RFP 019-0-2026HM vFINAL.pdf

Newport News Public Schools

ISSUING OFFICE:

PURCHASING DEPARTMENT

12465 WARWICK BOULEVARD

NEWPORT NEWS, VA 23606-3041

TELEPHONE: (757) 591-4525

FAX: (757) 591-4593

DATE: April 1, 2026

Attention of Offeror is Directed To Section 2.2-4367 to 2.2-4377 Code of Virginia (Ethics In Public Contracting)

ELECTRONIC PROPOSALS All proposals may be submitted electronically online via eVA until Closing Date and Closing Time as specified in this solicitation including any addenda issued by this office using Offeror’s established eVA Supplier Account. The entire proposal response including any /all attachments and any/all addenda must be submitted electronically via eVA, no later than the closing date and time stated in the solicitation posting.

Mailed, faxed, or emailed proposals will not be accepted. Newport News Public Schools is not responsible for late electronic delivery. Offerors are highly encouraged to anticipate and plan for technical or heavy email transmission traffic at the last minute.

All inquiries for information regarding this Request for Proposals should be directed to the Buyer listed in this RFP or 757-591-4525

COMMODITY: IT and Network Security Audit Services

NIGP CODE: 25778, 91829, 91830, 91871, 91893, 92015, 92045, 92037, 99000, 99048

PLEASE FILL IN OFFEROR’S NAME & ADDRESS

IN THE SPACES PROVIDED BELOW:

THIS IS NOT AN ORDER

THE NEWPORT NEWS SCHOOL BOARD, HEREAFTER REFERRED TO AS NEWPORT NEWS PUBLIC SCHOOLS (NNPS), RESERVES THE RIGHT TO ACCEPT OR REJECT ANY OR ALL PROPOSALS IN WHOLE OR IN PART AND TO WAIVE ANY INFORMALITIES IN THE PROPOSAL PROCESS AND RESERVES THE RIGHT TO ENTER INTO ANY CONTRACT DEEMED TO BE IN ITS BEST INTEREST. THE ENTIRE CONTENTS OF THIS REQUEST FOR PROPOSALS, ANY ADDENDA, OFFEROR'S PROPOSAL AND

NEGOTIATED CHANGES SHALL BE INCORPORATED INTO ANY RESULTING CONTRACT.

This public body does not discriminate against faith-based organizations in accordance with the Code of Virginia, § 2.2-4343.1 or against an offeror or offerors because of race, religion, color, sex, national origin, age, disability, sexual orientation, gender identity, political affiliation, or veteran status, status as a military family, or any other basis prohibited by state law relating to discrimination in employment.

DESCRIPTION OF GOODS/SERVICES

Cybersecurity Penetration and Vulnerability Testing Services

ACKNOWLEDGE RECEIPT OF ADDENDUM: #1 #2 #3 #4 (Please Initial) IN COMPLIANCE WITH THIS SOLICITATION AND TO ALL THE CONDITIONS IMPOSED HEREIN, THE UNDERSIGNED AGREES TO PERFORM AY CONTRACT AWARDED AS A RESULT OF THIS SOLICITATION. THE FOLLOWING SECTION SHALL BE SIGNED BY AN AGENT AUTHORIZED TO BIND THE OFFEROR/COMPANY. FAILURE TO MAKE THIS COMMITMENT MAY RESULT IN PROPOSAL REJECTION.

Authorized Agent Signature Type or Print Name Email Address

Company FEI/FIN#

Phone Number

FAX Number

REQUEST FOR PROPOSALS

RFP ITEM NO.

019-0-2026/HM

PROCUREMENT OFFICER

Heather Medina, VCO, VCCO

CLOSING DATE

April 27, 2026

CLOSING TIME

10:00 AM EST

OPTIONAL PREPROPOSAL

CONFERENCE

DATE: April 14, 2026

TIME: 10:00 AM EST

ANTI-COLLUSION:

SPECIFIC LEGAL REQUIREMENTS

In the preparation and submission of this proposal/proposal, said offeror/offeror did not either directly or indirectly enter into any combination or arrangement with any person, firm or corporation, or enter into any agreement, participate in any collusion, or otherwise take any action in violation of the Sherman Act (15 U.S.C.

Section 1), Sections 59.1-9.1 through 59.1-9.17 or Sections 59.1-68.6 through 59.1-68.8 of the Code of Virginia. The undersigned offeror/offeror hereby certifies that this agreement, or any claims resulting therefrom, is not the result of, or affected by, any act of collusion with, or any act of, another person or persons, firm or corporation engaged in the same line of business or commerce; and, that no person acting for, or employed by, NNPS has an interest in, or is concerned with, this proposal/proposal; and, that no person or persons, firm or corporation other than the undersigned, have, or are, interested in this proposal/proposal.

DRUG-FREE WORKPLACE:

During the performance of this contract, the successful offeror/offeror agrees to (i) provide a drug-free workplace for the successful offeror's/offeror’s employees; (ii) post in conspicuous places, available to employees and applicants for employment, a statement notifying employees that the unlawful manufacture, sale, distribution, dispensation, possession, or use of a controlled substance or marijuana is prohibited in the successful offeror's/offeror’s workplace and specifying the actions that will be taken against employees for violations of such prohibition; (iii) state in all solicitations or advertisements for employees placed by or on behalf of the successful offeror/offeror that the successful offeror/offeror maintains a drug-free workplace; and (iv) include the provisions of the foregoing clauses in every subcontract or purchase order of over $10,000, so that the provisions will be binding upon each successful offeror/offeror or vendor. For the purpose of this section, "drug-free workplace" means a site for the performance or work done in connection with a specific contract awarded to a successful offeror/offeror in accordance with federal law, the employees of whom are prohibited from engaging in the unlawful manufacture, sale, distribution, dispensation, possession or use of any controlled substance or marijuana during the performance of the contract.

