baselineRFIDoes the platform provide continuous/automated breach-and-attack simulation (BAS) versus point-in-time manual penetration testing, and can both be run from the same platform?weight 3
Answer key — what a strong answer shows
Clarify whether this is a BAS platform, a pen-testing service, or genuinely both — many vendors market as one but deliver only the other.
baselineRFPDescribe the attack technique library (MITRE ATT&CK coverage) — how many techniques/procedures are simulated, and how frequently is the library updated to reflect newly observed adversary TTPs?weight 3
Answer key — what a strong answer shows
Look for a specific ATT&CK coverage count and update cadence, not a vague 'comprehensive coverage' claim.
baselineRFIHow does the platform validate whether existing security controls (EDR, SIEM, firewall) actually detected or blocked each simulated attack, and is this validation automated or does it require manual log review?weight 3
Answer key — what a strong answer shows
Strong answers describe automated control-validation feedback rather than requiring the customer to manually cross-reference logs.
baselineRFIFor manual/human-led penetration testing, what are the tester qualifications (OSCP, OSCE, CREST, etc.), and can customers request specific testers or specializations (web app, cloud, red team)?weight 3
Answer key — what a strong answer shows
Look for named certifications and the ability to request specialized testers, not a generic 'certified testers' claim.
baselineRFPDetail reporting depth for a completed engagement — does it include exploitation proof, business-risk framing, and prioritized remediation guidance, and what is the typical turnaround time from test completion to final report?weight 3
Answer key — what a strong answer shows
Strong answers state a specific turnaround time and describe business-risk framing beyond a raw vulnerability list.
baselineRFIDoes the platform support purple-team exercises where simulation results are used collaboratively with the defense team in real time, versus a black-box report delivered after the fact?weight 3
Answer key — what a strong answer shows
Real-time collaborative purple-teaming is a materially different, often more valuable, engagement model than after-the-fact reporting.
baselineRFPExplain how remediation is verified — is there an automated re-test of the specific attack path after a fix is applied, and what is the typical cost/effort of a re-test compared to the original engagement?weight 3
Answer key — what a strong answer shows
Look for an efficient re-test mechanism (ideally automated for BAS, or discounted for manual pen tests) rather than requiring a full new engagement.
baselineRFIWhat is the safety/blast-radius model for automated BAS in production environments — are simulated attacks executed safely with no real payload/exploitation, or does the platform require a staging environment?weight 3
Answer key — what a strong answer shows
Strong answers explain concretely how production safety is guaranteed rather than asserting 'safe for production' without detail.
baselineRFIDoes the platform offer cloud-native attack-path simulation specific to AWS/Azure/GCP misconfigurations and privilege-escalation chains, distinct from traditional network/endpoint attack simulation?weight 3
Answer key — what a strong answer shows
Cloud-specific attack-path simulation (e.g., simulating an IAM privilege-escalation chain) is a materially different and increasingly important capability from traditional on-prem BAS — ask for it explicitly rather than assuming general BAS coverage extends to cloud.
baselineRFPDetail social-engineering and physical penetration testing scope — does the service include pretexting, tailgating/physical-access testing, or is the offering limited to purely technical/network attack simulation?weight 3
Answer key — what a strong answer shows
Strong answers are explicit about whether social-engineering and physical testing are included, add-on, or entirely out of scope — this is a common gap between marketing claims and actual service scope.
baselineRFIHow does the platform or service specifically support compliance-mandated annual penetration tests (PCI DSS, SOC 2) — does it produce an attestation-ready report format auditors will accept, and has it been accepted by auditors for real customers?weight 3
Answer key — what a strong answer shows
Look for a concrete track record of auditor-accepted reports, not just a claim of 'compliance-ready' formatting — ask for a customer reference where the report was actually used to pass an audit.
baselineRFPExplain the pricing model — per-engagement flat fee, subscription for continuous BAS, or hybrid — and provide a total cost comparison between a single annual manual pentest and a year of continuous automated simulation for a comparable environment.weight 3
Answer key — what a strong answer shows
Strong answers give a real cost comparison; a vendor unable to frame their pricing against the traditional annual-pentest alternative is avoiding a legitimate buyer question about ROI.
