RFP 019-0-2026HM Cybersecurity Addendum 2.pdf

PURCHASING DEPARTMENT Newport News Public Schools

757-591-4525/ FAX 757-591-4593 12465 WARWICK BOULEVARD • NEWPORT NEWS, VIRGINIA 23606-3041

April 28, 2026

Addendum #2

FOR IMMEDIATE ATTENTION

ADDENDUM NO. 2 TO ALL OFFERORS:

Reference – Request for Proposal: RFP #019-0-2026/HM

Cybersecurity Penetration & Vulnerability Testing For Delivery To: Newport News Public Schools Bid Submittals Due: May 8, 2026 at 10:00 AM EDT (CHANGED)

Responses to Offerors questions are as follows:

1. Network & Infrastructure Scope

a) Are all approximately 40,000 devices and all 50+ facilities in scope for testing, or will a subset or sampling methodology be used?

ANSWER: Ideally, we would like to review our entire network for potential vulnerabilities. We are open to narrowing down the scope to a smaller subset of devices and or/network segments. Please provide specific details on pricing/costs for both options.

b) How many public-facing IP addresses, domains, and internet-accessible systems are in scope for external vulnerability assessment and penetration testing?

ANSWER: Assessment scope includes a single /24 network (254 usable addresses) and 1 domain.

c) How many internal IP addresses, subnets, or VLANs are in scope for internal vulnerability assessment and penetration testing?

ANSWER: Assessment scope includes a /16 network of up to 65,534 usable addresses.

d) Are there any systems, networks, or environments explicitly out of scope due to operational or life-safety considerations?

ANSWER: All networks and systems are in scope for this engagement, with no exclusions.

e) Are there legacy, IoT, OT, HVAC, or CCTV systems that require modified or limited testing approaches?

ANSWER: Legacy, IoT, OT, HVAC, and CCTV systems are in scope. Testing will be conducted using non-disruptive methods. Any active or potentially disruptive testing will be scheduled during approved maintenance windows and require explicit approval prior to execution.

2. Wireless Environment

a) Section III.B.3.c references four wireless networks. Are these four distinct SSIDs, and are they located at a single facility or distributed across multiple locations?

ANSWER: The correct SSID count is 6, distributed across all physical sites.

b) How many facilities are expected to be included in wireless penetration testing?

ANSWER: There are 4 locations within the City of Newport News, Virginia. Locations will include schools and administrative sites (approximately 50 sites total).

c) Approximately how many wireless access points are deployed at in-scope facilities?

ANSWER: Access point density varies by location.

d) What authentication mechanisms are used for the wireless networks (e.g., WPA2-Enterprise, WPA3, captive portal)?

ANSWER: Authentication methods in use include WPA2-Enterprise, WPA2 and Captive Portal.

3. Vulnerability Assessment & Penetration Testing Approach

a) Will vulnerability assessment be delivered as a separate service and deliverable, or integrated into penetration testing?

ANSWER: Vulnerability assessment and penetration testing should be delivered as a combined engagement with a unified report.

b) Will internal and external testing primarily follow a black-box approach, or will limited credentials be provided for grey-box testing where appropriate?

ANSWER: Hybrid Methodology should be used. Black-box testing for external assessments and grey-box testing for internal assessments. Any credentials or network context provided for grey-box testing will be limited to what is necessary to simulate an insider threat or compromised account scenario.

c) What level of exploitation is permitted during penetration testing (e.g., proof-of-concept only vs. privilege escalation and lateral movement)?

ANSWER: Full exploitation, including privilege escalation, lateral movement, and data access, to accurately represent the real-world impact of identified vulnerabilities. All exploitation activities will be thoroughly documented and conducted within mutually agreed-upon rules of engagement.

d) Will remediation validation or retesting be required as part of the base engagement, or proposed as an optional service?

ANSWER: Remediation validation and retesting should be available as an optional service.

4. Web Applications & Business Systems

a) How many web applications and websites are in scope for Web Application Security Assessment and Website Security Assessment?

ANSWER: Ten web applications and websites are in scope for the Web Application and Website Security Assessment.

b) Will authenticated testing be required for web applications, and will test credentials be provided?

