biddoc.pdf

Town of Monument RFP No. 26-009 Page 1

REQUEST FOR PROPOSALS (RFP)

NETWORK ENVIRONMENT

PENETRATION TESTING AND

SECURITY ASSESSMENT SERVICES

RFP NO: 26-009

RFP ISSUANCE DATE: AUGUST 13, 2026

PROPOSAL DUE DATE: SEPTEMBER 9, 2026

Town of Monument RFP No. 26-009 Page 2

1. Solicitation Overview

• Solicitation Number: 26-009

• Issuing Agency: Town of Monument, Colorado

• Contract Term: The initial contract term shall be for one (1) year commencing upon execution of the agreement. Subject to satisfactory performance, mutual agreement of the parties, and availability of appropriated funds, the Town may extend the agreement for additional terms. In no event shall the total contract duration exceed thirty-six (36) months.

• Questions Due: August 26, 2026, 4:30 p.m. MDT

• Proposal Due Date: September 9, 2026, 5:00 p.m. MDT

• Proposals must be submitted electronically through BidNet Direct under RFP No. 26-

009 no later than September 9, 2026, at 5:00 p.m. MDT. Email, physical, facsimile, or other submissions will not be accepted. BidNet’s recorded submission time will control. Vendors are responsible for completing uploads before the deadline.

2. Purpose and Background

The Town seeks proposals from qualified cybersecurity firms to conduct a baseline penetration test and security assessment of the Town's information technology environment. This assessment is intended to provide an initial evaluation of the Town's cybersecurity posture by identifying significant vulnerabilities, security misconfigurations, and areas of elevated risk within key technology systems.

The Town utilizes a managed services provider (MSP) that supports daily IT operations, including help desk services, Microsoft 365 administration, network administration, server management, firewall management, cybersecurity monitoring, and management of various security technologies. The selected vendor will be expected to coordinate with

Town staff and the Town's MSP throughout the engagement as necessary.

The assessment shall include a review and limited penetration testing of the Town's external network perimeter, internal network infrastructure, core identity services, Microsoft 365 environment, and CJIS-related systems supporting the Police Department.

The purpose of this engagement is to establish a cybersecurity baseline, validate the effectiveness of existing security controls, prioritize remediation efforts, and support the

Town's multi-year cybersecurity improvement program.

This engagement is intended to be a foundational assessment and is not expected to include exhaustive testing of all systems, applications, or user populations. Future assessments may expand scope and testing depth based on findings and remediation efforts resulting from this baseline engagement.

Town of Monument RFP No. 26-009 Page 3

3. Current Environment Overview

The Town's technology environment consists of Microsoft 365 and Microsoft Entra ID cloud services, on-premises Active Directory, virtual and physical server infrastructure, firewall and network security technologies, managed endpoint protection solutions, CJIS-related Police Department systems, and supporting network infrastructure. Town operations are conducted across four primary facilities: Town Hall, Public Works, the

Water Laboratory, and the Parks/Streets/Fleet Facility. Each facility maintains an independent internet connection and perimeter firewall to support operational and security requirements.

The Town also operates a Supervisory Control and Data Acquisition (SCADA) environment supporting water operations. The SCADA environment is managed separately by the Water Department and a third-party contractor and is not within the scope of this solicitation or the associated penetration testing activities.

The Town's information technology environment is managed by a third-party Managed

Services Provider (MSP) under contract with the Town.

The Town may provide supplemental environment information to prospective vendors through written responses to questions, addenda, or other procurement communications.

Such information may include approximate user counts, endpoint counts, server counts, facility information, and other non-public details deemed necessary for proposal preparation. The Town reserves the right to limit disclosure of information that could adversely affect the security of Town systems or operations.

4. Scope of Services

External Network Assessment

The selected vendor shall perform a limited external penetration test of the Town's internet-facing systems to identify vulnerabilities that could be exploited by an external threat actor.

Activities may include:

• External vulnerability discovery and validation

• Identification of exposed services and security misconfigurations

• Limited exploitation of vulnerabilities to demonstrate risk

• Validation of external security controls

Internal Network Assessment

The selected vendor shall conduct a baseline internal network penetration test from a trusted internal network perspective.

Town of Monument RFP No. 26-009 Page 4

Activities may include:

• Identification of high-risk vulnerabilities

• Security configuration review of selected systems

• Basic privilege escalation and lateral movement testing

• Identification of weaknesses that could facilitate unauthorized access

• The Town will provide mutually agreed testing access, workspace, network connectivity, and technical coordination necessary to conduct internal assessment activities.

