RFP 019-0-2026/HM - Cybersecurity Penetration & Vulnerability Testing Services

Newport News Public Schools (NNPS), the ninth largest school division in Virginia serving approximately 26,500 students across 50+ facilities, is issuing RFP 019-0-2026/HM to procure comprehensive cybersecurity penetration testing and operational framework review assessment services. The procured services include vulnerability assessments, external and internal penetration testing, wireless penetration testing, firewall evaluation, data governance review, information security policy development, security awareness training, and physical penetration testing, with optional services for cloud assessments, compromise assessments, and HVAC/CCTV penetration testing. The school district operates a privately-owned fiber optic wide area network with up to 40,000 connected devices, and NNPS will provide one teacher laptop and one student Chromebook while the contractor must supply all other materials and equipment. All deliverables, including detailed assessment reports with findings and remediation recommendations, must be completed within four weeks of testing completion. Proposals are evaluated on qualifications and experience (35 points), methodology and approach/tools (30 points), deliverables (20 points), and price (15 points). An optional pre-proposal conference is scheduled for April 14, 2026, at 10:00 AM EST via Zoom, written questions are due by April 15, 2026, at 10:00 AM EDT, and proposals must be submitted via eVA only by April 27, 2026, at 10:00 AM EST. The contract term is one year from the latest signature date with four optional one-year renewal periods available at the same prices and terms.

Pricing must be submitted as a lump sum total with itemized cost breakdowns for each service category, covering all materials, equipment, incidentals, and service delivery fees. Proposal bonds equal to 5% of the total proposal price are required for proposals of $100,000 or more, and performance and payment bonds equal to 100% of the contract price are required if the project exceeds $500,000. The contractor must maintain workers' compensation coverage at statutory limits, automobile liability of $1,000,000, commercial general liability of $1,000,000, and umbrella/excess liability of $5,000,000. Payment will be made via electronic funds transfer within 30 days of invoice receipt for completed and accepted work. The contractor must comply with Virginia Code section 2.2-4367 to 2.2-4377 regarding ethics in public contracting and maintain SSAE 16 SOC Type II reports annually documenting verified controls. No set-aside designations or restrictions limiting organization types are specified in the RFP, and no specific budget range or award value is disclosed in the available documentation.