RFP - Multi-Jurisdictional, Cybersecurity Penetration Testing

The Atlanta Regional Commission (ARC) is soliciting proposals for a Multi-Jurisdictional Cybersecurity Penetration Testing project covering the City of Atlanta and five counties: Clayton, Cobb, DeKalb, Fulton, and Gwinnett. The procurement seeks a vendor to conduct comprehensive cybersecurity testing across multiple jurisdictions, including application testing, network testing, red team testing, and physical penetration testing. Qualified vendors must be headquartered in the United States, possess at least five years of IT security assessment experience, and demonstrate expertise in testing mobile and web applications, wireless networks, and cloud-hosted environments. The project requires detailed testing capabilities such as brute force testing, password cracking, and identifying OWASP Top 10 vulnerabilities from multiple user perspectives. Proposals will be evaluated using a "best value" approach, with technical approach (35%), expert qualifications (30%), fee reasonableness (25%), and references (10%) as primary criteria. The virtual bidder's conference is scheduled for November 5, 2025, with proposal submissions due by 12:00 PM EST on November 24, 2025. The selected vendor should be prepared to begin work within ten days of contract signing and will initially conduct one penetration test for each jurisdiction, with potential for two additional annual tests.

The project is funded through the FY2024 Department of Homeland Security Homeland Security Grant Program (DHS HSGP) with a total project cost capped at $150,000. The Atlanta Regional Commission is an equal opportunity employer committed to nondiscrimination in its operations. Proposals are limited to 30 pages and must include a sample penetration test report, hourly rates, and a comprehensive price sheet covering initial and potential additional testing. The procurement does not explicitly mention specific set-aside designations for disadvantaged enterprises or small businesses. Vendors must submit their proposals through the ARC procurement website, with all documentation and requirements specified in the Request for Proposal document. The contract will be administered by the Atlanta Regional Commission, which serves as the fiscal agent and project manager for this multi-jurisdictional cybersecurity initiative. Successful vendors should be prepared to provide detailed reporting and maintain flexibility to adapt testing methodologies to the specific needs of each participating jurisdiction.