EMPLOYMENT DISCRIMINATION BY THE SUCESSFUL OFFEROR/OFFEROR SHALL BE PROHIBITED:

1. During the performance of this contract, the successful offeror/offeror agrees as follows:

a. Offeror/offeror shall not discriminate against any employee or applicant for employment because of race, religion, color, sex, national origin, age, disability, or any other basis prohibited by state law relating to discrimination in employment, except where there is a bona fide occupational qualification reasonably necessary to the normal operation of the successful offeror/offeror. The successful offeror/offeror agrees to post in conspicuous places, available to employees and applicants for employment, notices setting forth the provisions of this nondiscrimination clause.

b. Successful offeror/offeror, in all solicitations or advertisements for employees placed by or on behalf of the successful offeror/offeror, shall state that such successful offeror/offeror is an equal opportunity employer.

c. Notices, advertisements, and solicitations placed in accordance with federal law, rule or regulation shall be deemed sufficient for the purpose of meeting the requirements of this section.

2. Successful offeror/offeror shall include the provisions of the foregoing Subsections a, b, and c in every subcontract or purchase order of over $10,000, so that the provisions will be binding upon each subcontractor or vendor.

COMPLIANCE WITH STATE LAW; FOREIGN AND DOMESTIC BUSINESSES AUTHORIZED TO TRANSACT BUSINESS IN THE

COMMONWEALTH:

1. A contractor organized as a stock or nonstock corporation, limited liability company, business trust, or limited partnership or registered as a registered limited liability partnership shall be authorized to transact business in the Commonwealth as a domestic or foreign business entity if so required by Title 13.1 or Title 50 or as otherwise required by law.

2. An offeror/offeror organized or authorized to transact business in the Commonwealth pursuant to Title 13.1 or Title 50 will include in its proposal or proposal the identification number issued to it by the State Corporation Commission in the space provided below. Any offeror/offeror that is not required to be authorized to transact business in the Commonwealth as a foreign business entity under Title 13.1 or Title 50 or as otherwise required by law shall include in its proposal or proposal a statement why the offeror/offeror is not required to be so authorized. Offeror/offeror is to include the VA Code reference authorizing the exemption in said statement.

3. Any offeror/offeror described in the foregoing Subsection 2. that fails to provide the required information shall not receive an award unless a waiver of this requirement is granted by the Superintendent or designee.

4. Any business entity described in the foregoing Subsection 1. that enters into a contract with NNPS shall not allow its existence to lapse or its existence to lapse or its certificate of authority or registration to transact business in the Commonwealth, if so required under Title 13.1 or Title 50, to be revoked or cancelled at any time during the term of the contract.

Name and Address of OFFEROR/OFFEROR: Date: Authorized Signature: _

Printed Name: _ Title:

Phone Number: Fax Number: _

Email Address: _ _

Federal Tax Identification Number/Social Security Number: _

State Corporation Commission Identification Number: _

Is offeror/offeror a "minority" business? Yes No If yes, please indicate the "minority" classification below:

African American Hispanic American Native American Asian American Other; Please Explain:

Service Disabled Veteran? Yes No Service Disabled Veteran Business? Yes No Woman Owned?

Small Business?

Yes Yes

No No

Faith-Based Organization? Yes No

TABLE OF CONTENTS

PAGE

I. PURPOSE 4

II. BACKGROUND 4

III. STATEMENT OF NEEDS 4

IV. PROPOSAL INSTRUCTIONS TO THE OFFEROR 7

EVALUATION AND AWARD CRITERIA 11

V. GENERAL TERMS AND CONDITIONS 12

VI. SPECIAL TERMS AND CONDITIONS 20

The following shall be submitted as part of your RFP proposal submission:

ATTACHMENTS:

Attachment A – Pricing Schedule (Must submit with proposal)

Attachment B – Questionnaire (Must submit with proposal)

RFP #019-0-2026/HM Page 4 of 32

I. PURPOSE

The purpose of this RFP is to solicit sealed proposals from qualified firms for information security penetration testing and operational framework review assessment. The objective of this audit is to make the information systems which the Newport News Public School division depends on, more resistant to attacks, limit the damage attacks cause upon occurrence, and make the information systems more resilient. NNPS is seeking firms that have expertise and experience with NIST assessment methodology and cybersecurity, in addition to an established record in providing high quality cybersecurity services within the PreK-12 education setting.

II. BACKGROUND

Newport News Public Schools is the ninth largest school division in the Commonwealth with approximately 26,500 students. NNPS is an urban school system educating children in 3 early childhood centers, 24 elementary schools, 7 middle schools, 1 middle/high school combination, a virtual learning academy and 5 high schools. NNPS also provides programs for at-risk students in addition to special education programs. A listing of NNPS facilities and its locations may be accessed via NNPS’ official web site at http://sbo.nn.k12.va.us/schools. NNPS employees approximately 4,688 employees in a variety of educational, managerial, professional, technical, clerical, service and maintenance positions.

