Vulnerability Assessment, Penetration Testing, and Related Services

The government authority located in Ontario is seeking vulnerability assessment, penetration testing, and related services to secure its information technology environments. The agency needs to identify vulnerabilities, weaknesses, insecure configurations, and exposure risks within its current network security controls and architecture. To solve these security challenges, the agency requires a comprehensive evaluation of its applications, databases, endpoints, mobile devices, network devices, cloud environments, containers, Application Programming Interfaces, servers, Software-as-a-Service applications, and operational technology assets. The scope of work covers vulnerability assessment services, penetration testing services, and governance, risk, compliance, and advisory services. The selected provider must catalogue the agency's requested IT assets and perform web application security assessments. Requested penetration testing services include application, cloud environment, network, and web application penetration testing. The advisory and compliance scope requires manual probing of application interfaces, authentication process testing, business logic testing, and encryption usage testing. Eligible bidders must be onshore organizations located in Canada. The agency requires the performance of all work to be conducted offsite. Bidders must submit their responses digitally via email or online, and the agency is looking for proposals to determine the budget. The agency requires all questions regarding this opportunity to be submitted no later than July 17, 2026.