Identity and Access Management Assessment

The selected vendor shall assess core identity services, including:

• Active Directory security posture

• Privileged account review

• Password and authentication controls

• Identification of common Active Directory security weaknesses

Testing should focus on significant risks and misconfigurations rather than a full Active

Directory adversary simulation.

Microsoft 365 Assessment

The selected vendor shall perform a security review of the Town's Microsoft 365 environment, including:

• Microsoft Entra ID configuration review

• Multi-factor authentication implementation

• Conditional Access policies

• Administrative roles and privileged accounts

• Exchange Online and tenant-level security settings

This assessment is intended to identify significant security gaps and configuration issues and is not expected to include advanced cloud penetration testing activities.

CJIS-Focused Review

For systems supporting the Police Department, the selected vendor shall:

• Assess security controls associated with CJIS-related environments

• Identify vulnerabilities and configuration weaknesses

• Provide recommendations to improve security and CJIS alignment

Town of Monument RFP No. 26-009 Page 5

The assessment shall be coordinated to minimize operational impact on public safety systems. The assessment is not intended to constitute a formal CJIS compliance audit.

Coordination with Town MSP

The Town's technology environment is supported by an external Managed Services

Provider (MSP). The selected vendor shall coordinate with designated Town representatives and the MSP throughout the assessment, including project planning, scheduling, information gathering, testing activities, status updates, and review of findings.

The MSP may provide support activities including, but not limited to:

• Network and system documentation

• Asset inventories

• Firewall and network configuration information

• Microsoft 365 and identity management information

• Coordination of testing windows

• Review and validation of findings

• Assistance with remediation planning

The selected vendor shall remain responsible for all testing activities, analysis, findings, and recommendations produced as part of the engagement.

Assessment Communications and Escalation Procedures

The selected vendor shall establish communication and escalation procedures prior to commencement of testing activities. At a minimum, vendors shall:

• Identify a project manager and primary technical contact.

• Provide regular status updates throughout the engagement.

• Immediately report validated Critical severity findings to designated Town representatives.

• Coordinate all testing activities with Town personnel and the Town's MSP.

• Document escalation procedures for service interruptions, unexpected impacts, or security incidents encountered during testing.

• Identify emergency points of contact available during active testing periods.

Scope Exclusions

Unless specifically approved in writing by the Town, the following systems, services, and testing activities are excluded from the scope of this baseline assessment:

Town of Monument RFP No. 26-009 Page 6

• The Town's SCADA and industrial control systems supporting water operations.

• Systems owned, operated, or managed exclusively by third-party vendors that have not been expressly authorized for testing by the Town.

• Physical security assessments.

• Social engineering assessments, including phishing, vishing, or impersonation testing.

• Wireless penetration testing.

• Denial-of-service (DoS) or stress testing.

• Application source code reviews.

• Red team exercises or adversary emulation activities.

The Water Laboratory facility is within the scope of the assessment only to the extent that it connects to or utilizes the Town's corporate information technology environment. The separate SCADA environment supporting water operations is specifically excluded from testing.

The Town reserves the right to expand or modify the scope of services through mutual agreement with the selected vendor.

5. Deliverables

The selected vendor shall provide:

Executive Summary

A management-level report including:

• Overall cybersecurity posture assessment

• High-level findings

• Risk summary

• Strategic recommendations

Technical Report

A detailed report containing:

• Methodology

• Findings and supporting evidence

• Risk ratings

• Impact descriptions

• Recommended remediation actions

Town of Monument RFP No. 26-009 Page 7

• Risk ratings should utilize CVSS v3.1 or another industry-recognized methodology and include Critical, High, Medium, Low, and Informational classifications.

• The fixed-price proposal shall include one remediation validation and retesting cycle for all Critical and High severity findings for which the Town completes remediation within sixty (60) calendar days after final report delivery. Additional retesting, expanded validation, or validation requested after the sixty-day period may be proposed as separately priced optional services.

Deliverable Format Requirements

Final reports shall be provided electronically in searchable PDF format. Upon request, the vendor shall provide editable versions of reports in Microsoft Word format. Presentation materials shall be provided electronically.

Findings Presentation

A remote or onsite presentation to Town leadership and IT staff summarizing results and recommendations.

6. Vendor Qualifications

The vendor shall have demonstrated experience conducting penetration testing engagements.

Key personnel assigned to the engagement shall possess relevant industry certifications, such as OSCP, GPEN, GXPN, CISSP, CEH, or equivalent credentials.

Personnel assigned to CJIS-related testing activities shall be capable of satisfying applicable CJIS access or background requirements if required by the Town.

Experience with:

• Microsoft 365

• Active Directory

• Entra ID

• Government or public-sector environments

7. Testing Methodology and Tools

The selected vendor shall utilize industry-recognized penetration testing methodologies and commercially reasonable tools appropriate for the scope of services. Vendors shall identify the primary tools, frameworks, and techniques proposed for use during the engagement.