ANSWER: Both unauthenticated and authenticated testing will be conducted. Test credentials will be provided by NNPS prior to the start of testing.

c) Which HR, Payroll, and Business Office systems are in scope, and are these systems on-premises, SaaS-based, or vendor-hosted?

ANSWER: HR, Payroll, and Business Office systems in scope consist of a mix of on-premises, SaaS-based, and vendor-hosted platforms.

d) For vendor-hosted systems, who will coordinate required third-party authorization for testing?

ANSWER: NNPS will coordinate directly with applicable third-party vendors to obtain the necessary authorization prior to any testing of vendor-hosted systems. NNPS will actively assist the awarded vendor throughout this process to ensure timely authorization and minimal delays to the engagement timeline.

5. Firewall & Network Security Evaluation

a) How many firewall devices are in scope for evaluation, and what vendors or platforms are currently deployed?

ANSWER: There is 1 firewall device in scope for evaluation. All deployed firewalls are Fortinet platforms.

b) Will firewall review include configuration analysis only, or also log and rule-set review?

ANSWER: Firewall review should encompass both configuration analysis and log and rule-set review to provide a comprehensive assessment of the security posture.

c) Are firewall and IPS/IDS configurations standardized across facilities, or do they vary by location?

ANSWER: Firewall and IPS/IDS configurations are standardized.

6. Tools, Baselines & Existing Capabilities

a) NNPS currently uses OpenVAS for vulnerability scanning. Will existing scan results or asset inventories be shared to establish a baseline?

ANSWER: NNPS currently utilizes Nessus for vulnerability scanning. Existing scan results and asset inventories will be shared with the selected vendor to establish a baseline prior to testing.

b) Are there approved or restricted tools that Offerors must use or avoid during testing?

ANSWER: No tools are restricted. However, any tools or techniques with the potential for operational disruption will require explicit approval prior to execution.

c) Are internal scanning agents or testing appliances permitted on the NNPS network?

ANSWER: Internal scanning agents and testing appliances are permitted on the NNPS network. As with all active testing, any potentially disruptive activities will require explicit approval prior to execution.

7. Cloud Environment

a) Are cloud platforms such as Microsoft 365 and Google Workspace included in the base scope?

ANSWER: Google Workspace and Microsoft 365 are included in the base scope. An audit of the M365 and GW environment will be conducted as part of the engagement.

b) Are other cloud environments (e.g., AWS, Azure, GCP) included or considered optional services?

ANSWER: No additional cloud environments such as AWS, Azure, or GCP are currently in scope.

c) Are cloud services expected to be tested at the infrastructure layer, application layer, or both?

ANSWER: Testing will focus at the application layer. This includes Microsoft 365 and Google Workspace services, configurations, access controls, and user permissions. No infrastructure-layer cloud testing is applicable at this time.

8. Social Engineering & Physical Penetration Testing

a) What is the expected scope for Social Engineering and Security Awareness Testing, including number of staff users, frequency, and approved methods?

ANSWER: Social engineering testing will target approximately 4,300 staff users via spear phishing, phishing, vishing, and USB drop campaigns. Campaigns will be conducted at planned intervals throughout the engagement to evaluate staff awareness over time rather than as a single point-in-time exercise.

b) Are students explicitly excluded from all social engineering testing?

ANSWER: Students are explicitly excluded from all social engineering testing. All campaigns will be scoped exclusively to staff users.

c) What is the scope of Physical Penetration Testing, including number and type of facilities and permitted tactics?

ANSWER: Physical penetration testing will cover all applicable school division facility types, focusing on identifying and evaluating risks to access control systems, security cameras, alarm systems, and other physical security controls.

d) Will Physical Penetration Testing require written rules of engagement and prior authorization?

ANSWER: Written rules of engagement and prior authorization are required before any physical testing begins. Any potentially disruptive tactics will require explicit approval prior to execution.

9. Scheduling, Logistics & Access

a) Which portions of the engagement require on-site presence versus remote execution?

ANSWER: Written rules of engagement and prior authorization are required before any physical testing begins. Any potentially disruptive tactics will require explicit approval prior to execution.

b) How many facilities are expected to require on-site visits?

ANSWER: Four facilities are expected to require on-site visits. All locations are within the City of Newport News, Virginia.

c) What are NNPS’s defined after-hours testing windows?

