Cybersecurity and Physical Security Assessment

The West Virginia School of Osteopathic Medicine (WVSOM) is soliciting proposals through an Agency Request for Quote (ARFQ 0476 SOM2600000003) for a comprehensive Cybersecurity and Physical Security Assessment. This procurement is classified as an Agency Purchase Order under commodity code 43233203, with proposals due by April 13, 2026, at 15:30. The assessment will evaluate the current cybersecurity and physical security posture of WVSOM's facilities located at 400 North Lee Street in Lewisburg, West Virginia, encompassing approximately 100 servers (85% in Azure, 15% on-premises), 350 workstations, 40 network printers, 40 public IP addresses, 3 wireless SSIDs, 2 firewalls, and 1 VPN appliance. The scope of work includes on-site inspections, system reviews, interviews with relevant personnel, external and internal vulnerability scanning, penetration testing, wireless network assessment, configuration reviews, and development of a 12-18 month remediation roadmap aligned with the NIST Cybersecurity Framework. Deliverables must include a detailed written report with findings, risk assessments, prioritized recommendations by risk level and implementation feasibility, and supporting evidence to establish baseline security metrics. Vendors must demonstrate relevant certifications or experience in both cybersecurity and physical security disciplines, with acceptable credentials including CISSP, CISM, OSCP, CEH, CISA, or CompTIA Security+; all proposed personnel must have completed criminal background checks within the previous twelve months. WVSOM intends to award the contract and begin Year 1 engagement in the fall, with the contract structured as a five-year engagement featuring comprehensive assessments in Years 1, 3, and 5, and targeted validation reviews in Years 2 and 4.

The solicitation contains no designated set-asides or restrictions limiting responses to specific types of organizations, disadvantaged enterprises, or minority-owned businesses. This is a completely new contract with no incumbent vendor or existing contractor to transition from. WVSOM will provide essential infrastructure and documentation including network diagrams, asset inventories, system documentation, Active Directory exports, and read-only access to Microsoft 365 and Azure administrative portals; vendors must provide their own assessment equipment and tools, which must be non-disruptive and operationally practical, excluding denial-of-service testing and full red team lateral movement exercises. Proposals may be submitted electronically via email to bids@osteo.wvsom.edu or by physical delivery, and vendors must include their Federal Employer Identification Number (FEIN) and authorized signatures with submissions. WVSOM has not established a maximum budget for this project, providing vendors with complete pricing discretion; vendors should propose fixed annual lump-sum pricing for each of the five contract years, with Years 2 and 4 potentially priced lower due to narrower assessment scope. Interested vendors should contact Kerry M. Lemon, the designated buyer, at 304-647-6302 or klemon@osteo.wvsom.edu for additional information and clarifications regarding the procurement.