The network design for Newport News Public Schools consists of two geographically diverse data centers across a privately-owned fiber optic wide area network (“WAN”). The WAN serves 50+ individual facilities to provide connectivity across the district. Additionally, there are up to 40,000 devices that exist on the network. NNPS’ current internal scanning tools include OpenVAS-Vulnerability Scanning.

III. SCOPE OF WORK/STATEMENT OF NEEDS

A. GENERAL REQUIREMENTS

1. Newport News Public Schools ("NNPS") is seeking to solicit sealed bids from qualified firms to provide an Information Security penetration testing and operational framework review assessment. The qualified Contractor will perform an audit of the identified data systems and networks using an objective vendor-neutral framework (NIST 800-53), conduct penetration testing, and provide a report with recommended remediation options.

2. This is an annual test. The vulnerability assessment and penetration testing shall be completed with all deliverables to Newport News Public Schools within four (4) weeks after the vulnerability assessment and penetration testing have been completed. Additional time can be allotted; however, the request must be submitted in writing, and approved by the Contract Administrator listed herein this solicitation.

3. Penetration testing and network assessments may be completed after hours to prevent any network disruptions. All other work should be completed during normal business hours, 7:00 AM – 4:30 PM unless otherwise noted.

4. The Agency will provide one (1) teacher laptop and one (1) student Chromebook. The Contractor shall provide all other materials, equipment, and incidentals needed for the completion of services.

5. A list of network infrastructure, networks, and types of end user devices will be provided to the Contractor.

6. The vulnerability assessment and penetration testing shall be conducted both on-site and remote. The Contractor may need to visit multiple sites to collect all required data. A conference room will be provided if the Contractor needs to be physically on-site.

7. The timing of specific types of testing will be discussed with the selected Offeror to avoid interruptions to instruction.

8. Internal scanning agents are permitted, if required as part of the assessment.

9. The Contractor shall not use any hardware or software that will interrupt network connectivity or production system. The Contractor must disclose if any testing may impact network operations.

http://sbo.nn.k12.va.us/schools.

RFP #019-0-2026/HM Page 5 of 32

B. SPECIFIC REQUIREMENTS – Services Requested

The selected firm shall ensure the following are covered for each requested service listed below.

1. Vulnerability Assessment and Penetration Testing General Requirements

a. Confirm and obtain approval on the scope of Service, including a test plan in writing prior to Service commencement.

b. Communicate with third-party vendor to obtain authorization as required.

c. Engage Customer before the actual test or a to confirm logistics arrangement, understand test goals and objectives as a result of the test or assessment.

d. Establish a communication plan as to who will know about the test.

e. Establish an incident and escalation management process to handle issues that may happen during the test or assessment.

f. Identify information on the nature of the test being performed. (e.g., White Box, Black Box, Grey

Box)

g. Identify targets and map attack vectors and exploitation (e.g., elevating privileges) within the scope of requested services.

h. Provide reporting and documentation as required.

2. Vulnerability Assessment

a. Assess current network security measures to identify any vulnerability that exists in NNPS current network architecture.

b. Conduct external and/or internal vulnerability scans to identify any security vulnerability that exists in school division resources.

c. Conduct Web Application Security Assessment.

d. Conduct Website Security Assessment.

e. Conduct Vulnerability assessment of business systems utilized by Human Resources, Payroll, and the

Business Office.

3. Penetration Testing

a. External Penetration Test

The external penetration test will be performed completely external to NNPS via the internet. The scope of this test is to review the vulnerabilities and risks of all Internet-accessible systems owned by NNPS. Testing will be performed by mimicking an attacker with no network credentials or network information.

b. Internal Penetration Test

The Internal penetration assessment will be performed from inside the organization. The scope of this test is to review internal systems that may be vulnerable to an attack. Testing will be performed by mimicking an attacker with no network credentials or network information.

c. Wireless Penetration Testing

Identify wireless networks and validate security mechanisms in place to prevent unauthorized access through wireless networks. The scope for the wireless penetration test will include four separate wireless networks.

4. Firewall Evaluation

Conduct an onsite/offsite internal firewall configuration, policy, and log review, which includes:

a. Conduct a review of the overall Firewall Configuration.

b. Conduct a review of applications, protocols, and filters.

c. Conduct a review of Firewall Policies and IPS Configuration.

RFP #019-0-2026/HM Page 6 of 32

5. Information Security Policies and Data Governance General Requirements

a. Conduct a review to identify gaps in the school divisions' Data Governance and information security policies.

b. Review organizational IT policies related to local, state, and federal laws to ensure compliance.

6. Security Policies

a. Review current policies and put together a framework of IT policies and ensure that they adhere to the latest best practices and industry standards.

b. Read through and evaluate written company policy regarding technology.

c. Review, assess, and recommend updates or additions to the assigned roles and responsibilities associated with the new policies.

d. Draft new policies and provide a framework for industry-standard IT and security policies.

7. Data Governance

a. Identify gaps in existing organizational Data Governance policies and technology.

b. Propose data governance standards that facilitate the adoption across the entire school division. The data governance framework should include the policies, procedures, practices, and to improve data quality, maintain integrity, and enable the appropriate and proper data utilization while enforcing compliance and security.

c. Provide accurate estimates of the costs and needs (technical, employee) for the long-term maintenance of data governance and information security program.

8. Optional Services

The successful Offeror shall provide optional services to NNPS upon request. It is understood that optional services may be requested in the future. In such an event, these optional services shall be considered incorporated herein by reference.

