IWQ 127067 Ad 1.pdf
PDF 189 KB Posted
- Solicitation number
- PE-77023-NONST-2026-000000529
- Issued by
- Gwinnett County, Georgia
About this file
This is an addendum to a Request for Quotes (RFQ) issued by Gwinnett County, Georgia for the provision of PCI penetration testing services. The addendum, dated March 17, 2026, announces a revised deadline for quote submissions of 3:00 pm on March 20, 2026. The scope of work includes both external and internal penetration testing of the County's cardholder data environment (CDE), with one CDE identified in the environment. Respondents must complete all forms included in the original quote invitation and submit responses via email to Bethany.White@GwinnettCounty.com. The County has previously engaged external service providers for PCI penetration testing and will not mandate adherence to a specific testing methodology; instead, service providers should propose their standard PCI testing methodology. The County prefers that awarded vendors access the testing environment through an OVA/Virtual machine provisioned by the County's ITS team, though VPN access is available as an alternative.
Regarding technical requirements, acceptable certifications include OSCP, GPEN, or GXPN; the County expressed no preference for PCI-certified Assessor Service Providers (ASVs) or Qualified Security Assessors (QSAs). Specific environmental details including the total number of IP addresses in scope, the number of live systems, the list of live systems, the number of source network segments, concurrent scanning permissions, and whether the CDE and corporate network share Active Directory infrastructure will be provided to the awarded service provider post-award. Vendors responding to this RFQ must sign and return the addendum with their quote submissions; failure to do so may result in the quote being deemed non-responsive.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| IWQ 127067 INV.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
March 17, 2026
Addendum #1
IWQ 127067
The due date has changed. Quotes Should Be Received By: 3:00 pm on March 20, 2026.
Questions
Q1. What is the format for RFQ responses? Does the County want a full proposal or just the quote and other required forms?
A1. All of the forms from the quote invitation should be completed. There is nothing additional required. They can be returned via email to Bethany.White@GwinnettCounty.com
Q2. The certification requirements are listed as “OSCP or equivalent.” What would the County consider to be an equivalent certification, for example, CEH, GPEN, GXPN?
A2. GPEN or GXPN are acceptable.
Q3. Does the County have a preference for a service provider that is a PCI-certified ASV or QSA?
A3. We do not have a preference.
Q4. Has the County previously conducted PCI penetration testing for this environment, and if so, was it performed by an external service provider?
A4. Yes, the County has previously conducted PCI penetration testing and it was performed by an external service provider.
Q5. Does the County require adherence to a specific penetration testing methodology, or should service providers propose their standard methodology?
A5. The service provider should propose their standard PCI testing methodology.
Q6. For the internal penetration testing described in the quote invitation, will the awarded service provider access the environment through a County-provided VPN or remote testing platform?
A6. The County can provide a VPN connection but the preferred method is a OVA/Virtual machine is sent to the county and the county’s ITS team will provision the virtual machine for testing purposes.
Q7. How many CDE’s exist in the environment?
A7. 1
Q8. How many total IP addresses are in scope for discovery scanning [available IP address space within each CDE(s)]?
A8. This information will be provided to the awarded service provider.
IWQ 127067
Addendum 1
Q9. How many live systems (i.e. active IP addresses) are each CDE(s)?
A9. This information will be provided to the awarded service provider.
Q10. Will you provide a list of live systems within each CDE? (ex: 192.168.111.111, 192.168.222.222, etc) A10. A subnet scope will be provided.
Q11. What is the number of source network segments? (i.e. Corporate LAN, Management LAN, Server
LAN, Retail store, etc.)?
A11. This information will be provided to the awarded service provider.
Q12. If there is more than one source network, is concurrent scanning from the source networks against the CDEs allowed?
A12. This information will be provided to the awarded service provider.
Q13. Do the CDE and Corp Network share Active Directory infrastructure?
A13. This information will be provided to the awarded service provider.
This addendum should be signed in the space provided below and returned with your quote. Failure to do so may result in your quote being deemed non-responsive.
Sincerely, Bethany White Purchasing Associate II
Company Name
Authorized Representative
File details come from the government source that posted it. Updated .