baselineRFIDoes the platform offer red-team-as-a-service with a continuous/retained engagement model (ongoing embedded adversary simulation) versus only discrete, scheduled engagements, and what does a typical retained-service SLA look like?weight 3
Answer key — what a strong answer shows
A continuous retained red-team model provides materially different (and more expensive) value than periodic point-in-time engagements — the answer should make the distinction and pricing implications clear.
baselineRFIHow deep is API and application-layer penetration testing specifically (business-logic flaws, broken authorization, not just OWASP Top 10 automated scanning) — are these manual, specialist-led tests or automated tooling relabeled as 'API pentesting'?weight 3
Answer key — what a strong answer shows
Manual, business-logic-focused testing catches materially different vulnerabilities than automated scanning — press on whether 'API pentesting' means real manual testing or just an automated scanner with a pentest label.
baselineRFPDetail ransomware-specific attack simulation — does the platform simulate real-world ransomware TTPs (lateral movement, backup-deletion attempts, exfiltration-before-encryption) end-to-end, and can it validate whether backup/recovery controls would actually survive a simulated attack?weight 3
Answer key — what a strong answer shows
End-to-end ransomware simulation that tests backup/recovery resilience (not just initial-access detection) is a materially more complete validation than a generic 'ransomware module' that only tests endpoint detection.
baselineRFIHow does the platform integrate with the customer's existing vulnerability management program so that simulation-validated attack paths and scanner-identified vulnerabilities feed into a single combined risk view, rather than two disconnected reports?weight 3
Answer key — what a strong answer shows
A genuinely combined risk view (validated exploitability from BAS/pentest cross-referenced with VM scanner findings) is materially more actionable than two separate tools producing two separate, unreconciled reports.
baselineRFPVendors should provide a range of testing and validation services; vendors must not only describe their approach but also provide evidence of their capability in each area (Penetration Testing, Red Team, Purple Team, BAS).weight 3
baselineRFPDefine potential penetration testing scenarios with the ISO.weight 3
baselineRFPPerform manual-first penetration testing across external, internal, cloud, and application environments.weight 3
baselineRFPPlan and prepare for the penetration test results to include scripts and presentation materials and review with the ISO.weight 3
baselineRFPEvaluate reports, methodologies, credentials, and references for the penetration testing engagement.weight 3
baselineRFPFacilitate a 3-4 hour penetration test results session with 20-30 department leaders and IT professionals from the organization.weight 3
baselineRFPDocument, within 30 days, penetration test results to include documented scenarios, evaluation of the port authority's response to scenarios, and documented well-done items and opportunities for improvement.weight 3
baselineRFPPerform Red Team exercises that emulate real-world threat actors.weight 3
baselineRFPProvide a case study of a previous adversary emulation engagement, including objectives, outcomes, and mapped tactics using the MITRE ATT&CK framework.weight 3
baselineRFPProvide metrics from Red Team engagements (e.g., time-to-detect, dwell time, response effectiveness).weight 3
baselineRFPProvide Red Team qualifications (e.g., GPEN, CRTP) of team members.weight 3
baselineRFPFacilitate Purple Team sessions where offensive tactics, techniques, and procedures (TTPs) are executed while defenders tune detections in real time.weight 3
baselineRFPProvide a sample agenda or workshop outline for Purple Team exercises.weight 3
baselineRFPProvide example Purple Team deliverables such as after-action reports, detection tuning documentation, or playbook updates.weight 3
baselineRFPProvide client feedback or testimonials highlighting measurable improvements in detection or response from Purple Team engagements.weight 3
baselineRFPProvide mapping of Purple Team tactics to MITRE ATT&CK for transparency.weight 3
baselineRFPProvide a breach and attack simulation (BAS) platform or managed service to continuously validate controls.weight 3
baselineRFPProvide screenshots or sample reports from the BAS platform.weight 3
baselineRFPProvide proof of BAS integration with Security Information and Event Management (SIEM) systems and Security Orchestration, Automation, and Response (SOAR) platforms.weight 3
baselineRFPProvide documentation showing how repeatable BAS testing is scheduled and validated.weight 3
