Penetration testing, external vulnerability scanning - e-rate program for new library location in bunnell

Flagler County is seeking proposals for penetration testing and external vulnerability scanning services for the Flagler County Public Library under the E-Rate Cybersecurity Pilot Program. The procurement (RFP #25-RFP-071) aims to monitor and detect network threats for the main library and a branch location, with services covering external network, physical, and social engineering testing. Vendors must possess a valid Service Provider Identification Number (SPIN) from the Universal Service Administration Company. The evaluation process will consider multiple scoring criteria, including cost (25%), technical approach (10%), project management (10%), service and maintenance plan (10%), project team qualifications (20%), security questionnaire (20%), and non-disclosure agreement (5%), with points awarded on a 0-5 scale. The response deadline is July 7, 2025, at 2:00 pm, with oral presentations scheduled for July 10, 2025, and an evaluation meeting set for July 14, 2025. The contract will commence in Fall 2025 and conclude in Summer 2026, with a one-year term and no renewal options.

The procurement does not specify explicit set-aside designations or restrictions for disadvantaged enterprises. Vendors must complete a comprehensive Third Party Security Questionnaire that evaluates security practices across multiple domains, including authentication, change management, database security, and network protection. Compliance with industry standards such as CIS Critical Security Controls, HIPAA, ISO 27002, and NIST Cybersecurity Frameworks is expected. Insurance requirements are stringent, mandating coverage including Worker's Compensation, Commercial General Liability, Automobile Liability, and Professional Liability, with minimum coverage of $1,000,000 per claim. While a specific budget range is not disclosed, the project is funded through the federal E-Rate program, and the county reserves the right to cancel or reduce the procurement if full funding is not secured. Vendors must be prepared to sign a detailed Nondisclosure Agreement and demonstrate robust capabilities in cybersecurity threat detection and remediation.