The option such as the following but not limited to:

a. Cloud assessment and penetration testing Services (e.g., environments, Application Program Interfaces ("APIs").

b. Compromise assessment (e.g., data forensics, confirmation on security breaches).

c. Penetration testing Services on Customer’s Heat, Air Ventilation, and Cooling (“HVAC”) and

Closed-circuit Television(“CCTV”) systems.

9. Security Awareness and Social Engineering Testing

10. Physical Penetration Testing

C. DELIVERABLES – Reporting and Presentation

Upon completion of each requested service, the firm shall provide NNPS with an assessment report which should include the following information at a minimum:

1. Vendor is to provide weekly (or bi-weekly) written status reports detailing:

a. Progress against the agreed-upon project timeline/plan.

b. Testing activities completed and currently underway.

c. Initial, non-critical findings (without waiting for the final report).

d. Any anticipated schedule deviations or blockers.

2. Offeror must designate a senior technical POC for NNPS who will be available for questions and formal check-in calls throughout the engagement.

3. Offeror must provide a project timeline inclusive of the information below:

a. All Offerors must submit a detailed project timeline/Gantt chart as part of their proposal, clearly outlining:

i. Key milestones (e.g., scoping completion, external testing start/end, internal testing start/end, final report draft).

ii. Estimated person-days for each phase of the assessment.

RFP #019-0-2026/HM Page 7 of 32

iii. A schedule for the review of security policies and data governance.

b. A formalized Kick-off Meeting to finalize the project schedule and logistics, and a Mandatory formalized Close-out Meeting to formally hand off all final files and data.

4. "White-Glove" Follow Up / Post-Assessment Support

a. Provide a formal, mandatory presentation of the final report to NNPS leadership and IT staff, allowing for dedicated time for Q&A on findings and remediation steps.

b. Must include a fixed amount of post-delivery consultation hours (e.g., 8-16 hours) valid for 30-60 days after the final report delivery, intended for follow-up questions, clarification on remediation, or review of initial mitigation efforts.

c. Executive Summary of Services Performed

d. Scope of Services Performed

e. Detailed Results of Identified by Preformed Tests and/or Analyses

f. Detailed explanation of the implications of the identified vulnerabilities, business impact, and potential risks

g. Detailed steps of immediate mitigation of associated risks

h. Recommended high-risk areas for immediate attention, as applicable

NNPS will evaluate all proposal submissions to determine capabilities and capacity to select the most qualified firm to provide the services listed in the Scope of Work/Statement of Needs.

IV. SPECIAL INSTRUCTIONS TO THE OFFEROR

Definitions Issuing Office:

Wherever used in this Request for Proposals, Issuing Office will be:

Heather Medina, VCO Procurement Coordinator Newport News Public Schools Purchasing Department 12465 Warwick Boulevard Newport News, VA 23606-3041 Phone: (757) 591-4533 Fax: (757) 591-4593 Email: heather.medina@nn.k12.va.us

NNPS Contract Administrator:

Wherever used in this Request for Proposals and for purposes of any notices under this contract, the NNPS Contract Administrator will be:

David Saunders Information Security Analyst 12511 Warwick Blvd, Suite A Newport News, VA 23606 Phone: (757) 881-5461 x 12134 Email: david.saunders@nn.k12.va.us

A. Contact with NNPS Staff, Representatives, and/or Agents:

Direct contact with NNPS staff, representatives, and/or agents other than Purchasing Department staff on the subject of this RFP or any subject related to this RFP is expressly prohibited except with the prior knowledge and permission of the Purchasing Director

B. Offerors of Record:

Offerors receiving a copy of this RFP from a source other than the Issuing Office via the www.eVA.virginia.gov web site must contact the Issuing Office and provide Offeror’s name, address, contact person, telephone and fax number, and the RFP Item Number.

mailto:heather.medina@nn.k12.va.us mailto:david.saunders@nn.k12.va.us http://www.eva.virginia.gov/

RFP #019-0-2026/HM Page 8 of 32

C. Pre-Proposal Conference (Optional):

An Optional pre-proposal conference will be held via the following Zoom Meeting link on Tuesday, April 14, 2026 at 10:00 AM, Eastern Daylight Savings Time to answer any questions regarding this RFP.

Join the Meeting Now https://nn-k12-va-us.zoom.us/j/83206782732?pwd=b3xYCBp6BHQtBKoH1RC8G8tHepyoa9.1

Meeting ID: 832 0678 2732 Passcode: 152427

Join by Telephone:

One tap mobile: +13017158592,83206782732# US, +13052241968,83206782732# US

Any changes determined necessary as a result of this conference or any other source that may affect the responses to the Request for Proposal will be formally addressed by the issuing Office via Addenda. Attending this conference is not mandatory, but advisable.

D. Questions:

Offerors must submit questions regarding the Request for Proposal in writing to the Issuing Office to heather.medina@nn.k12.va.us no later than Wednesday, April 15, 2026, 10:00 A.M. EDT. Necessary replies will be issued to all Offerors of record as addenda that shall become part of the contract documents. Oral instructions do not form a part of the Proposal documents.

Offeror is responsible for checking the NNPS Purchasing webpage, eVA.virginia.gov web site or contacting the Issuing Office within 48 hours prior to Proposal closing to secure any addenda issued for this RFP.

