Network Penetration Testing Services

PURCHASING DIVISION
Joni Laming, Manager
(616) 632-7720
purchasing@kentcountymi.gov
SOLICITATION
Solicitation Type Request for Proposal (RFP)
Solicitation Number 6483
Description Network Penetration Testing Services
Date of Issuance 3/20/2026
Inquiries Deadline Date & Time (local)
Due Date & Time (local)
Pre-Submission Conference Yes: Non-Mandatory Teleconference (attendance
recommended & pre-registration required)
Conference Date & Time (local) 4/30/2026
Buyer Name Pitchellis
INTRODUCTION
The Kent County Purchasing Division is soliciting proposals from qualified security vendors to provide
comprehensive penetration testing services across both its web applications and network infrastructure.
The purpose of this engagement is to simulate real-world attack scenarios, identify vulnerabilities and
misconfigurations, and provide actionable recommendations that will enhance Kent County's security
posture.
Vendors may submit proposals for Part 1 (Web Application Penetration Testing), Part 2 (Network
Penetration Testing), or both parts combined.
SCOPE
PART 1: Web Application Penetration Testing
* The following applications are in scope:
app.kentcountymi.gov
o
www.accesskent.com
o
Kentcountynewamericans.org
o
Kentcountyhealthconnect.org
o
apps.accesskent.com
o
grcourt.org
o
Testing requirements include:
* Black-Box Testing - Simulate external attackers without prior access.
* White-Box Testing - Authenticated testing with provided accounts (at minimum, standard user).
* Coverage of OWASP Top 10 vulnerabilities and related risks.
* Automated + Manual Testing - Automated scanning supported by manual exploitation to
confirm impact.
Page 1 of 6
1:00 PM
5/7/2026, 2 PM
5/12/2026, 2 PM
EST

* Business Logic Testing - Assess workflows, roles, and functionality for security flaws.
PART 2: Network Penetration Testing
* External Penetration Test
Assess publicly accessible systems, ports, and services. - Attempt to gain access to Kent
o
County's internal network.
* Internal Penetration Test
Simulate an attacker with insider or compromised access. - Test for lateral movement,
o
privilege escalation, and access to sensitive systems. - Evaluate patching, access control,
and segmentation practices.
* Wireless Penetration Test
Assess wireless infrastructure for encryption, authentication, and configuration
o
weaknesses. - Identify risks associated with connected employee or IoT devices.
Testing Approach
Vendors must describe their methodology in detail, including:
* Alignment with industry standards (PTES, NIST SP 800-115, OWASP).
* Use of Black-Box and White-Box testing strategies.
* Manual validation of vulnerabilities discovered by automated tools.
* Controlled exploitation to confirm real-world risk.
* Reporting of both technical and business risk.
Deliverables
Vendors must provide:
* Pre-Engagement Plan - Testing scope, timeline, and communication plan.
* Interim Status Updates - Regular updates during testing.
* Final Report including:
Executive Summary (non-technical, for leadership).
o
Technical Findings with severity ratings (Critical, High, Medium, Low, Informational).
o
Proof of exploitation (screenshots, logs, configs).
o
Actionable remediation guidance with prioritization.
o
* Presentation of Findings - Virtual or in-person debrief with Kent County stakeholders.
Key Focus Areas
For Web Applications:
* Input validation
* Access control enforcement
* Session management
* WordPress and CMS hardening
* Use of up-to-date libraries and plugins
For Network Infrastructure:
* Patch management
* Enforcement of least privilege access
* Network segmentation and configuration hardening
* Password policy enforcement
* Active Directory permissions audits
Page 2 of 6

* Purple Team collaboration opportunities
Vendor Qualifications
Proposals must include:
* Company overview and years of experience.
* Relevant staff certifications (e.g., OSCP, OSCE, GWAPT, GPEN, GXPN, CISSP).
* Experience with government or public-sector clients.
* Sample deliverables (redacted reports).
* At least two relevant client references.
Proposal Submission Requirements
Vendors must submit a proposal that includes:
* Technical approach and methodology for both Part 1 and Part 2.
* Project team qualifications and resumes.
Evaluation Criteria
Proposals will be evaluated based on:
* Testing methodology and approach
* Relevant experience and qualifications
* Quality of reporting and sample deliverables
* Cost effectiveness
* Client references and satisfaction
PART 3 (Optional): Social Media Penetration Testing - Please quote this section as a separate statement
of Work
The vendor shall assess the security posture of Kent County's official social media accounts and
associated processes. This testing is intended to identify risks related to account compromise,
impersonation, misinformation, and social engineering.
In-scope activities may include:
* Review of account security configurations (e.g., multi-factor authentication, recovery
mechanisms, role-based access, third-party integrations).
* Assessment of administrative access controls and privilege assignment.
* Testing for susceptibility to account takeover through password reset abuse, phishing, or
credential reuse (non-destructive and pre-approved techniques only).
* Evaluation of brand impersonation risks, including identification of fraudulent or look-alike
accounts.
* Review of posting, moderation, and incident response procedures related to compromised or
hijacked accounts.
* Assessment of employee awareness and exposure to social engineering tactics leveraging social
media platforms (where explicitly authorized).
Out-of-scope activities (unless explicitly approved):
* Posting live content to public accounts.
* Direct interaction with the public or followers.
* Any activity that could damage public trust, reputation, or violate platform terms of service.
Page 3 of 6

