What the buyer needs

AI summary

The government authority located in New Orleans, LA requires a USA-based onshore organization to provide offsite cybersecurity assessment and penetration testing services. The buyer needs vulnerability assessments to validate host configurations, manually verify vulnerabilities, and produce lists of known system flaws across operating systems, host applications, email servers, remote access services, and other servers. Additionally, the scope demands penetration testing to exploit vulnerabilities in email systems, firewalls, routers, VPN tunnels, and web servers. The vendor must also provide Virtual Chief Information Security Officer (vCISO) services to analyze security program effectiveness, perform vulnerability assessments and penetration tests, and review security policies, processes, and controls. Bidders must submit all questions no later than October 16, 2026. The buyer accepts digital response submissions via email or online and requests proposals to determine the budget.

Scope of work

Vulnerability Assessment with Penetration Test
Post-remediation Vulnerability Assessment
12 months of vCISO telephone support not to exceed 24 hours
Scope validation including ping sweeps, port scans, and footprinting
Enumeration and vulnerability mapping
Manual verification of automated scanning findings
Web application server testing within in-scope IP address range
Recommendations for AI and data governance policies

How proposals are evaluated

Criterion	Weight / scoring
Lowest responsible bidder	Not specified

Minimum qualifications

Must be an onshore USA Organization
Documented previous experience performing cybersecurity testing and assessments for transit systems
ISO/IEC 27001 compliant in internal controls to prevent data exposure
SOC 2 Type II compliant in internal controls to prevent data exposure
Assessment personnel must have documented experience using platforms such as Kali Linux and hold OSCP or CEH certifications
vCISO must have documented experience and provide qualifications and certifications upon award
Deployed personnel must undergo third-party background checks including criminal history and driving record

Documents to include with your response

Unit Price Bid Form (Attachment I)
Non-Collusion Affidavit
Participant Information Form
Addendum Acknowledgement
Fully executed Louisiana Public Bid Form
Contract Participation and DBE Commitment Form 1 - Schedule A
DBE Participation Questionnaire Form 2 - Schedule B (if applicable)
Good Faith Efforts Form 3 - Schedule C (if applicable)

How to submit

Method: Electronic via the RTA Procureware portal or delivered hard copy
Instructions: Submitted online through https://norta.procureware.com/home or delivered to 2817 Canal Street, New Orleans, LA 70119 on or before 2:00 P.M., November 3, 2026.