ANSWER: After-hours testing windows are defined as 8:00 PM to 5:00 AM.

d) Are there blackout periods during which testing cannot occur?

ANSWER: There are no formal blackout periods. However, any potentially disruptive testing must be explicitly approved in advance and conducted during non-business hours.

e) Will NNPS provide VPN or secure remote access for internal testing activities?

ANSWER: Yes, VPN connectivity will be provided to facilitate secure remote access for internal testing activities.

10. Compliance, Frameworks & Data Handling

a) Which version of NIST SP 800-53 does NNPS prefer, and is the expectation full control assessment or high-level alignment?

ANSWER: NIST SP 800-53 Revision 5.2.0, the current and most comprehensive version of the framework. Assessment will focus on high-level alignment to identify control gaps and prioritize remediation rather than a full control-by-control audit, unless a deeper assessment is requested.

b) Are there additional compliance frameworks or laws that findings must map to?

ANSWER: HIPAA, PCI, and other commercial compliance frameworks are not in scope.

c) What data handling or reporting protocols apply if student PII is inadvertently accessed?

ANSWER: In the event student PII is inadvertently accessed during testing, all activities will cease immediately upon discovery. The engagement team will notify the designated NNPS point of contact without delay, document the circumstances of access, and follow NNPS-defined incident response and data handling protocols. No student PII will be retained, transmitted, or included in any deliverable.

11. Deliverables, Reporting & Evaluation

a) What is the required format and level of detail for final deliverables?

ANSWER: Major project deliverables will be broken into individual reporting packages as outlined in the RFP.

b) What is the expected timeline for draft and final report review cycles?

ANSWER: Each deliverable will be due no later than four weeks following the completion of the applicable phase, unless an alternate timeline is mutually agreed upon in writing.

c) Will oral presentations or demonstrations be requested, and if so, will they be virtual or on-site?

ANSWER: A draft report will be delivered for NNPS review and feedback prior to finalization. Upon delivery of the final report, an oral presentation will be conducted remotely to walk through findings, answer questions, and satisfy the White-Glove Follow-Up and Post-Assessment Support requirements of this engagement.

12. Procurement and Contractual Clarifications

Contract Structure & Award Strategy

1) Does NNPS intend to award this RFP to a single vendor or multiple vendors? If multiple awards are anticipated, how many vendors are expected, and will the structure be a single project award or a task-order-based contract?

ANSWER: NNPS intends to award to a single vendor. The solicitation is for a term contract with renewal options as these services are to be performed on an annual basis as referenced in General Terms and Conditions, page 19, Letter II. Award.

2) Is there a current or recent incumbent, and will NNPS provide performance insights, gap areas, or knowledge-transfer materials to the successful Offeror?

ANSWER: There is no incumbent as the previous audit project was awarded upon completion of competitive procurement processes for a one-time engagement during a prior fiscal year period. If successful Offeror wants to see the previous contract materials, please submit a FOIA request to foia.requests@nn.k12.va.us.

Mandatory vs. Optional Services

1) Which services in Sections III.B.9 and III.B.10 are mandatory versus optional, and should optional services be priced now or only described as available?

ANSWER: Optional services pricing must be included with the proposal package submitted.

2) Are optional services expected at initial award or later during the contract term, and should they be priced as standalone alternates or integrated pricing scenarios?

ANSWER: Offerors may present alternative methods to the Statement of Needs outlined in the RFP. However, unsolicited optional and/or alternative offers should first present a response to NNPS’ objectives detailed in the Statement of Needs section of the solicitation. Offerors must address all evaluation criteria, with respect to any alternate solutions proposed. Exceptions and/or alternatives will be subject to negotiations.

Pricing Structure & Commercial Terms

1) Should pricing be lump-sum, unit-based, time-and-materials, or a hybrid model, and how should optional services be priced?

2) ANSWER: Attachment A should have pricing for all services to include Mandatory and Optional Services. Each service has been listed on a separate line and should be priced accordingly. Attachment A Cost Proposal: Any additional/optional pricing may be provided as supplemental sheets in addition to completion of Attachment A.

3) Should travel and on-site costs be embedded in lump-sum pricing or billed separately per NNPS travel policy?

