Network Environment Penetration Testing and Security Assessment Services

The Town of Monument, Colorado is requesting proposals for network environment penetration testing and security assessment services under RFP with proposals due September 9, 2026 at 5:00 p.m. MDT through BidNet Direct, and questions due August 26, 2026 at 4:30 p.m. MDT.

The scope includes baseline external and internal network penetration testing, Active Directory and identity security review, Microsoft 365 and Entra ID configuration evaluation, and a CJIS-focused assessment of Police Department systems. The engagement is designed to identify significant vulnerabilities, security misconfigurations, areas of elevated risk, validate existing security controls, and provide prioritized remediation recommendations. The Town's SCADA environment, physical security assessments, social engineering, wireless penetration testing, denial-of-service testing, application source code reviews, and red team exercises are excluded unless specifically approved in writing. The vendor will coordinate with Town staff and the Town's third-party managed services provider.

The initial contract term is one year from execution, with options for extension up to a total duration not exceeding thirty-six months, subject to satisfactory performance and mutual agreement. Proposals must be fixed-price, covering all labor, testing activities, project management, reporting, travel, and other costs. The fixed-price proposal includes one remediation validation and retesting cycle for Critical and High severity findings remediated within sixty days of final report delivery. Optional services for additional remediation validation and retesting are proposed separately.

Evaluation criteria are qualifications and relevant experience (20%), proposed methodology and technical approach (20%), deliverables and reporting quality (15%), references and government or CJIS experience (20%), and cost proposal (25%). Award is not necessarily made to the lowest-priced proposal. The anticipated evaluation period is September 10–18, 2026, with award notification expected October 6, 2026.