Cybersecurity Penetration Testing

The City of Orlando is seeking quotes for a comprehensive Cybersecurity Penetration Testing project (RFQ23-0479) targeting multiple Water Reclamation facilities, including Iron Bridge, Water Conserv I, Water Conserv II, and the Water Reclamation Administration Facility. The procurement involves conducting internal penetration testing, network security testing, and application testing with the primary objectives of identifying system vulnerabilities and potential access points. Bidders must possess specific cybersecurity certifications, including CREST Penetration Testing, ISO 27001, OSCP, OSCE, ISACRB CSSA, and ISACRB CEPT. The project requires comprehensive reporting, which must include an executive summary, technical report, and summary report detailing testing methodologies, discovered vulnerabilities, and recommended remediation steps. Key procurement dates include a pre-solicitation conference on September 6, 2023, at 10:00 AM, a deadline for submitting questions on September 11, 2023, at 5:00 PM, and a proposal submission deadline of September 21, 2023, at 2:00 PM. The evaluation will consider the lowest responsive and responsible bid, with emphasis on vendor qualifications, experience, and technical capabilities.

The solicitation does not explicitly mention specific set-aside designations or restrictions for disadvantaged enterprises. The contract is structured as a one-time purchase, with the City reserving the right to award based on comprehensive assessment of vendor qualifications. Bidders are required to submit various supporting documentation, including references, insurance certificates, W-9 forms, and proof of certifications. The contract includes a mandatory retest to be performed at the end of 2024, ensuring ongoing cybersecurity assessment. While a specific budget range is not disclosed, the comprehensive nature of the testing across multiple facilities suggests a significant investment in cybersecurity infrastructure. The solicitation indicates that the City will prioritize vendors demonstrating robust technical expertise, comprehensive testing capabilities, and a thorough approach to identifying and mitigating potential security vulnerabilities in their water reclamation technology infrastructure.