ANSWER: The Offeror shall decide how to bill to their travel cost. Pricing may be all inclusive or if travel cost is unknown, provide a “not to exceed” amount as part of your RFP response that will be invoiced for actual travel expenses.

4) Is multi-year pricing required, and if so, should prices remain fixed across option years or be adjustable using an index such as CPI-U?

ANSWER: The Price Escalation/De-Escalation clause is hereby included under the Special Terms and Conditions:

NNPS may consider price adjustments, after the initial contract term, based solely upon manufacturer price increases/decreases. Successful Offeror shall provide NNPS a written request for any such manufacturer increases.

Such requests shall be addressed to the Issuing Office and shall be accompanied by written verifications of said price increase by the manufacturer. A minimum thirty (30)-day advance notice period shall be required for such requests. Requests for price increase adjustments are subject to the review and approval of the NNPS Director of Procurement. Successful Offeror shall apply and implement, immediately upon notification from manufacturer, any and all price decreases for items included under any contract resulting from this Invitation for Bids. Any increase in cost shall not increase by a greater percentage than the percentage change in the Consumer price Index for All Urban Consumers of the Bureau of Labor Statistics published by the United States Department of Labor during the previous twelve months.

5) Can NNPS provide indicative budget guidance to help determine whether bonding requirements apply?

ANSWER: At this time, the School Division has elected not to disclose a specific budget for this solicitation.

Offerors are encouraged to propose solutions and pricing that they believe best meet the scope of work and deliverables outlined in the RFP.

Bonds & Financial Qualifications

1) Will NNPS waive proposal, performance, or payment bond requirements, and does NNPS anticipate the engagement exceeding the $500K bonding threshold?

ANSWER: Bonding requirements, listed in the RFP Special Terms and Condition, Section E. Bonds is hereby removed in its entirety from the solicitation.

2) What types of financial documentation are acceptable to demonstrate financial stability, particularly for privately held firms?

ANSWER: As referenced in the RFP on page 10, please include a copy of the three (3) most recent annual reports and financial statements for each quarter since the last annual report to date. If company is privately held, supply sufficient information to document the Company’s financial status and capability to perform under this contract.

Include any financial ratings held by the firm with date of rating, and legal name of company to which the rating applies.

Evaluation Criteria & Scoring

1) How will the 30% methodology score be evaluated, including weighting between technical approach and tools, and how are “exceptional” vs “good” responses defined?

ANSWER: Please refer to pages 10-11, Section H, “Evaluation of Proposals,” for this information.

2) Is there a preference for innovative approaches versus strict compliance-based responses, and how are qualifications, experience, methodology, and price weighted?

ANSWER: The Methodology & Approach is left to the discretion of the Offeror. Please refer to pages 10-11, Section H, “Evaluation of Proposals,” for this information.

3) How will oral presentations or demonstrations influence final scoring, and will they be conducted virtually or on-site?

ANSWER: These will be conducted virtually with Offerors who are shortlisted during the Evaluation process of the procurement. Please refer to pages 10-11, Section H, “Evaluation of Proposals,” for scoring criteria and weights.

Proposal Submission Requirements

1) Are there page limits or preferred maximum lengths for proposal tabs?

ANSWER: While there is no set page limit or maximum length, the objective of this solicitation is to receive proposal submissions that demonstrate the Offeror’s clear understanding of the Scope of Work/Statement of Needs reflecting the firm’s expertise, experience and capability to provide the services required during the performance of the contract term. Please refer to pages 8-9, Section G, “Proposal Submittal Requirements,” for this information.

2) How should confidential or trade-secret information be submitted (redacted copy vs separately labeled document)?

ANSWER: Please refer to pages 8-9, Section G, “Proposal Submittal Requirements,” and page 12, Header V, “General Terms & Conditions”, subparagraph C, regarding identification of Proprietary/Confidential information.

3) Are subcontractors permitted, and if so, when is NNPS approval required?

ANSWER: Please refer to page 12, Header V, “General Terms & Conditions,” subparagraph G, bullet 3 and subparagraph H, for this information. Any use of subcontractors and work performed must receive prior written approval from NNPS.

Staffing & Labor Requirements

1) Is all staffing required to be U.S.-based, or are offshore resources permitted for any portion of the work?