baselineRFPProvide metrics demonstrating BAS detection coverage and improvements over time.weight 3
baselineRFPPerform authorized external network penetration testing of the public-facing perimeter of all the municipality's locations, including all externally reachable municipality-owned IP addresses, internet-facing services, web applications, remote access portals, VPN endpoints, and externally hosted services, including reconnaissance, service/version enumeration, vulnerability identification, authenticated and unauthenticated exploitation attempts, password attacks against exposed authentication interfaces, and manual validation of all findings (automated scanning alone is not permissible).weight 3
baselineRFPPerform authorized internal network penetration testing of two isolated internal environments (the main municipal facility and the Police Department), simulating a threat actor with internal network access, including network discovery, vulnerability identification, lateral movement, privilege escalation, credential harvesting, Active Directory enumeration and attack path analysis, with manual validation of all findings.weight 3
baselineRFPDeploy a separate, hardened, encrypted-at-rest testing appliance to each isolated internal environment for parallel testing; appliances shall be uniquely identified and removed or sanitized at the conclusion of the engagement.weight 3
baselineRFPPerform authorized social engineering testing of municipal personnel, including email phishing campaigns against an agreed-upon population, sophisticated enough to simulate an adversary-in-the-middle (AiTM) attack.weight 3
baselineRFPCoordinate testing windows with municipal IT staff and, for Police Department systems, with the Chief of Police or designee; provide weekly updates during active testing and immediately notify the municipality of any critical finding presenting an active risk to operations or public safety.weight 3
baselineRFPObtain municipal approval before proceeding with validation of any finding that could disrupt municipal operations.weight 3
baselineRFPDeliver a written final report including an executive summary for a non-technical audience, detailed technical findings with risk ratings/evidence/remediation recommendations, an attack narrative, a social engineering results summary (click rates and credential capture rates by group), and a prioritized remediation roadmap, with all findings scored using CVSS or an equivalent standard.weight 3
baselineRFPMaintain and deliver an engagement log documenting date/time of each attack performed (with emphasis on successful attacks) to allow the municipality to correlate testing activity against its security monitoring and alerting systems.weight 3
baselineRFPBe available to present findings to municipal staff and, if requested, to the governing board in executive session.weight 3
baselineRFPStore all engagement data in encrypted form, not transmit municipal data to any third party, not use municipal data for marketing/case studies/AI-ML training, and securely destroy all engagement data no later than 30 days after final report acceptance except where retention is required by law.weight 3
baselineRFPBe willing and ready to sign a non-disclosure agreement.weight 3
baselineRFPConfer with municipal IT staff and the Police Department on penetration testing matters as requested during the contract term.weight 3
baselineRFPAcknowledge that the anticipated services described can be provided and indicate any relevant additional services the firm would offer.weight 3
baselineRFPDemonstrate a minimum of five (5) years of experience providing network penetration testing services, with documented experience serving municipal, public sector, or law enforcement clients.weight 3
baselineRFPDemonstrate experience performing external, internal, and social engineering penetration testing engagements of comparable scope.weight 3
baselineRFPDemonstrate familiarity with industry-recognized testing methodologies (e.g., PTES).weight 3
baselineRFPIdentify staffing qualifications, including the proposed engagement lead.weight 3
baselineRFPProvide a methodology overview and sample (redacted) deliverables demonstrating minimum requirements.weight 3
baselineRFPProvide a sample (redacted) penetration testing report demonstrating the firm's reporting format and quality.weight 3
baselineRFPConfirm the firm has the legal authority and technical capability to perform network penetration testing services and shall comply with applicable laws, including the Computer Fraud and Abuse Act, applicable state computer crime statutes, and the FBI CJIS Security Policy where applicable.weight 3
