Cyber Security Audit Of Website - ANNEXURES | NSeGS

- e) The scope of the audit (in case of VA/PT) should not be limited to the few lists like OWASP top 10 or SANS Top 25 programming errors, it must include the discovery of all known vulnerabilities

2.2 Schedule of Conducting Cyber Security Audit: Cyber Security Audit in NSEGS needs to be conducted Two Times for the sake of cross-checking the effective implementation of the recommendations provided during the first Audit exercise. The First Cyber Security Audit exercise needs to be commenced within 7 days of issuing the Work Order. The audit will include a compliance audit as per CERT-IN markers along with the technical sampling audit for evidence gathering. Report of vulnerability and corrective measure need to be provided by the Bidder and based on the same action would be taken at NSEGS end. The First Phase of the Cyber Security Audit and its Reporting need to be completed as per the scheduled timeline.

- a. After the end of the First Phase of the Cyber Security Audit and Reporting thereof by the bidder, NSEGS would take some reasonable time to study the Gaps in Cyber Security and would attempt to bridge the gaps as much as possible. After the Gap bridging exercise by NSEGS has been completed, the bidder would be informed accordingly by the concerned NSEGS representative, and thereafter the bidder should commence the Second Phase of the Cyber Security Audit exercise. The time taken by NSEGS for bridging the vulnerability will not affect the bidder in any way as the bidder will not be held responsible for any delay in the same. The Report of the VA/PT Analysis of the First Phase of Cyber Security Audit should be made in such a way that it should help NSEGS in patching or updating of web/applications.
- b. The Second phase Cyber Security Audit need to be completed within 7 days after the concerned NSEGS representative gives the go-ahead for the Second Phase exercise. The purpose of the Second Phase Audit exercise would be to identify and specify whether the Vulnerability Report Submitted in the First Phase exercise, still exists or the Cyber Security Gaps are plugged in to make the IT system of NSEGS as secure as possible. The Second phase audit exercise should also result in a Detailed Report and Analysis to be submitted for the current Cyber Security status of the websites hosted at the Nagaland State Data Centre.

2.3 Reports and Deliverables:

- 1. Audit Plan of the Cyber Audit exercise .
- 2. Dates and Locations of Proposed and Actual Cyber Audit exercise.
- 3. Summary of Cyber Audit findings, including identification tests and the results of the tests, need to be shared with concerned NSEGS officials.
- 4. Analysis of vulnerabilities and issues of concern of Cyber Security needs to be reported.
- 5. Recommendations in line with CERT-IN compliant.
- 6. Final Report of Cyber Security Audit in NSEGS across all departments to be submitted immediately after the completion of the Audit activity.
- 7. Presentations on the Cyber Security Audit Report, its findings, conclusions, and recommendations
- 8. Security Audit Certificate for all the audited websites.

The bidder will analyse all reports, which has to be shared with representatives to keep NSEGS informed about cyber threats at present and in future at NSEGS IT facilities. The bidder will identify current and future cyber threats to NSEGS IT facilities and propose to take actions to mitigate such upcoming cyber threats and vulnerabilities so identified.