E. Changes or Modifications:

Changes or modifications to this Request for Proposals made prior to the date and time of closing will be addressed by addenda from the Issuing Office. Offerors are to acknowledge receipt of addenda in the space provided on the cover page of this Request for Proposal. Oral communications are not a part of the Proposal documents. This RFP and any addenda shall be incorporated, by reference, into any resulting contract.

F. RFP Closing:

Offeror shall ensure its Proposal is time stamped by the Issuing Office no later than the Closing Date and Time shown on the cover page of this Information for Proposal. Proposals received after the specified date and time (timestamped 10:01AM - EST or later) will not be considered and will be returned to the Offeror unopened.

G. Proposal Submittal Requirements:

1. Per the VPPA § 2.2-4303. (Effective January 1, 2025) Methods of Procurement, Newport News Public Schools now provides an option to submit electronic copies of the requested proposal/proposal through electronic means or hard copy/paper submissions. All proposals may be submitted electronically online via eVA using the Offeror’s established eVA Supplier Account, in person, or by mail. The entire proposal response including any / all attachments and any / all addenda must be submitted electronically via eVA, in person, or mail no later than the closing date and time stated in the solicitation posting. Faxed, mailed or emailed proposals will not be accepted.

To learn how to submit an online proposal/proposal in eVA please refer to the online supplier training page at:

https://eva.virginia.gov/supplier-training-materials.html

The link to the video “Viewing and Responding to Solicitations” can be found on the Supplier Training Materials page at: https://www.youtube.com/watch?v=KSxcAkOekW0

It is the responsibility of the Offeror to ensure all required attachments are properly completed, readable and uploaded to eVA by the date and time deadline stated on the electronic solicitation posting.

Offerors should allow sufficient time to account for any technical difficulties they may encounter during online submission or uploading of documents. In the event of technical difficulties, suppliers should contact eVA Customer Care at 1-866-289-7367 or via email at eVACustomerCare@DGS.Virginia.gov.

https://nn-k12-va-us.zoom.us/j/83206782732?pwd=b3xYCBp6BHQtBKoH1RC8G8tHepyoa9.1 mailto:heather.medina@nn.k12.va.us https://url.us.m.mimecastprotect.com/s/f7l2CKr24NU6RlwKuMfvT5S77v?domain=eva.virginia.gov https://url.us.m.mimecastprotect.com/s/R5gJCL924OU7zAOqSqhOTyNK8A?domain=youtube.com mailto:eVACustomerCare@DGS.Virginia.gov

RFP #019-0-2026/HM Page 9 of 32

2. Each Proposal submission shall be submitted to the Issuing Office and shall include the following documents:

a. The cover page of this Request for Proposal, which will contain:

(1) Original signature of an agent authorized to bind the company;

(2) Requested contact information;

(3) Company FEI/TIN number; and,

(4) Acknowledgment of any addenda on page one (1);

b. Completed and signed anti collusion/nondiscrimination clauses on page 2;

c. Vendor Pricing Schedule requested in this RFP (Attachment A);

d. Vendor Questionnaire Form requested in this RFP (Attachment B);

e. Proposals must include all elements noted in the “Preparation of Proposals” section below;

f. Include a statement setting forth the basis for protection of proprietary information, if any, as detailed in the “Proprietary Information/Disclosure” section.

3. Proposals are to be organized in the following tabs:

Tab 1 – Executive Summary The executive summary should include but not limited to:

• Background information about the organization (philosophy, ownership, size, facilities, locations, etc.)

• Size and location of the office that will serve NNPS.

• Offeror’s qualifications to perform the services, including all resources available to the Offeror during the performance of the contract.

• Qualifications and resumes of all personnel providing services for the duration of the contracted services.

• A copy of certificate verifying the firm is registered to do business in the Commonwealth of Virginia.

Tab 2 – Methodology and Tools To Include but not limited to the following:

• An overview of the Offeror’s understanding of the Statement of Need

• The firm’s written technical plan and best practical approach towards providing an audit of Newport News

Public Schools data systems and networks as described in the Statement of Needs. Describe the approach for all services listed within the Statement of Needs (What, when, and how services will be performed, and time frame for completion (to include all deliverables)

• Provide detail list of any scanning tools, equipment, etc. that the Offeror will use to complete the audit.

• Provide a list of all hardware or software options that will be used.

Tab 3 – Deliverables Include an assessment report for EACH requested service to include:

• An executive summary of services performed

• Scope of services performed

• Detailed results of identified by performed tests and/or analyses

• Detailed explanation of the implications of the identified vulnerabilities, the business impact, and the potential risks

• Detailed steps of immediate mitigation of associated risks

• Recommended high-risk areas for immediate attention, as applicable

Tab 4 – Financial Proposal (To include price)

• The firm’s financial proposal and relevant terms including discounts, a breakdown of overall costs (per service as listed in Statement of Needs) to include any fees associated with the delivery of services.

• Completed price sheet (Attachment A) must include all applicable cost components in final price.

• The Offeror’s price will be subject to negotiations.

• After negotiations and award of this contract, the Successful Offeror’s pricing for the services provided under this contract shall be a firm fixed price for the duration of the contract and any extensions.

• Offeror is to identify any NNPS resources required.

• If Offeror intends to subcontract any part of work under this contract, the Offeror shall indicate which services or functions will be subcontracted.