baselineRFPConduct white-box testing for both a Cybersecurity Risk Assessment and a Penetration Test across eight of the housing authority's locations and fourteen departments, covering 10+ cloud applications, 2 web applications, AD, endpoints, and on-premises equipment for 500+ devices, targeting 350+ users, including phishing, vishing, smishing, and physical pretexting.weight 3
baselineRFPTest internet-facing assets (perimeter, VPN, remote access, web portals) for exploitable weaknesses (External Network Testing).weight 3
baselineRFPAssess internal systems and segmentation for lateral movement opportunities and common misconfigurations (Internal Network Testing).weight 3
baselineRFPAttempt to escalate privileges and move across systems to simulate real attacker behavior (Privilege Escalation & Lateral Movement).weight 3
baselineRFPConduct simulated phishing and approved pretexting scenarios to assess user awareness and process controls (Social Engineering, optional/scoped).weight 3
baselineRFPRecord validated findings with proof-of-concept details and reproduction steps (Evidence & Exploitation Documentation).weight 3
baselineRFPProvide fix validation support and a retest option for high/critical findings (Remediation Guidance & Retest, optional/scoped).weight 3
baselineRFPDeliver a Penetration Test Report (PDF/Word) covering scope, methods, validated findings, exploited vectors, and recommended remediations, including an estimate of hours to remediate the findings.weight 3
baselineRFPProvide details of the cybersecurity professionals who will be involved in the engagement, including qualifications, certifications (e.g., CISSP, CEH, OSCP), and experience (Team Qualifications).weight 3
baselineRFPProvide a clear outline of the approach and methodology for both the Cybersecurity Risk Assessment and Penetration Test, including tools, techniques, and standards followed (e.g., NIST, OWASP).weight 3
baselineRFPProvide a Penetration-Testing-as-a-Service (PTaaS) offering that allows the organization to dynamically request testing, coordinate execution, and receive results through a centralized platform, minimizing manual processes and focusing on automation, efficiency, and the most relevant threats.weight 3
baselineRFPPropose an approach for testing mission systems and applications in pre-production/production-like test environments for vulnerabilities, design anti-patterns, resistance to DoS/DDoS, and common coding and configuration errors, with options for tailoring scope, retesting remediated findings, and focused ad hoc tests.weight 3
baselineRFPPerform Ethical Hacking testing including internal network scanning, port scanning, system fingerprinting, services probing, exploit research, manual vulnerability/configuration testing and verification, application layer testing, firewall/ACL testing, privilege escalation, password strength testing, network equipment and database security controls testing, and internal network scanning for known trojans.weight 3
baselineRFPPerform Web Application testing including injection, broken authentication/session management, XSS, insecure direct object references, security misconfiguration, sensitive data exposure, missing function-level access control, CSRF, use of components with known vulnerabilities, unvalidated redirects/forwards, API/web services testing, session hijacking (MITM/sniffing/sidejacking), and malicious file upload.weight 3
baselineRFPPerform application code testing for user session management including input validation of login fields, cookie security, lockouts, and user session integrity.weight 3
baselineRFPTest across all major user types for each system (anonymous, external, internal non-privileged, internal privileged users) as recommended by the organization based on access levels.weight 3
baselineRFPOffer optional Social Engineering Testing (phishing, vishing, smishing, and AI emulation/simulation) supporting three corporate-level campaigns annually, and publish an annual Social Engineering Assessment Report with recommendations, outcomes, and key risks.weight 3
baselineRFPOffer optional Physical Environment Testing including Wi-Fi penetration testing of corporate and guest networks, and physical access testing (tailgating, guest verification/monitoring, access to controlled rooms) at the organization's headquarters.weight 3
baselineRFPHold a Contract Kick-Off Meeting no later than 10 workdays after contract award to introduce teams and coordinate technical planning.weight 3
baselineRFPDevelop and submit an Onboarding Plan for all Contractor personnel, test accounts, tools, and coordination of support by the organization's teams within 10 business days of contract award.weight 3
baselineRFPDevelop and submit a draft and final Core System Penetration Test Plan for each of up to 20 systems, with Contractor responsible for coordinating access and readiness to commence testing on schedule.weight 3
