When is the submission deadline?

Submissions are due October 1, 2026. Questions must be submitted by September 24, 2026.

It was issued by District Of Columbia Housing Finance Agency. The work is located in Washington, District of Columbia, United States.

Who is a good fit for this opportunity?

Cybersecurity firm specializing in IT penetration testing and offensive security. Experienced in web application, network, and internal environment assessments. Proficient in OWASP methodologies and industry-standard testing practices. Qualified personnel with recognized penetration testing and security certifications. Demonstrated experience supporting government or public-sector clients. Capable of conducting controlled tests without intentional service disruption or data loss.

IT Penetration Testing Services (Due October 1, 2026)

A Washington, DC government authority seeks qualified vendors to conduct IT penetration testing that simulates real-world attacks and evaluates security controls. Testing must follow industry standards, avoid intentional disruption or data deletion, and use agency-approved IP addresses.

Must have experience providing penetration testing services for government or similar organizations within the past three years
Must provide Gray Box testing methodology
Must adhere to industry standards including OWASP, NIST/CIS, and OSSTMM
Must maintain professional liability insurance with limits of at least $1,000,000 per claim and $2,000,000 annual aggregate
Must maintain commercial general liability insurance with limits of at least $1,000,000 per occurrence and $2,000,000 general aggregate
Must be authorized and in good standing under the laws of the District of Columbia
Must provide a penetration testing plan within 15 days of contract award
Must provide a detailed penetration testing report within 10 business days of testing completion
Must provide a debriefing session within 10 business days after report submission
Must be certified as a business enterprise at the time of submission to receive preference points

Proposals are due by October 1st, 2026 at 2:00 p.m. local time.

Questions must be submitted no later than seven days prior to the date set for receipt of offers.

Primary procurement contact — name, title, email, and phone

Additional decision-makers and their departments

The government authority in Washington, DC is seeking a vendor to provide IT penetration testing services designed to simulate real-world attacks and evaluate the effectiveness of its information technology security controls.

The services should be delivered in accordance with applicable industry standards, including the Open Web Application Security Project (OWASP). Testing activities are expected to include reconnaissance and enumeration, vulnerability identification, exploitation and privilege escalation, internal lateral movement, impact analysis, and validation of findings. Testing must not intentionally cause system outages or delete data, and all testing must use IP addresses registered and approved by the agency.

IT Penetration Testing Services

Overview

Settle Signals

SUMMARY

KEY REQUIREMENTS

CONTRACT DURATION

TIMELINE

QUESTION DEADLINE

CONTACTS

Issuing Agency

DESCRIPTION

Similar RFPs

Frequently asked questions

RFP Hunter shows what is open. Settle shows what is forming.