Web application security and penetration testing

The Oregon Public Utility Commission (OPUC) is seeking a contractor to perform a comprehensive web application security assessment and penetration testing on three of its public-facing web applications, including the OUSF, RSPF, and eDockets Search systems, as well as the OTAP Online Application and Consumer Online Complaint forms. The assessment will utilize the OWASP Application Security Verification Standard (ASVS) Level 2 requirements and include dynamic vulnerability testing, manual and automated penetration testing, and the identification of vulnerabilities with recommendations for remediation. The contractor will be responsible for project management, including a kick-off meeting, weekly technical conferences, and the delivery of a presentation, executive report, detailed findings and vulnerability matrix, and remediation verification within 60 days of the assessment completion. Proposals must be submitted by December 4, 2025, at 3:00 PM PST and should include hourly rates and estimated hours to complete the described work.

There are no set-aside designations or restrictions on the types of organizations that can respond to this opportunity. The RFQ does not list any incumbent vendors or current contractors, nor does it mention any existing infrastructure or technology that requires integration. The RFQ does not provide any specific award values or budget ranges, but the contractor will be responsible for the comprehensive web application security assessment and penetration testing services as described.