baselineRFPPublish a draft and final Core System Penetration Test Report for each system tested, summarizing all findings rated by severity, with sources, reproduction instructions, and coverage of each significant finding, within 10 business days after test conclusion.weight 3
baselineRFPEmail the organization's product manager within 1 business day of discovering a Critical or High severity finding, with draft details and reproduction instructions (Significant Alert of Finding).weight 3
baselineRFPCoordinate with the organization to document opportunities, threats, techniques, approaches, and audiences for three annual social engineering tests (Social Engineering Annual Strategy) within 45 calendar days of contract award and annually thereafter.weight 3
baselineRFPProvide monthly Ad Hoc Penetration Test reports covering all ad hoc tests accomplished, planned, in-progress, or canceled, for remediation verification or targeted vulnerability/fraud-risk testing requested by the organization.weight 3
baselineRFPProvide a weekly status report by email consolidating activities performed and planned, and a formal monthly status report of major activities/accomplishments for the organization's leadership.weight 3
baselineRFPDevelop a 60-day Transition Out Plan before end of the period of performance, including knowledge transfer and offboarding of all Contractor personnel, test accounts, and tools.weight 3
baselineRFPDevelop a proposed comprehensive Deliverables Schedule incorporating all deliverables, presented for the organization's approval and reviewed at least monthly.weight 3
baselineRFPProvide detailed information about proposed Key Personnel (Contract Engagement Manager plus additional engineers/consultants/IT leads) who will be written into the contract by name.weight 3
baselineRFPProvide an in-depth discussion of technical approach to providing the described services, including a clear statement of whether performance will comply with all RFP requirements.weight 3
baselineRFPProvide an in-depth overview of the proposed use of Artificial Intelligence in the technical approach, describing how and in what circumstances AI will be used to perform the services, with separate pricing for scenarios with and without AI use.weight 3
baselineRFPDescribe capabilities for performing the services, including personnel resources and management capabilities, and how subcontractors or partners are used and how rates are determined when using subcontractors.weight 3
baselineRFPIdentify by name all Key Personnel and describe their technical knowledge, experience, qualifications, education, and depth of expertise relevant to the requested services; submit resumes (max 2 pages each).weight 3
baselineRFPProvide a description of recent experience providing related penetration-testing-as-a-service, with examples of projects and personnel including position types and assignment lengths.weight 3
baselineRFPProvide a list of 2-3 current or recently completed contracts similar in scope, including client name, project title, period of performance, contract number/value, and primary/backup points of contact.weight 3
baselineRFPComplete pricing information (Attachment 1 - Bid Sheet), proposing alternative pricing for the PTaaS approach, fully loaded including wages, overhead, G&A, taxes, and profit.weight 3
baselineRFPProvide periodic penetration testing of the housing finance agency's public-facing web applications with a report and debriefing upon completion.weight 3
baselineRFPProvide periodic penetration testing of the housing finance agency's Wi-Fi with a report and debriefing upon completion.weight 3
baselineRFPProvide Internal and External Network Vulnerability Assessment & Penetration Testing, and Web Application Penetration Testing.weight 3
baselineRFPThe Bidder should perform periodic Information Security assessments, IT Security audits, Vulnerability Assessment and Penetration Testing (VAPT), and other applicable security assessments for the application and underlying hosting infrastructure, and remediate all identified audit observations and security gaps within timelines specified in the financial institution's IT Audit Policy.weight 3
baselineRFPFulfill all requirements as defined by PCI DSS v4.0 for external penetration tests which are to be conducted annually (per PCI DSS sections 11.3 and 11.4).weight 3
baselineRFPTesting must be based on industry-accepted penetration testing approaches (for example, NIST SP800-115).weight 3
baselineRFPTesting must include coverage for the entire Card Holder Data Environment (CDE) perimeter and critical systems, and testing from both inside and outside the network.weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
