RFI C000952 Vulnerability Disclosure Service

***AMENDMENT - added Attachment 2 - Vendor Questions & ITS' reponses - to vendor submitted questions in "Document" section of this ad. The New York State Office of Information Technology Services (ITS) is seeking responses to this Request for Information (RFI) from the vendor community to identify vendors capable of delivering Vulnerability Disclosure Services that focus on a service offering that includes a served public website, front-end disclosure evaluation and a comprehensive vulnerability disclosure service following New York State Vulnerability Disclosure Program (VDP) standards in a timely and cost-effective manner. Cybersecurity application vulnerabilities along with infrastructure vulnerabilities and phishing attacks are the three major avenues that attackers take to compromise an organization. Scanning for vulnerabilities identifies many types of vulnerabilities but nothing is better than trained personnel utilizing the tools and techniques of the attackers to determine if an application is vulnerable. This service should include not only the front-end but the capability to validate researcher reported findings, track and communicate finding status with NYS ITS and the researchers, as well as reporting volume, severity and other metrics to NYS ITS and were requested back to the researchers and public through a website dashboard. NO AWARD WILL BE MADE. This RFI is for planning and informational purposes only and does not constitute a commitment to a future procurement. RFI C000952 Vulnerability Disclosure Service will also be published at https://its.ny.gov/competitive-procurement-opportunities.