2026 Penetration Testing RFP RIHousing

Background
The Rhode Island Housing and Mortgage Finance Corporation (RIHousing) is seeking proposals from qualified firms to conduct penetration tests of its network, applications, and buildings. This initiative aims to identify and document risks and vulnerabilities for compliance and auditing purposes. The contract is set for a two-year period, with an option to extend for an additional two years if the selected company exceeds expectations.

Work Details
The selected vendor will perform four (4) penetration tests over the two-year period, scheduled at six-month intervals. The tests will include:

1) Social engineering (including phishing and vishing);
2) Web application testing (both credentialed and non-credentialed);
3) Physical penetration testing at one physical location;
4) External network penetration testing;
5) Wireless security testing.

The scope includes approximately 300 public IP addresses, five wildcard domains, five web applications, and one physical location. The vendor must notify RIHousing of any critical risk findings immediately and deliver a final report within five business days after the last test. This report should detail identified vulnerabilities, attack methodologies used, and recommended remediations.

Period of Performance
The contract will be performed over a two-year period with four separate tests occurring at six-month intervals: the first test in May 2026, the second in November 2026, the third in May 2027, and the fourth in November 2027.

Place of Performance
The services will be performed at RIHousing's designated locations in Rhode Island.

Bidder Requirements
Firms must demonstrate their capacity to perform the scope of work outlined in the RFP. They are required to provide information about their experience, resources, and any subcontractors involved. Additionally, firms must comply with Rhode Island laws regarding minority-owned or women-owned business participation.