUNT MANAGER
(404) 323-9177

www.bishopfox.com