Penetration Testing

Coffee County School System

Buyer seeks biannual network penetration testing services for a three-year period from September 2025 to May 2028. Testing options include internal Gray Box, external Gray Box, or comprehensive penetration testing. Buyer requires detailed reports that identify vulnerabilities, assess severity, and recommend specific remediation steps. The service will be funded through the FCC Cyber Pilot program, with invoicing following the SPI method.

• 6/18/2025 - RFP Distribution
• 7/9/2025 - End of Questions Period
• 7/16/2025 - Bid Opening and Committee Review
• 7/16/2025 - Proposal Due Date
• 7/24/2025 - Vendor Selection Presentation
• 7/24/2025 - Board of Education Approval
• 7/25/2025 - Vendor Selection Announcement

• Must have SPIN Number from Schools and Libraries Division
• Must provide at least three references
• Must provide new, factory-sealed equipment if applicable

• Perform external Gray Box penetration testing
• Conduct internal Gray Box penetration testing
• Deliver comprehensive penetration testing reports
• Provide CVSS scores for identified vulnerabilities
• Create executive summary for non-technical stakeholders
• Detail methodology, tools, and testing phases
• Document exploitation steps for vulnerabilities
• Develop remediation recommendations with specific steps
• Create risk matrix ranked by severity
• Confirm exit from systems and closure of all backdoors
• Sign memorandum of understanding for rules of engagement
• Execute non-disclosure agreement for confidentiality
• Present technical findings with business impact assessment
• Provide proof of vulnerability discovery
• Perform biannual testing over three-year period