RFP #019-0-2026/HM Page 10 of 32

• Include a copy of the three (3) most recent annual reports and financial statements for each quarter since the last annual report to date. If company is privately held, supply sufficient information to document the Company’s financial status and capability to perform under this contract. Include any financial ratings held by the firm with date of rating, and legal name of company to which the rating applies.

Tab 5-Experience Include experience and qualifications of assigned personnel as it relates to the Statement of Needs. Description should include but not limited to:

• Offeror’s established experience record in providing comparable services to organizations similar to

NNPS.

• Number and types of customers the Offeror has served with comparable services.

• Statement detailing why the Offeror is fully qualified and most suitable candidate to provide NNPS with the services required within the RFP.

• Include a minimum of four (4) references for which the Offeror has completed services comparable to those described herein. Two (2) of the references must be for active accounts and two (2) must be recently (within the past 5 years) terminated accounts. (The terminated accounts should not be those that were terminated due to solely to merger, acquisition, or other such industry action.) Include references for work performed in an environment comparable to NNPS. For each reference detail the following:

o Name and Address of Firm o Name, title, address, email address, phone number and fax of a contact for the firm o Number of years Offeror has severed the firm o Brief summary of scope of services provided o Information detailing project of similar scope that the Offeror is currently engaged in; to include name and address of firm, name, title, address email address, and phone number of contact within firm

Tab 6-Proprietary Information

• Include a statement setting forth the basis for protection of proprietary information, if any, as detailed in the “Proprietary Information/Disclosure” section. Include trade secrets or proprietary information that shall not be subject to public disclosure under the Virginia Freedom of Information Act, the Offeror must invoke the protection of Code of Virginia, § 2.2-4342F, in writing, prior to or upon submission of the data or other materials, and must identify the data or other materials to be protected and state the reasons why protection is necessary.

Tab 7-Exceptions/Deviations

• Detail any exceptions taken to the Statement of Needs and Terms and Conditions section of the RFP. For each exception, specify the RFP page number, section number, and the exception taken. The Offeror should not incorporate its standard contract document into its proposal by reference or in full text, without listing the exception taken to the Statement of Needs/Terms and Conditions section of the RFP. Offerors may present alternative methods to the Statement of Needs outlined in the RFP. However, unsolicited optional and/or alternative offers should first present a response to NNPS objectives detailed in the Statement of Needs section of the solicitation. Offerors must address all evaluation criteria, with respect to any alternate solutions proposed. Exceptions and/or alternatives will be subject to negotiations.

H. Evaluation of Proposals:

1. After the RFP closes, NNPS will select for further consideration one or more Offerors deemed to be fully qualified and best suited among those submitting proposals based on Offerors’ responses to the information requested in this RFP.

2. In assessing responses to the RFP, consideration will be given to several factors, including, but not limited to, the conformity of the responses to the specifications of the RFP, the competency and responsibility of Offerors, the ability of the Offerors to perform satisfactory service, and the dollar amounts of the proposals.

Overall proposal ratings are as follows:

RFP #019-0-2026/HM Page 11 of 32

• Exceptional: Submission exceeds expectations, has an excellent probability of success in achieving all objectives. Very innovative.

• Good: Very good probability of success. Achieves all objectives in a reasonable fashion.

Acceptable: Has reasonable probability of success. Some objectives may not be met.

• Poor: Falls short of expectations and has a low probability of success.

• Unacceptable: Submission fails to meet requirements and the approach has no probability of success.

3. NNPS shall assess each response in accordance with the criteria weighted detailed below:

Criteria Weight

Qualifications & Experience 35 points Methodology & Approach/Tools 30 points Deliverables 20 points Price 15 points

Total 100 points

4. Exceptions/Alternatives will be considered.

5. Based on the initial evaluation, NNPS may request the selected Offerors to make oral presentations and provide product demonstrations. Thereafter, NNPS will conduct negotiations with each of the selected short-listed Offerors. Individuals representing the Offeror during negotiations shall have the authority to negotiate and contractually bind the company to a contract.

6. After negotiations are completed, NNPS will select the Offeror who, in NNPS’s opinion, has made the best proposal and shall award the contract to that Offeror (referred to in this RFP as the Successful Offeror).

Should NNPS determine in writing and in its sole discretion that only one Offeror is fully qualified, or that one Offeror is clearly more highly qualified than the others under consideration, a contract may be negotiated and awarded to that Offeror.

7. NNPS is not required to furnish a statement of the reason(s) why a proposal was not deemed to be the most advantageous.

I. Presentation/Demonstration:

If in NNPS’s opinion, vendor presentations or demonstrations of the Offeror’s proposed system’s features and capabilities are warranted, NNPS will notify the appropriate vendors. Such presentation or demonstration will be at an NNPS site or held virtually at a date and time mutually agreed to between NNPS and Offeror which will be at the Offeror’s expense.

J. Cost of Responding:

This solicitation does not commit NNPS to pay any costs incurred by the Offeror or any other party in the preparation and/or submission of proposals or in making necessary studies or designs for the preparation thereof, nor is NNPS obligated to procure or contract for such services.

V. GENERAL TERMS AND CONDITIONS

A. Contract Document:

This RFP, its addenda, Successful Offeror’s proposal, any additional information requested, and negotiated changes and will constitute the final contract hereafter referred to as this “contract”. These documents will be incorporated by reference into the NNPS purchase order awarding this contract. This contract shall be governed by the contract documents in the following order of precedence:

1. This RFP document;

2. Any negotiated changes to the foregoing documents; and

3. Offeror’s proposal

RFP #019-0-2026/HM Page 12 of 32

B. Proposal Binding for One-hundred Twenty (120) Days:

Offeror agrees that its Proposal shall be binding and may not be withdrawn for a period of one-hundred (120) calendar days after the scheduled closing date of this Request for Proposals.

