Cybersecurity and Physical Security Assessment

The West Virginia School of Osteopathic Medicine (WVSOM) issued Agency Request for Quote (ARFQ) 0476 SOM2600000003 for a comprehensive Cybersecurity and Physical Security Assessment. This procurement encompasses a five-year engagement structured with comprehensive assessments in Years 1, 3, and 5, and targeted validation reviews in Years 2 and 4. The scope includes governance and risk management assessment, identity and access management (IAM) review, infrastructure and network security assessment covering approximately 100 servers, 350 workstations, 40 network printers, 3 wireless SSIDs, and 40 public IP addresses, Microsoft 365 and Azure administrative security review, and physical security assessment at a single onsite location. The assessment must align primarily with the NIST Cybersecurity Framework while maintaining sensitivity to HIPAA and FERPA obligations. Deliverables include detailed reports, vulnerability analyses, and prioritized recommendations with actionable intelligence to strengthen the institution's overall security framework. Required qualifications mandate that vendor personnel hold relevant industry certifications such as CISSP, CISM, OSCP, CEH, CISA, or CompTIA Security+ as a team combination, complete criminal background checks within the previous twelve months, and provide copies of certifications with proposals. The evaluation criteria allocate 100 total points, with 70 points for technical components (15 points for Approach and Methodology to Goals and Objectives, 20 points for Approach and Methodology to Compliance with Mandatory Project Requirements, 20 points for Qualifications and Experience Generally, and 15 points for Exceeding Mandatory Qualification and Experience Requirements) and 30 points for cost evaluation. Proposals are due by April 13, 2026, at 3:30 PM, submitted either via email to bids@osteo.wvsom.edu or by physical delivery to 400 North Lee Street, Lewisburg, West Virginia, with the Year 1 engagement anticipated to begin in Fall 2026. Vendors must contact Kerry M. Lemon, the designated buyer, at 304-647-6302 or klemon@osteo.wvsom.edu for inquiries; no pre-bid meeting or site visits are required during the solicitation period.

This procurement contains no identified set-aside designations or restrictions limiting the types of organizations that may respond, and no incumbent vendors are listed as this represents a completely new contract initiative with no previous external assessment reports available for review. The solicitation does not specify disadvantaged enterprise requirements or preferences. WVSOM has not established a maximum budget for this project; vendors must propose fixed annual pricing for each of the five contract years, with the understanding that Years 2 and 4 validation years will generally be priced lower than comprehensive assessment years. Vendors are responsible for providing all equipment necessary to perform vulnerability scanning and internal assessments and must include all travel costs for the physical security assessment in the annual lump sum pricing. WVSOM will provide integration support including read-only administrative access to Microsoft 365 and Azure tenants, current Active Directory exports or Azure AD user reports, available network diagrams and asset inventories, and existing information security policies and procedures. Restrictions include requirements that vendors employ only onshore resources, prohibit denial-of-service testing and full red team lateral movement exercises, and mandate black box testing methodology for external penetration testing, with vendors retaining full discretion in selecting non-disruptive and operationally practical vulnerability scanning tools.