EfficiencyOne is issuing this RFP to identify qualified and independent firms having the necessary qualifications and experience to provide Vulnerability Assessment and Penetration Testing (VAPT) Services for EfficiencyOne.

EfficiencyOne anticipates it may establish agreements with up to two separate Service Providers to conduct two VAPT assessment cycles each year. It is anticipated that one Service Provider will conduct the Winter Project Cycle, generally between January 15 and March 31, and the other Service Provider will conduct the Summer Project Cycle, generally between August 15 and October 5. Project Cycle assignments may be rotated in a renewal year to provide methodological diversity and a fresh perspective.

Each VAPT assessment cycle is expected to include the following, as further detailed in the RFP and associated Contract Package:

• Internal network vulnerability assessment and penetration testing;
• External network vulnerability assessment and penetration testing;
• Wireless network risk assessment;
• Remote-work and endpoint security assessment;
• Web security assessment;
• Authorized social-engineering testing;
• Technical and executive-level reporting;
• Remediation testing and validation; and
• Related cybersecurity advisory and knowledge-transfer support.

A Bidder Information Session will be held on Thursday, October 8, 2026 (11:00 am– 12:00 pm Atlantic Time)

Join Microsoft Teams Meeting: (https://teams.microsoft.com/meet/283537884638372?p=eT1A5A6TKAYYoq57uC)

• Meeting ID: 283 537 884 638 372

• Passcode: sD7nn64Y

Or call in (audio only)

• Phone Number: +1 437-703-4488

• Phone Conference ID: 432 292 040#