Independent Cybersecurity Risk Assessment and Penetration Testing Services

Carlynton School District requires independent cybersecurity risk assessment and penetration testing services performed onsite and offsite. The scope encompasses assessing governance structures, administrative controls, identity management, cloud configurations, network architecture, and ransomware recovery capabilities. Vendors must also conduct external and internal penetration testing, internet-facing vulnerability assessments, retesting of remediated Critical and High findings, and at least one K–12 simulated incident tabletop exercise. Eligibility requires onshore USA organizations with professional cybersecurity and penetration-testing experience, specifically in Microsoft environments and K–12 educational organizations. Vendors may submit responses digitally via email or online by November 11, 2026, while questions are due by October 19, 2026. Proposals are evaluated on K–12/Pennsylvania public-sector cybersecurity experience (20%), qualifications and experience of assigned personnel (15%), cost/value (15%), and the quality and usefulness of proposed deliverables (10%).