Town of Monument RFP No. 26-009 Page 8

The Town does not require the use of any specific product or software platform;

however, testing should be conducted using accepted cybersecurity assessment practices and tools commonly utilized within the industry.

Testing methodologies should align with recognized standards such as:

• National Institute of Standards and Technology (NIST)

• Open Worldwide Application Security Project (OWASP), where applicable

• Penetration Testing Execution Standard (PTES)

• Center for Internet Security (CIS) best practices

• Criminal Justice Information Services (CJIS) Security Policy requirements, where applicable

8. Rules of Engagement

The selected vendor shall comply with the Town's Rules of Engagement for all assessment activities. At a minimum:

• No testing activities shall commence until the Town and the selected vendor have approved a mutually agreed Rules of Engagement and Authorization to Test document identifying approved targets, testing windows, points of contact, escalation procedures, and testing restrictions.

• Testing activities shall be coordinated with designated Town and MSP personnel.

• Testing windows shall be mutually agreed upon before the commencement of testing.

• The vendor shall identify a project manager and primary technical contact.

• Critical vulnerabilities that present an immediate risk to Town operations shall be reported promptly upon validation.

• The vendor shall immediately notify the Town of any unanticipated service interruption, system instability, or operational impact resulting from testing activities.

• The Town reserves the right to suspend or terminate testing activities at any time if operational, safety, or security concerns arise.

• The vendor shall maintain logs of testing activities and provide them upon request.

Town of Monument RFP No. 26-009 Page 9

• Denial-of-service testing, social engineering, wireless testing, SCADA testing, and any other excluded activities remain prohibited unless specifically authorized in writing by the Town.

• The vendor shall protect all information obtained during the engagement and shall not disclose such information except as authorized by the Town.

9. Proposal Requirements

Vendors shall provide responses addressing the following:

Technical Approach

1. The testing methodology to be used.

2. The primary assessment tools proposed for the engagement.

3. How findings are validated to reduce false positives.

4. The qualifications and certifications of personnel conducting the assessment.

5. The estimated timeframe for testing activities, draft report delivery, final report delivery, and presentation of findings.

Vendor Experience and Qualifications

Vendors shall provide:

1. A brief company overview, including years of experience providing penetration testing and cybersecurity assessment services.

2. A description of the vendor's experience conducting similar assessments for municipal, government, public-sector, or CJIS-related environments.

3. A description of at least two (2) comparable engagements completed within the past four (4) years, including the scope of services provided and client type.

4. Identification of key personnel assigned to the engagement and a summary of their relevant experience and certifications.

5. A minimum of two (2) client references for projects of similar scope and complexity, including organization name, contact name, title, phone number, email address, and a brief description of services provided.

6. A redacted sample executive summary and/or technical findings report from a similar engagement (optional but encouraged).

Vendor Collaboration and Communication

Vendors shall describe their approach to collaborating with third-party managed service providers during penetration testing engagements. Responses should address:

Town of Monument RFP No. 26-009 Page 10

• Communication methods and project governance.

• Information gathering and documentation requirements.

• Coordination of testing activities and maintenance windows.

• Handling of findings involving MSP-managed systems and services.

• Delivery of findings and remediation recommendations to both Town staff and authorized MSP personnel.

The Town seeks a vendor that employs a structured, risk-based penetration testing methodology utilizing both automated and manual testing techniques. Preference will be given to methodologies that validate findings through controlled testing, minimize false positives, prioritize risks based on business impact, and provide practical, actionable remediation recommendations. Vendors shall clearly describe their methodology, testing procedures, validation processes, reporting approach, and experience supporting municipal government, Microsoft 365, Active Directory, and CJIS-related environments.

Because portions of the Town's technology environment are managed by a third-party

Managed Services Provider (MSP), the selected vendor shall demonstrate an ability to coordinate effectively with both Town personnel and MSP representatives to facilitate information gathering, assessment activities, communication of findings, and remediation planning.

10. Proposal Format and Submission Requirements

Proposals shall be organized in the following order:

1. Cover Letter

2. Company Background and Qualifications

3. Technical Approach and Methodology

4. Project Team and Key Personnel

5. Relevant Experience and References

6. Deliverables and Reporting Approach

7. Cost Proposal

8. Exceptions or Requested Contract Modifications

9. Additional Supporting Information

10. Vendors shall provide a fixed-price proposal covering all labor, testing activities, project management, reporting, travel, meetings, and other costs required to complete the engagement.

