When is the submission deadline?

Submissions are due October 1, 2026. Questions must be submitted by September 24, 2026.

It was issued by District Of Columbia Housing Finance Agency. The work is located in Washington, District of Columbia, United States.

Who is a good fit for this opportunity?

Cybersecurity firm specializing in gray box penetration testing. Experience assessing government networks, systems, and applications. Skilled in vulnerability analysis, exploitation, privilege escalation, and internal testing. Ability to perform controlled testing outside normal business hours. Strong record of delivering actionable remediation plans and cybersecurity recommendations.

RFP HunterNever miss another opportunity you should have won.

Book a demo

See More RFPs

IT Penetration Testing Services

Book a demo

Overview

Cybersecurity & Data Privacy

Washington, District of Columbia, United StatesPosted: August 31, 2026Deadline: October 1, 2026

Settle Signals

Market intelligence for public sector sales teams

RFP Hunter shows what is open. Settle shows what is forming.

Settle pieces together buyer signals, budgets, contract activity, and the sources your team already monitors. See why an opportunity fits and what to do before the RFP posts.

Learn more about Settle

SUMMARY

A Washington, DC government authority seeks a qualified provider for one year of gray box IT penetration testing. Services must assess vulnerabilities and security controls while delivering actionable remediation recommendations without causing outages or data loss.

KEY REQUIREMENTS

Must have experience providing penetration testing services for government or similar organizations within the past three years
Must provide Gray Box testing methodology
Must adhere to industry standards including OWASP, NIST/CIS, and OSSTMM
Must maintain professional liability insurance with limits of at least $1,000,000 per claim and $2,000,000 annual aggregate
Must maintain commercial general liability insurance with limits of at least $1,000,000 per occurrence and $2,000,000 general aggregate
Must provide a penetration testing plan within 15 days of contract award
Must be authorized and in good standing under the laws of the District of Columbia
Must provide a Clean Hands Certificate for awards in excess of $100,000
Must provide a Certificate of Good Standing for awards in excess of $100,000

CONTRACT DURATION

12 months

TIMELINE

Proposals are due by October 1st, 2026 at 2:00 p.m. local time.

Questions must be submitted no later than seven days prior to the date set for receipt of offers.

QUESTION DEADLINE

September 24, 2026

CONTACTS

Primary procurement contact — name, title, email, and phone

Additional decision-makers and their departments

See Decision-Maker Contacts

Issuing Agency

District Of Columbia Housing Finance Agency

Organization overview and procurement intelligence available on paid plans.

See Issuer Research

DESCRIPTION

A government authority in Washington, DC is seeking a contractor to provide IT penetration testing services under a one-year contract. The engagement will use gray box testing to identify vulnerabilities across the agency’s network, systems, and applications; evaluate existing security controls; assess potential risks; and provide actionable recommendations to mitigate identified findings.

The contractor will also provide options for implementing recommended solutions, relevant resource references, and guidance to strengthen the agency’s cybersecurity posture. Testing will be conducted outside the agency’s business hours and may include reconnaissance and enumeration, vulnerability identification, exploitation and privilege escalation, internal lateral movement, impact analysis, and validation of findings. Testing must not intentionally cause system outages or delete data.

Similar RFPs

Frequently asked questions

When is the submission deadline?: Submissions are due October 1, 2026. Questions must be submitted by September 24, 2026.
Who issued this RFP?: It was issued by District Of Columbia Housing Finance Agency. The work is located in Washington, District of Columbia, United States.
Who is a good fit for this opportunity?: Cybersecurity firm specializing in gray box penetration testing
Experience assessing government networks, systems, and applications
Skilled in vulnerability analysis, exploitation, privilege escalation, and internal testing
Ability to perform controlled testing outside normal business hours
Strong record of delivering actionable remediation plans and cybersecurity recommendations

Analysis generated by Settle AI from the source RFP.

RFP Hunter shows what is open. Settle shows what is forming.

Settle pieces together buyer signals, budgets, contract activity, and the sources your team already monitors. See why an opportunity fits and what to do before the RFP posts.

See how Settle works