DOM Vulnerability Assessment and Penetration Testing MSOW

Background
The Department of Management is seeking to conduct regular vulnerability assessments and penetration tests to identify weaknesses in systems and networks. This solicitation is specifically open to cybersecurity prequalified vendors in Category #4: Vulnerability Assessment and Penetration Testing, as awarded from the previous procurement process (204BUS0915). The resulting Master Statement of Work (MSOW) will be exclusively for the Department of Management's use, with an anticipated term ending on November 30, 2029, and an option for up to five annual renewals.

Work Details
The contractor will provide a range of cybersecurity services including:

1. External Network Penetration Testing - Simulates attacks from external threat actors targeting internet-facing infrastructure.
2. Internal Network Penetration Testing - Mimics insider threats to test internal networks.
3. Web Application Penetration Testing - Tests security of web applications based on various criteria such as user roles and authentication.
4. Mobile Application Penetration Testing - Analyzes vulnerabilities in mobile apps across client-side and server-side communications.
5. Wireless Network Penetration Testing - Assesses security based on access points and SSIDs.
6. Cloud Infrastructure Penetration Testing - Evaluates cloud environments for misconfigurations and unauthorized access risks.
7. Social Engineering - Conducts phishing, vishing, and smishing attempts to test human factors in security.
8. Physical Security / Facility Intrusion Testing - Tests physical security measures against various intrusion techniques.
9. Network Vulnerability Assessment - Evaluates network vulnerabilities based on IP addresses and scanning depth.

Period of Performance
The contract will be performed from the date of award until November 30, 2029, with options for five annual renewals.

Place of Performance
Services will be performed at locations specified by the Department of Management or as required by the nature of the assessments.

Bidder Requirements
Only vendors prequalified in Category #4: Vulnerability Assessment and Penetration Testing are eligible to respond to this solicitation.