RFP 019-0-2026HM ADD 1.pdf

This is an addendum to RFP 019-0-2026/HM issued by Newport News Public Schools (NNPS), the ninth largest school division in Virginia serving approximately 26,500 students across 50+ facilities. NNPS is procuring comprehensive cybersecurity penetration testing and operational framework review assessment services, including vulnerability assessments, external and internal penetration testing, wireless penetration testing, firewall evaluation, data governance review, information security policy development, security awareness training, and physical penetration testing. Optional services include cloud assessments, compromise assessments, and HVAC/CCTV penetration testing. NNPS will provide one teacher laptop and one student Chromebook; the contractor must supply all other materials and equipment. All deliverables, including detailed assessment reports with findings and remediation recommendations, must be completed within four weeks of testing completion. An optional pre-proposal conference is scheduled for April 14, 2026, at 10:00 AM EST via Zoom. Written questions are due by April 15, 2026, at 10:00 AM EDT, and proposals must be submitted via eVA by April 27, 2026, at 10:00 AM EST. The contract term is one year from the latest signature date with four optional one-year renewal periods available at the same prices and terms.

Proposals are evaluated on qualifications and experience (35 points), methodology and approach/tools (30 points), deliverables (20 points), and price (15 points). Pricing must be submitted as a lump sum total with itemized cost breakdowns for each service category, covering all materials, equipment, incidentals, and service delivery fees. Proposal bonds equal to 5% of the total proposal price are required for proposals of $100,000 or more, and performance and payment bonds equal to 100% of the contract price are required if the project exceeds $500,000. The contractor must maintain workers' compensation coverage at statutory limits, automobile liability of $1,000,000, commercial general liability of $1,000,000, and umbrella/excess liability of $5,000,000. Payment will be made via electronic funds transfer within 30 days of invoice receipt for completed and accepted work. No set-aside designations or restrictions limiting organization types are specified, and no specific budget range or award value is disclosed. The contractor must comply with Virginia Code section 2.2-4367 to 2.2-4377 regarding ethics in public contracting and maintain SSAE 16 SOC Type II reports annually documenting verified controls.