Town of Monument RFP No. 26-009 Page 11

11. Optional services, including additional remediation validation, additional retesting cycles, validation requested after the included sixty (60) day remediation period, or expanded testing scopes, may be proposed as separately priced optional services.

12. Proposals shall remain valid for ninety (90) calendar days following the proposal due date.

Town of Monument RFP No. 26-009 Page 12

11. Evaluation Criteria

Proposals will be evaluated by a review committee based on the criteria set forth below.

The Town will evaluate each proposal based on its overall merit, demonstrated ability to meet the requirements of this solicitation, and the value provided to the Town. Cost and overall value to the Town will be significant factors in the evaluation process; however, award will not necessarily be made to the lowest-priced proposal. The Town reserves the right to award a contract to the vendor whose proposal is determined to be in the best interest of the Town.

Proposed Evaluation Matrix

Evaluation Criteria Weight

Qualifications and Relevant Experience 20%

Proposed Methodology & Technical Approach 20%

Deliverables and Reporting Quality 15%

References / Government / CJIS Experience 20%

Cost Proposal 25%

The Town's objective is to select a qualified vendor capable of conducting a baseline penetration test and providing meaningful recommendations to support the Town's ongoing cybersecurity improvement efforts. While cost is an important evaluation factor, the Town may place greater emphasis on demonstrated qualifications, relevant municipal and cybersecurity experience, proposed methodology, quality of reporting, and overall value when determining the proposal that best meets the Town's needs.

12. Contract Term and Optional Future Services

The Town anticipates establishing a recurring cybersecurity assessment program. While this solicitation is limited to a baseline Year 1 assessment, the Town may, at its sole discretion and subject to applicable procurement requirements, consider additional or expanded assessment services in future years, including deeper penetration testing, Microsoft 365 reviews, wireless security assessments, application testing, remediation validation, and other cybersecurity consulting services.

Town of Monument RFP No. 26-009 Page 13

13. Procurement Timeline

All dates and deadlines are subject to change at the Town’s discretion. Any changes to the procurement timeline will be issued by written addendum or other written notice from the Town. All questions and requests for clarification shall be submitted through BidNet

Direct. Responses that alter, clarify, or interpret the RFP will be issued by written addendum. All times are Mountain Daylight Time.

• RFP Release Date: August 13, 2026.

• Questions Due: August 26, 2026, 4:30 p.m. MDT.

• Proposals Due: September 9, 2026, 5:00 p.m. MDT.

• Anticipated Evaluation Period: September 10, 2026 – September 18, 2026.

• Anticipated Award Notification: October 6, 2026.

14. Terms, Conditions, and Insurance

The Town reserves the right to negotiate and execute a mutually acceptable professional services agreement with the selected vendor. The selected vendor shall be required to meet the Town's insurance requirements and provide certificates of insurance and any required endorsements prior to contract execution.

By submitting a proposal, vendors acknowledge that additional contractual provisions related to insurance, indemnification, liability, confidentiality, cybersecurity, and data protection may be required as part of the final agreement.

Vendors should identify any material concerns regarding insurance, indemnification, liability, or other contractual terms in their proposal. Vendor exceptions may be considered during evaluation, contract negotiations, and award determination.

A. Tax Exemption

The Town, as a home rule municipality, is exempt from sales and use taxes. Vendors shall inform prospective subcontractors and suppliers of the Town's tax-exempt status.

Appropriate tax exemption documentation will be provided to the successful vendor upon request.

B. Pre-Contractual Expenses

The Town assumes no responsibility for costs incurred by vendors in preparing or submitting proposals, participating in interviews, demonstrations, negotiations, or otherwise responding to this solicitation.

C. Non-Discrimination

By submitting a proposal, the vendor agrees not to unlawfully discriminate against any employee, applicant, contractor, or member of the public on the basis of any characteristic protected under applicable federal, state, or local law.

Town of Monument RFP No. 26-009 Page 14

D. Governing Law

This solicitation and any resulting agreement shall be governed by the laws of the State of Colorado. Venue for any dispute arising from this solicitation or any resulting agreement shall be in the appropriate state court located in El Paso County, Colorado.

E. Public Records

All proposals submitted become the property of the Town and may be subject to disclosure under the Colorado Open Records Act, § 24-72-201, et seq., C.R.S. Vendors should clearly identify information they consider confidential or proprietary; however, the Town will determine disclosure obligations in accordance with applicable law.

F. Reservation of Rights

The Town reserves the right to cancel this solicitation, in whole or in part, at any time and for any reason without liability or obligation to any vendor. The Town further reserves the right to reject any or all proposals, waive informalities or irregularities, request clarification of proposal responses, conduct interviews or presentations, request best and final offers, and make an award deemed to be in the best interest of the Town.