C. Proprietary Information/Non-Disclosure:

Offeror is advised that the Virginia Public Procurement Act (Section 2.2-4342, Code of Virginia, 1950 as amended) shall govern public inspection of all records submitted by Offeror. Specifically, if Offeror seeks to protect any proprietary data or materials, pursuant to Section 2.2-4342, Offeror shall:

1. Invoke the protections of this section prior to or upon submission of the data or other materials,

2. Provide a statement that identifies the data or other materials to be protected and that states the reasons why protection is necessary.

3. Submit trade secrets or other proprietary information under separate cover in a sealed envelope clearly marked “PROPRIETARY”.

4. Information submitted that does not meet the above requirements will be considered public information in accordance with State statutes.

5. NNPS reserves the right to submit such information to the NNPS attorney for concurrence of the Offeror’s claim that it is in fact proprietary.

6. References to the proprietary information may be made within the body of the Proposal; however, all information contained within the body of the Proposal shall be public information in accordance with State statutes.

7. Trade secrets or proprietary information submitted by an Offeror in conjunction with this RFP is not subject to public disclosure under the Virginia Freedom of Information Act (VFOIA).

8. Information submitted that does not meet the above requirements will be considered public information in accordance with the VFOIA.

9. An all-inclusive statement that the entire Proposal is proprietary is unacceptable. A statement that Offeror’s costs and/or Proposal pricing are to be protected is unacceptable. Offeror will be requested to remove any such statement(s) in order to be eligible for further consideration.

D. Contract Modification:

After award, any and all modifications to this contract shall be mutually agreed to by both parties, in writing, and authorized by the NNPS Purchasing Agent or his designee via issuance of a change order (purchase order).

E. Offeror Obligation:

Offeror shall carefully examine the contents of this Request for Proposals and any subsequent addenda. Failure to do so shall not relieve the Successful Offeror of its obligation to fulfill the requirements of any contract awarded as a result of this RFP.

F. Conditions of Work:

Offeror shall inform itself fully of the conditions relating to services required herein. Failure to do so will not relieve a Successful Offeror of the obligation to furnish all goods and/or services necessary to carry out the provisions of this contract.

G. Prime Contractor:

If in its performance of this contract, Successful Offeror supplies goods or services by or through another party or subcontractor, Successful Offeror agrees that:

1. Successful Offeror shall act as the prime contractor for the goods and services to be provided under contract and shall be the sole point of contact with regard to all obligations under this contract.

2. Successful Offeror represents and warrants that Successful Offeror has made third parties or subcontractors aware of the proposed use and disposition of the other party’s products or services, and that such other party has agreed in writing that it has no objection and that NNPS is not liable to such third parties or subcontractors for any work performed under this contract.

3. The use of subcontractors and the work they perform must receive the prior written approval of NNPS.

NNPS will designate a Contract Administrator to approve such work.

4. Successful Offeror shall be solely responsible for all work performed and materials provided by subcontractors.

5. Successful Offeror shall be responsible for the liability of subcontractors for the types and limits

RFP #019-0-2026/HM Page 13 of 32 required of the Successful Offeror under this contract.

H. Subcontractors:

Contractor's use of subcontractors and the work they are to perform must receive written approval from the Contract Administrator at least ten (10) calendar days prior to the work being performed. Contractor shall be solely responsible for all work performed and materials provided by subcontractors. Contractor shall be responsible for the liability of subcontractors for the types and limits required of the Contractor.

I. Non-Assignment:

Successful Offeror shall not assign its rights and duties under this Agreement without the prior written consent of the NNPS Contract Administrator.

J. Antitrust:

Any perceived anti-trust violation shall be reported to the State Attorney General for possible enforcement of anti-trust laws.

K. Anti-collusion/Nondiscrimination Requirements Form:

The attached “Anti-collusion/Nondiscrimination Requirements” form, on page 2 of this RFP, shall be executed by Offeror and is to be submitted with Offeror’s proposal. The requirements set forth on said form shall be considered to be binding terms and conditions in any contract resulting from this RFP. A contract will not be awarded to an Offeror who has not signed the anti-collision/nondiscrimination statement.

L. Compliance with Federal, State, and Local Laws and Federal Immigration Law:

Contractor does not, and shall not during the performance of the contract for goods and services in the Commonwealth, knowingly employ an unauthorized alien as defined in the federal Immigration Reform and Control Act of 1986.

M. Compliance with state law; foreign and domestic businesses authorized to transact business in the Commonwealth:

Contractor organized as a stock or nonstock corporation, limited liability company, business trust, or limited partnership or registered as a registered limited liability partnership shall be authorized to transact business in the Commonwealth as a domestic or foreign business entity if so required by Title 13.1 or Title 50 or as otherwise required by law. Contractor shall not allow its existence to lapse or its certificate of authority or registration to transact business in the Commonwealth, if so required under Title 13.1 or Title 50, to be revoked or cancelled at any time during the term of the contract. NNPS may void any contract with the Contractor if the Contractor fails to remain in compliance with the provisions of this section.

