ITES-11288 - USA (Carnegie, Pennsylvania) - Independent Cybersecurity Risk Assessment and Penetration Testing Services - Deadline November 11,2026

(1) Vendor needs to provide independent cybersecurity risk assessment and penetration testing services to the government authority located in Carnegie, PA. – Review the agency’s cybersecurity governance structure and administrative controls, including, where applicable:• Cybersecurity policies and administrative procedures;• Roles and responsibilities;• Risk–management processes;• Acceptable–use policies;• Account–management procedures;• Privileged–access management;• Password and authentication practices;• Multifactor authentication;• Onboarding and offboarding procedures;• Cybersecurity awareness training;• Incident reporting;• Vendor and third–party risk management;• Data governance;• Cyber insurance requirements;• Business continuity;• Disaster recovery; and• Incident–response planning.– Conduct a comprehensive vulnerability assessment of authorized agency internet–facing assets.– Conduct controlled external penetration testing designed to determine whether identified vulnerabilities can be exploited by an unauthorized external actor.– Conduct internal testing from an authorized location within the agency environment.– Evaluate applicable identity–management infrastructure, including Active Directory.– Evaluate the agency’s applicable Microsoft 365/Google Workspace for Education cloud security configurations.– Evaluate network architecture from a cybersecurity perspective.– Evaluate the agency’s ability to recover from ransomware or other destructive cybersecurity incidents.– Review the agency’s cybersecurity incident–response procedures.– Conduct at least one cybersecurity tabletop exercise with appropriate District personnel. The exercise should simulate a realistic K–12 cybersecurity event such as ransomware, compromised administrator credentials, data exfiltration, or widespread system disruption.(2) All the questions must be submitted no later than October 19, 2026.