Vulnerability Assessment & Penetration Testing MSOW

The Iowa Department of Management is seeking a Master Statement of Work (MSOW) for Vulnerability Assessment and Penetration Testing services through a Request for Bid (RFB) PQ-185-2522-2025. This procurement is specifically targeted at prequalified cybersecurity vendors in Category #4, who were previously awarded contracts from procurement 2024BUS0915. The primary objective is to secure comprehensive cybersecurity assessment services, with vendors required to submit hourly rates for services using an attached pricing schedule. Bids will be accepted from June 2, 2025, at 12:00 PM CDT to June 16, 2025, at 1:00 PM CDT, with the anticipated contract term ending on November 30, 2029. The agency reserves the option to renew the MSOW for up to five additional annual periods. Bidders must be explicitly listed in the Cybersecurity Prequalified Vendors List and demonstrate capability to perform detailed vulnerability assessments and penetration testing services. The solicitation contact is Zach Gillen, who can be reached at zach.gillen@dom.iowa.gov for any questions regarding the bid.

The procurement is exclusively reserved for prequalified vendors, with no specific set-aside designations for disadvantaged enterprises mentioned in the available documentation. Payment terms are structured at 0% 0, Net 60, in compliance with Iowa Code 8A.514, which allows the state 60 days to process invoice payments. While specific budget ranges are not disclosed, the procurement suggests a potentially significant contract value given the comprehensive nature of cybersecurity services and the extended potential contract duration. The MSOW will be used by the Department of Management, indicating a statewide scope for these cybersecurity services. No incumbent vendors or existing technology integration requirements are explicitly detailed in the provided documents. Interested vendors must carefully review the prequalification requirements and ensure they meet the specific criteria for Cybersecurity Vendor Support Services Category #4 before submitting their bid.