Crowdsource Pentesting RFI.pdf

Request for Information (RFI) SP-CIO-908761

Request for Information

U.S. Office of Personnel Management

OPM Crowdsource Pentesting

Background and Purpose

The mission of the Office of Personnel Management (OPM) is to be a champion of talent for the Federal government, and we endeavor to position the Federal government as a model employer that empowers our workforce to solve our nation's toughest challenges. The mission of the Office of the Chief Information Officer (OCIO), Cybersecurity Division’s (CSD) mission is to achieve full visibility of OPM’s systems and processes to ensure compliance and risk reduction activities to meet OPM’s risk tolerance. CSD oversees the implementation of The Federal Information Security Management Act (FISMA), National Institute of Standards and Technology (NIST) Risk Management Framework, Cybersecurity and Infrastructure Security Agency’s (CISA) Binding Operational and Emergency Directives, and Office of Management and Budget (OMB) Directives and memos. Operations support provides critical day-to-day operations and maintenance of services used by our customers routinely, from cloud Microsoft 365 to application support, to on-premises server maintenance. The organization is geographically dispersed across primary locations in Washington DC, Boyers, Pennsylvania, and Macon, Georgia.

The purpose of this RFI is to identify FEDRAMP certified software and service applications that perform the testing of system vulnerabilities in order to improve the overall security posture of the Agency. The software and support services will provide for continuous penetration testing for vulnerability discovery and assessment of external facing web pages and applications for both existing and new vulnerabilities. It will include professional services support (where applicable) in support of Enterprise Network, Security Operations Center (SOC) and Enterprise Monitoring Solutions.

Format for the Submission of Responses:

The attached spreadsheet provides a format for response to this RFI (Attachment 01). This spreadsheet is intended to minimize the effort of the respondent and structure the responses for ease of analysis by the Government. Respondent may also attach a capabilities statement.

Information Submission Instructions

All information sent in response to this RFI shall be in Excel Spreadsheet format (Attachment

01) and shall be submitted electronically to Elizabeth.Finley2@opm.gov by 5PM ET April 24, 2024. TELEPHONE INQUIRIES WILL NOT BE ACCEPTED.

Request for Information (RFI) SP-CIO-908761

Additional Information

This RFI is only for the purpose of identifying potential sources and supplemental information as part of OPM’s market research. No Request for Quotation (RFQ) exists; therefore, please do not request a copy of the RFQ.

Responses to this RFI are not quotes on which OPM can issue any contracts or orders. This RFI is issued for information and planning purposes only and does not itself constitute a RFQ. The Government does not intend to award a contract or order based only on responses to this RFI.

Interested parties must not submit proprietary or competition sensitive information within their response.

Responses to the RFI will not be returned. Responders are solely responsible for all expenses associated with responding to this RFI. OPM will not pay for information received in response to this RFI.

There is no commitment by the Government to respond to any questions received, issue a RFQ, make an award or awards, or to be responsible for any monies expended by industry responses to this RFI.

Attachment to the RFI:

1. Attachment 01: Vendor Response Template