A government authority located in Virginia is seeking a vendor to provide comprehensive cybersecurity penetration and vulnerability testing services. The selected firm will perform an Information Security penetration testing and operational framework review assessment, conducting audits of data systems and networks using the NIST 800–53 vendor-neutral framework. Required services include penetration testing, vulnerability assessments, and providing detailed reports with recommended remediation actions.

Vendors may use internal scanning agents if necessary. While penetration testing and network assessments may be performed after regular hours to avoid disruptions, all other work must be carried out during normal business hours (7:00 AM – 4:30 PM), unless otherwise specified. The scope includes on-site and remote testing, web application and website security assessments, and vulnerability evaluations of business systems used in Human Resources, Payroll, and the Business Office. Additionally, the assessment will encompass reviews of firewall configurations, applications, protocols, filters, firewall policies, and IPS configurations. A pre-bid meeting is scheduled for April 14, 2026, with all questions due by April 15, 2026.