Penetration Testing for DCBS

The Oregon Department of Consumer and Business Services (DCBS) is issuing a Request for Quotes (RFQ) for professional penetration testing services to assess the security posture of the agency's information systems. The procurement solicits comprehensive penetration testing across multiple attack vectors, including social engineering, phishing, web services, physical penetration testing, network access, Wi-Fi, device security, and employee laptop assessments. Key deliverables include a Rule of Engagement document, an executive summary suitable for leadership and non-technical stakeholders, a detailed technical report with risk ratings using CVSS or equivalent standards, mapping of findings to security frameworks such as CIS Controls and NIST, and a post-engagement debrief session. The selected consultant must complete all work by June 30, 2026, with an estimated contract term of three months. Evaluation will utilize a Best Value Analysis (BVA) process with maximum 100 points distributed across four criteria: Approach, Methodology, and Availability (45 points), Qualifications and Experience of the Consultant Firm (15 points), Qualifications and Experience of Key Persons (15 points), and Cost (25 points). Quote submissions must include methodologies description and draft Statement of Work, offeror qualifications and experience including years in the field and similar government services, descriptions and resumes of Key Persons, and a completed Pricing Sheet. The RFQ was issued on March 12, 2026, with quotes due by March 19, 2026, at 3:00 PM; questions and clarification requests must be submitted in writing to Nicholas Brooks at Nicholas.Brooks@dcbs.oregon.gov or 971-375-7762 by the offer due date.

The RFQ documents do not identify set-aside designations, disadvantaged enterprise restrictions, or preferences for specific organization types, allowing broad competition among qualified penetration testing firms. No incumbent vendors or current contractors are referenced in the procurement materials. The contract will be structured as a work order substantially similar to the MPSA sample contract form provided, requiring the consultant to furnish all necessary materials and equipment with limited reimbursement for pre-approved travel expenses compliant with the Oregon Accounting Manual. Contract award will be made to the highest-scored offeror, with payment not to exceed a specified amount in the work order, payable monthly within 45 calendar days of receipt of properly completed invoices. The RFQ materials do not disclose a specific budget range or award value; interested firms should note that the contract may include a two-tier evaluation process with potential interviews and presentations. Additionally, all offerors must be prepared to certify compliance with Oregon state and local tax laws and may be required to submit a Disclosure Exemption Affidavit to protect trade secrets or confidential business information under Oregon's Public Records Law.