AGO474000 - FY25 - Pen Testing - 5AW1 - INC0140323

The State of Ohio is seeking to procure penetration testing services from Bugcrowd to enhance its cybersecurity infrastructure, with a specific focus on comprehensive vulnerability assessment and testing across multiple digital environments. The procurement, identified as AGO474000 - FY25 - Pen Testing - 5AW1 - INC0140323, is soliciting services that include standard penetration testing for web and network systems, vulnerability disclosure program management, and specialized security assessments. The contract will cover testing of web, network, API, and mobile platforms, with deliverables including real-time result visibility through the Bugcrowd platform, comprehensive vulnerability reporting, and ongoing security operations support. Key objectives include strengthening the state's cyber security presence through rigorous testing methodologies, embedded submission forms, and advanced program reporting. The solicitation was posted on April 14, 2025, with proposals due by April 30, 2025, indicating a relatively tight procurement timeline of approximately two weeks for potential vendors to prepare and submit their responses.

While no specific set-aside designations or enterprise restrictions were explicitly mentioned in the documentation, the contract appears to be a competitive procurement targeting specialized cybersecurity service providers with expertise in penetration testing and vulnerability management. The total contract value is estimated at $89,200, with individual service prices ranging from $1,000 to $24,000 depending on the specific testing requirements and environmental complexity. Service components include public program access, unlimited triage and validation by Bugcrowd's security operations team, SDLC integration, and ongoing account management. The pricing structure suggests flexibility for additional testing if the initial environment parameters are exceeded, indicating the state's commitment to comprehensive security assessment. The procurement appears to be technology-agnostic, focusing on the vendor's capability to provide robust, adaptable cybersecurity testing services rather than requiring integration with specific existing infrastructure.