#IWQ #127067 Provision of PCI Penetration Testing Services

Gwinnett County, Georgia is soliciting qualified service providers through an Informal Written Quotation (IWQ #127067) to provide comprehensive PCI penetration testing services. The procurement encompasses three distinct assessment areas: external network penetration testing against internet-facing systems (limited to 250 IP addresses for discovery scanning, 125 for vulnerability scanning, and 50 for penetration testing), internal network penetration testing from within the County network (limited to 500 IP addresses for discovery scanning, 250 for vulnerability scanning, and 100 for penetration testing), and application penetration testing for a web-based application with username/password authentication. Qualified vendors must hold an Offensive Security Certified Professional (OSCP) certification, or approved equivalents including GPEN or GXPN certifications, and must demonstrate financial stability with a minimum of three references for similar projects. The primary deliverable is a comprehensive technical findings report that includes an executive summary, approach documentation, detailed findings and recommendations, and supporting appendices. The County will award to the lowest responsive and responsible vendor based on pricing submitted on the County's fee schedule. The revised deadline for quote submissions is 3:00 p.m. on March 20, 2026, with submissions required via email to Bethany.White@GwinnettCounty.com. Service delivery will occur at 75 Langley Drive, Lawrenceville, Georgia 30046, with payment expected within 30 days of receipt of approved payment requests.

All contractors must maintain extensive insurance coverage including Commercial General Liability with a $2,000,000 general aggregate limit, Professional Liability/Errors and Omissions coverage with $1,000,000 per claim and $2,000,000 aggregate limits, and Cyber Liability Insurance with $1,000,000 per claim and aggregate limits. Respondents must comply with the Georgia Illegal Immigration Reform Enhancements for 2013, maintain E-Verify participation, and execute a notarized Contractor Affidavit and Agreement. The County has previously engaged external service providers for PCI penetration testing and does not mandate adherence to a specific testing methodology; vendors should propose their standard PCI testing methodology. Awarded vendors will access the testing environment through an OVA/Virtual machine provisioned by the County's ITS team, with VPN access available as an alternative. Specific environmental details including the total number of IP addresses in scope, the number of live systems, network segments, concurrent scanning permissions, and Active Directory infrastructure sharing information will be provided to the awarded service provider post-award. While no specific budget range is listed, pricing will be a critical evaluation factor with award going to the lowest responsive bid. Vendors must sign and return the addendum with their quote submissions to avoid being deemed non-responsive.