BVA RFQ S-44000-00016305_Penetration Testing.docx

S-44000-00014806

BVA RFQ S-44000-00016305 Penetration Testing

REQUEST FOR QUOTES (RFQ)

Best Value Analysis Process

Issue Date: March 12, 2026 at 03:00 PM

Issuing Office: Department of Consumer and Business Services

RFQ Contact Information

Service Category: Information Security Services

Issued to:

1. Introduction:

Authorized Purchaser is issuing this RFQ to obtain professional penetration testing services to assess the security posture of the agency’s information systems.

The length of the Work Order Contract (WOC) is estimated to be three months. Work must be completed by June 30, 2026.

2. Background Information:

The Oregon Department of Consumer and Business Services (“DCBS” or “Client”) is Oregon’s largest consumer protection and business regulatory agency. DCBS is a resource to consumers and businesses in areas involving building safety, finance, and workplace health and safety.

The goal is to identify exploitable vulnerabilities, validate existing security controls, and provide actionable remediation guidance to reduce organizational risk.

3. Scope of Services:

Professional consultant (Offeror) shall evaluate Agency’s vulnerabilities by performing penetration testing using exploits similar to the following:

· Social Engineering,

· Service Desk Exploit

· Phishing

· Web Services

· Physical Pentest

· Network Access

· Wi-Fi

· On-Lan Wi-Fi

· Hot Network Jack

· Device Security

· Employee Laptop

Offeror shall:

· Deliver a Rule of engagement document outlining how offeror plans to perform the penetration testing.

· Create an executive summary suitable for leadership and non-technical stakeholders.

· Create a detailed technical report including:

· Description of findings

· Risk Ratings (CVSS or equivalent)

· Affected Systems

· Clear remediation recommendations

· Create mapping of findings to security frameworks where applicable (CIS Controls, NIST)

· Host a post-engagement debrief session.

More details can be found in Attachment A, Sample Contract.

4. Questions and Requests for Clarification:

All questions and requests for clarification regarding this RFQ must be submitted in writing by email to the Authorized Representative and must be received no later than March 19, 2026 at 3:00 PM.

When appropriate, as determined by Authorized Purchaser in its sole discretion, revisions, substitutions or clarifications of the RFQ will be sent electronically.

5. Quotation Submittal:

Quotes must be received on or before the Offer Due Date and Time at the location identified above to be considered. Quotes will not be accepted after the Offer Due Date and Time. Quotes will be accepted by e-mail, regular mail or hand delivery to the Authorized Representative identified above. Authorized Purchaser may extend the Offer Due Date when it is in the best interest of Authorized Purchaser.

Authorized Purchaser may reject all Quotes or to cancel this RFQ if in its sole determination, it is in the best interest of Authorized Purchaser.

6. Submittal Requirements:

a. Quotes must include a description of Offeror’s methodologies for providing the deliverables as described in Exhibit No. 1, and a draft Statement of Work based upon the Scope of Services described in Section 3.

b. Quotes must include a description of the Offeror’s qualifications and experience in working in the field. Please include total years of experience and list any similar services provided to other government agencies.

i. Quotes may include a description of past projects Offeror has completed that are similar in scope to what is being requested in this RFQ. Similar in scope means scanning and testing websites, and providing compliance training for staff in government, business, or commercial facilities.

c. Quotes must include a description of Offeror’s Key Persons, other staff, and their experience, including resumes.

d. Quotes must include submission of the Pricing Sheet (Exhibit No. 1).

e. Offeror may submit Attachment B – Disclosure Exemption Affidavit (Optional)

Quote submissions will be reviewed to determine if all Submittal Requirements have been met. Those meeting the Submittal Requirements will be evaluated to determine the “Best Value” for the State. “Best Value” is based solely on the evaluator’s determination of what best meets the needs of the State taking into account the considerations set out in this section of the RFQ. The scored evaluation includes assessment of all required initial submissions, but with the possible exception of the initial cost quote; which the Authorized Purchaser may defer to a subsequent round for scored evaluation. The Authorized Purchaser, with prior notice to Offerors, may revise submission and evaluation requirements for cost quote scored assessment.

Scoring categories and their related “maximum points” are listed in Figure 1, Scoring Criteria (BVA) and Weights. Offers will be evaluated in a single or multiple tier evaluation process depending on the scoring results after first tier evaluation. Evaluation includes review, assessment and scoring of non-cost component and cost component submissions as follows:

7. Evaluation:

7.1 Non-Cost Component Evaluation in Tier 1.

The Percentage of Points awarded in each non-cost scoring category is based upon Figure 2, Rating Scale. An Evaluation Committee (“Committee”) designated by the Authorized Purchaser will evaluate non-cost submissions. Each non-cost category will be scored based on the information provided in the Quotes in the context of the Rating Scale set out below in Figure 2. Using the Rating Scale, each evaluator will score by determining what percentage of the maximum possible points to attribute to an evaluation component. The Rating Scale provides guidance to evaluators concerning their required qualitative, subjective assessment of how well an Offeror addresses the elements and essentials prescribed in each scored component in terms of the Offeror’s demonstrated knowledge and likely capacity and capability to develop, deliver, and perform in the context of the relevant Tasks and Deliverables at issue in a submission requirement.

Authorized Purchaser will average the final scores for each non-cost quote submission evaluated and scored (calculated by totaling the points awarded by each Committee member and dividing by the number of members). The calculated average is the final score. Based on scores from the first tier evaluation, the Authorized Purchaser may determine to award a contract to the top-ranking Offeror, select one or more of the top-scoring Consultant(s) as finalists for the second tier evaluation, or determine to cancel the solicitation.

7.2 Cost Quote Component Evaluation in Tier 1

Authorized Purchaser may decide to defer calculation of cost points until a subsequent tier of evaluation, if any, limiting such calculation to the top-ranking Offerors who will compete in that round of evaluation. When scored, Cost Quote points will be awarded on the basis of the formula set out below.

B (Offeror’s cost score)

X (Offeror’s cost being scored)

“A”, the available cost points for the Offeror, is the maximum possible total of 200 cost points reduced by the percentage of points not awarded for all non-cost scored components. For example, if an Offeror receives 80% of all possible non-cost points, then that Offeror has 200 “available” cost points (80% of 250). Depending on the results of non-cost component scoring, each Offeror may have a different quantum of “available” cost points in the context of 250 maximum possible cost points.

7.3 Tier 2 Evaluation

If conducted, the second tier evaluation will consist of interviews with Offeror’s Key Persons and additional presentations that the Authorized Purchaser may require, including revised Cost Quote and example work submission.

Figures 1 and 2 are on the next page Figures 1 and 2:

Figure 1. Scoring Criteria (BVA) and Weights

Each non-cost category will be scored based on the information provided in the Quotes in the context of the Rating Scale set out below.

Figure 2. Rating Scale

90 – 100% OUTSTANDING - Response meets all the requirements and has demonstrated in a clear and concise manner a thorough knowledge and understanding of the subject matter and opportunity. The Offeror provides deep and meaningful insight into its expertise, knowledge, and understanding of the subject matter.

8. Award:

The Offeror with the highest-scored Quote will be awarded a Contract in a form substantially similar to the Work Order Contract form attached to the MPSA. SPC may negotiate Contract terms and conditions with the successful Offeror. SPC may award less than the full scope described in this RFQ.

EXHIBIT NO. 1

RFQ Pricing Sheet

TOTAL MAXIMUM NOT-TO-EXCEED COST

image1.png