For Social Media:
* Account takeover prevention
* Role and access governance
* Phishing and impersonation risk
* Third-party application and API access
* Incident response readiness
* Experience conducting social media or human-centric security assessments.
Dimensions, if furnished, are for general reference only and should be verified by Respondent.
Kent County will award and contract for the goods and services in this Solicitation in an efficient and
timely manner. In no event will notification of award be more than 45 days from the date of submission.
The Kent County Standard Submission Terms posted on the Bid Opportunities page of the Kent County
Purchasing Division website are incorporated by reference and shall be deemed to have the same force
and effect as if fully set forth herein.
INQUIRIES
Any and all communication regarding this Solicitation shall be on the Kent County Purchasing Division
Inquiry Blog via the Bid Opportunities page or during pre-proposal meetings. Kent County reserves the
right to determine the response format or not respond, at its sole discretion.
CONTRACT
Respondent shall agree to the terms and execute project specific contract(s) in accordance with the
contract attached as Exhibit A. The County will consider contract term exceptions only if the
Respondent provides the exceptions in its submission. Contract exceptions may preclude Respondent
from further consideration if the County, at its sole discretion, deems the exception material and
unsurmountable.
PRE-SUBMISSION TELECONFERENCE
A pre-submission conference is scheduled for this Solicitation. Conference registration is located
here . Registration closes 12 hour before the conference scheduled date and time. Attendee
should join the conference a minimum of 5 minutes before the conference is scheduled to
commence. Late attendees may not be admitted.
The conference provides attendees equal opportunity to seek clarifications regarding this
Solicitation. Failure to attend the pre-submission conference may result in rejection of non-
attendee inquiries. Each Respondent will be given the opportunity to ask questions and is
responsible for taking meeting notes. One person from the Respondent should be designated to
ask questions when prompted by the meeting host for teleconference meetings. All additional
attendees should remain muted. Attendees must fully review all Solicitation documents and
correspondence prior to the conference. Attendee shall be an employee or authorized reseller of
the Respondent with requisite knowledge, skills, and abilities to participate.
Attendee assumes all risks, costs, and expenses, including technological difficulties, associated
with meeting attendance. Attendee may not screenshot or record any part of the meeting including
Page 4 of 6

the audio. An attendee requiring special services is asked to provide requirements to the Kent
County Purchasing Division at least 48 hours in advance to allow for accommodations.
REQUEST FOR PROPOSAL SUBMISSION
Complete submissions must be received in the Kent County Purchasing Division on or before the due
date/time specified by the designated clock (local time). Late, faxed, or emailed submissions will NOT
be considered.
Submissions may be submitted electronically on the Bid Opportunities page of the Kent County
Purchasing Division's website. Respondent must include a complete proposal as 1 non-password
protected PDF document.
The time required to upload a submission may vary. Respondent assumes all risks associated with
electronic submission, including technological difficulties, and deems the County and its service provider
harmless and without fault. Successful electronic submissions are confirmed via Respondent's email.
Respondent shall view the link in the confirmation email to determine accuracy prior to due date/time.
Submissions must be in the format outlined below:
Executive Summary - One (1) page maximum
Summarize the Respondent's strong points and how experience, particularly with similar
responsibilities, will benefit the stakeholders.
Business Organization - One (1) page maximum
State the full names, addresses, phone numbers, emails, and websites of any parties and their
prospective roles.
Recommendation - Ten (10) pages maximum
Provide a recommendation focusing on the technical specification. Emphasize clarity and detail.
Sales and Marketing material will not be used to determine the award.
Timeline & Expectations - Two (2) pages maximum
Provide a timeline to implement the recommendation efficiently and effectively with emphasis on
key deliverables and milestones. Disclose necessary County resources, staffing and/or other
requirements to implement each phase of the recommendation.
Pricing Methodology - Two (2) pages maximum
Provide a detailed pricing methodology for an all-inclusive, implemented recommendation including
payment terms, unit costs, billable costs, and all other expenses. Clearly separate Response for Part
1 (Web Application), Part 2 (Network), and optional Part 3 (Social Media).
Project Staffing - One (1) page maximum plus resumes
Provide a chart with the staff committed to the recommendation. Show lines of authority and
provide a brief role description with responsibilities as they relate to the recommendation. Include
only relevant resumes.
Page 5 of 6

References - One (1) page maximum
Provide 3 relevant references, preferably for projects of similar scope and complexity. Include the
organization, contact person, current telephone number, email address, description, and dates of
service and total cost. Do not include any current/past Kent County employees as a reference.
Contract - Unlimited
Provide any contract and/or applicable agreements Kent County may be asked to sign. Kent County
reserves the right to present its own contract.
Page number maximums are strongly recommended but not compulsorily disqualifying. Kent County is
not liable for costs incurred prior to award. A submission constitutes an irrevocable offer for a period of
45 days from the due date/time. In the event the notification of award is not made within 45 days from
the due date/time, the Respondent may withdraw or provide a written extension of their submission.
Submissions may only be withdrawn by written request if the request is received before the due
date/time. Withdrawals after opening shall be subject to Kent County Fiscal Policy - Centralized
Purchasing 5(i)(2).
NO BID
Please provide feedback if you are electing not to participate in this Solicitation.
Page 6 of 6