IT Security Assessment Services

A government authority in Hastings, Minnesota is seeking a contractor to provide IT security assessment services. The selected firm will be granted timely access to relevant systems, networks, applications, documentation, personnel, credentials, test accounts, and VPN access needed to perform penetration testing and related assessment activities. The authority will also communicate applicable security policies, compliance requirements, operational procedures, and any restrictions that may affect testing methods or scheduling.

The scope includes threat modeling to develop an organizational profile from an attacker’s perspective, vulnerability enumeration across externally and internally exposed systems and critical assets, and defensive validation to assess the effectiveness of current detection and response methods. The contractor is also expected to perform safe, controlled exploitation analysis to demonstrate potential real-world impacts, including possible sensitive data exposure through issues such as information leakage or social engineering.

Deliverables include interim findings, status updates, draft reports, and actionable recommendations for remediation of identified vulnerabilities, risky practices, and exposure points. The assessment should also provide recommendations for protecting key county assets and improving the effectiveness of current defensive mechanisms and attack detection capabilities. Questions are to be submitted no later than August 7, 2026.