Internal and External Penetration Testing SAAS Solution

Rockland County's Department of Information Technology is seeking a recurring Software-as-a-Service (SaaS) solution for internal and external penetration testing through a competitive Request for Proposal (RFP-RC-2025-032). The procurement aims to acquire an autonomous platform that provides continuous security assessment, threat monitoring, and actionable reporting for the county's digital infrastructure. The solution must offer penetration testing capabilities without requiring agents or predefined scripts, deliver detailed remediation guidance, and verify fix effectiveness. Evaluation of proposals will be conducted using a 1,000-point weighted criteria system, with points distributed across continuous autonomous penetration testing capability (150 points), remediation guidance (100 points), SaaS technical readiness (200 points), staff qualifications (150 points), performance references (100 points), and cost (300 points). Key dates include a pre-proposal meeting on November 5, 2025, at 11:00 AM via Microsoft Teams, with written questions due by November 12, 2025, at 3:00 PM, and proposals due November 20, 2025, at 3:00 PM through the Bonfire Portal.

The contract will be a five-year term with potential one-year extensions, requiring vendors to maintain professional liability insurance of $1,000,000 per occurrence and $3,000,000 aggregate, along with commercial general liability of $1,000,000 per occurrence. Bidders must submit a minimum of three current and two past project references, with pricing required to include per-asset and total five-year cost structures. Price adjustments for option years are limited to the applicable Consumer Price Index (CPI) increase and can be requested annually with 30 days' advance notice. While no specific set-aside designations are mentioned, vendors must complete comprehensive disclosure statements covering areas such as non-collusion, political contributions, supplier responsibility, affirmative action compliance, and certifications related to business practices. The proposal requires submission of notarized documents, liability certificates, and compliance with various state and federal regulations. Though a specific budget range is not disclosed, the detailed evaluation criteria suggest the county is seeking a robust, high-quality penetration testing solution with a significant investment in cybersecurity infrastructure.