ANSWER: Staffing shall be US-based. All offerors shall have the ability the transact business in the Commonwealth of Virginia by having a valid State Corporation Commission number in accordance with General Term and Condition, Letter S. Compliance with All Laws and page 2, Specific Legal Requirements, Compliance with State Law; Foreign and Domestic Businesses authorized to transact business in Virginia.

2) Are there restrictions on staffing types (W-2 vs 1099), and are background checks required for on-site personnel?

ANSWER: The awarded vendor is an Independent Contractor, not an employee of NNPS. Please refer to Attachment C, “Certification of Compliance with the Code of Virginia,” for this information.

Contract Administration & Governance

1) Who has authority to approve the test plan and formally authorize testing beyond the named Contract Administrator?

ANSWER: The Executive Director of Technology.

2) Who are the technical, executive, and incident-response points of contact during the engagement?

ANSWER: The technical and incident response points of contacts will be the Information Security Team. The executive point of contact will be the Executive Director of Technology.

Post-Delivery Support

1) Are post-delivery consultation hours required in the base price, and does NNPS have a preference within the 8–16 hour / 30–60 day range?

ANSWER: Post-delivery consultation hours are required and shall be included in the base price with an option for additional hours if complex findings require extended remediation guidance. No preference within the time/day ranges.

Legal & Regulatory Compliance

1) Which local, state, and federal laws apply to this engagement, including the applicability of Code of Virginia §22.1-

296.1 to remote staff?

ANSWER: The awarded contract shall be governed by the laws of the Commonwealth of Virginia. The awarded Offeror shall comply with all federal, state and local statutes, ordinances and regulations currently in effect or adopted during the performance of the contract term. Please refer to page 12, Header V, “General Terms & Conditions,” subparagraphs L, M, T, U, V, GG and Attachment C, “Certification of Compliance with the Code of Virginia,” for this information.

References & Qualifications

1) Must references be K–12 clients, or is comparable public-sector experience acceptable, and are individual certifications required or preferred for evaluation?

ANSWER: References citing comparable public sector experience for projects similar in scope and services provided to clients of similar size are acceptable should the Offeror not possess any experience with providing K-12 educational organizations with these services.

Presentations/Demonstrations

1) Will oral presentations or demonstrations be requested, and if so, will they be virtual or on-site?

ANSWER: Oral presentations/demonstrations will be conducted virtually.

Terms and Conditions

1) The below list of clauses within Section VI. Special Terms & conditions are hereby amended as follows:

a. D. Insurance

The required coverages must include:

1. Cyber Liability Insurance in the amount of $5,000,000.00

2. Errors and Omissions in the amount of $5,000,000.00

b. E. Bonds: The bond requirements are removed in their entirety.

Attachments

1) The following attachment is hereby removed and no longer required with proposal submissions:

a. Attachment B – Questionnaire

13. Please be advised under Section IV, “Special Instructions to the Offeror,” on page 7 of the solicitation states the following:

A. Contact with NNPS Staff, Representatives, and/or Agents:

Direct contact with NNPS staff, representatives, and/or agents other than Purchasing Department staff on the subject of this RFP or any subject related to this RFP is expressly prohibited except with the prior knowledge and permission of the Purchasing Director.

14. The Closing Date and Time for proposals to be submitted has been extended to May 8, 2026 10:00 A.M. EDT.

15. All other provisions of the RFP shall remain unchanged.

1 Microsoft Copilot was utilized as a non-decision-making tool to assist with the administrative identification and consolidation of duplicate/overlapping questions. The consolidation was limited to combining questions of substantially identical scope, substance, intent and did not modify the substance, intent, nor competitive impact of any question submitted. Vendor-submitted questions were reviewed for exact duplication and for substantive similarity in intent, scope, or requested clarification. Questions addressing the same underlying topic (e.g., asset counts, locations, testing methodology, or scheduling) were consolidated into a single authoritative clarification to ensure consistency and avoid redundant responses. The use of Microsoft Copilot does not affect solicitation requirements, proposal evaluation, source selection, nor the treatment of any offeror, and all vendors were afforded the same information on an equal basis.

Sincerely, Heather M. Medina Heather M. Medina, VCCO, VCO Procurement Coordinator heather.medina@nn.k12.va.us 757-591-4525 x10754

Name of Firm

Signature/Title

Date