N. Hold Harmless/Indemnification:

It is understood and agreed that Successful Offeror hereby assumes the entire responsibility and liability for any and all material damages to persons or property caused by or resulting from or arising out of any act or omission on the part of Successful Offeror, its subcontractors, agents or employees under or in connection with this Contract or the performance or failure to perform any work required by this Contract. Successful Offeror agrees to indemnify and hold harmless NNPS and its agents, volunteers, servants, employees and officials from and against any and all claims, losses, or expenses, including reasonable attorney's fees and litigation expenses suffered by any indemnified party or entity as the result of claims or suits due to, arising out of or in connection with (a) any and all such damages, real or alleged, (b) the violation of any law applicable to this Contract, and (c) the performance of the work by Successful Offeror or those for whom Successful Offeror is legally liable. Upon written demand by the NNPS, Successful Offeror shall assume and defend at Successful Offeror's sole expense any and all such suits or defense of claims made against the NNPS, its agents, volunteers, servants, employees or officials.

O. Notices:

1. All notices, requests, demands, and elections under this contract, other than routine operational communications, shall be in writing and shall be deemed to have been duly given on the date when hand-delivered, or on the date of the confirmed facsimile transmission, or on the date received when delivered by courier that has a reliable system for tracking delivery, or six (6) NNPS business days after the date of mailing when mailed by United States mail, registered or certified mail, return receipt requested, postage prepaid. All notices shall be addressed

RFP #019-0-2026/HM Page 14 of 32 to the following individuals:

To NNPS: NNPS Contract Administrator as designated in this RFP.

To Successful Offeror: Successful Offeror’s Contract Administrator as defined in Successful Offeror’s proposal.

2. Either party may from time to time change the individual(s) to receive notices and/or its address for notification purposes by giving the other party written notice as provided above.

P. Non-Performance:

1. Delivery Delays: NNPS reserves the right to procure goods and/or services to be provided under this Contract from other sources in the event Successful Offeror fails to deliver such goods and/or service deliverables in accordance with delivery dates and time frames set forth in this Contract.

2. Unacceptable Deliveries (Rejections): Upon notification by NNPS that goods and/or service deliverables provided by the Successful Offeror under this Contract are damaged and/or not of the quality specified by NNPS, such goods and/or service deliverables will be rejected. Successful Offeror shall replace such rejected goods and/or service deliverables immediately or within a reasonable time as determined by NNPS.

3. Successful Offeror shall remove all rejected materials, equipment or supplies from the premises of NNPS within ten (10) days of notification. Rejected goods and/or service deliverables not removed from NNPS’ premises within ten (10) days will be regarded as abandoned, shall become the property of NNPS, and NNPS shall have the right to dispose of such items.

4. NNPS reserves the right to authorize immediate purchase from other sources against rejections.

5. Liability: Successful Offeror shall be liable to NNPS for all costs incurred by NNPS as a result of Successful

Offeror's failure to perform in accordance with the Contract. Successful Offeror's liability shall include, but not be limited to:

a. Damages and other delay costs, to include costs to procure goods/services from alternate suppliers.

b. Increased costs of performance, such as extended overhead and increased performance costs resulting from performance delays caused by Successful Offeror and/or rejections of Successful Offeror’s goods and/or service deliverables.

c. Warranty and rework costs, liability to third party, excess costs, attorney’s fees and related costs incurred by NNPS due to non-responsive performance of Successful Offeror.

Q. Termination Without Cause:

NNPS may at any time, and for any reason, terminate this Contract by written notice to Successful Offeror specifying the termination date, which shall be not less than thirty (30) days from the date such notice is mailed.

Notice shall be given to Successful Offeror by certified mail/return receipt requested, addressed to the Successful Offeror’s Contract Administrator. In the event of such termination, Successful Offeror shall be paid such amount as shall compensate Successful Offeror for the work satisfactorily completed, and accepted by NNPS, at the time of termination. In the event NNPS terminates this Contract, Successful Offeror shall withdraw its personnel and equipment, cease performance of any further work under this Contract, and turn over to NNPS any work completed or in process for which payment has been made.

R. Termination With Cause/Breach:

In the event that Successful Offeror shall for any reason or through any cause be in default of the terms of this Contract, NNPS may give Successful Offeror written notice of such default by certified mail/return receipt requested, addressed to the Successful Offeror’s Contract Administrator. Unless otherwise provided, Successful Offeror shall have ten (10) days from the date such notice is mailed in which to cure the default. Upon failure of the Successful Offeror to cure the default, NNPS may immediately cancel and terminate this Contract as of the mailing date of the default notice. Upon termination, Successful Offeror shall withdraw its personnel and equipment, cease performance of any further work under the Contract, and turn over to NNPS any work in process for which payment has been made. In the event of violations of law, safety or health standards and regulations, this Contract may be immediately cancelled and terminated by NNPS and provisions herein with respect to opportunity to cure default shall not be applicable.

S. Breach of Contract:

1. Successful Offeror shall be deemed in breach of this contract if the Successful Offeror:

a. Fails to comply with any terms of this contract;

RFP #019-0-2026/HM Page 15 of 32

b. Fails to cure such noncompliance within ten (10) calendar days from the date of the NNPS written notice or such other time frame, greater than ten (10) calendar days, specified by the NNPS Contract Administrator in the notice.

2. Fails to submit a written response to the NNPS notification of noncompliance within ten (10) calendar days after the date of the NNPS notice.

3. All notices under this contract shall be submitted, either by fax or certified mail, return-receipt requested, to the respective contract administrator.