Description
The Chicago Housing Authority (CHA) is seeking a qualified vendor to perform a comprehensive cybersecurity assessment and penetration‑testing engagement covering external, internal, cloud, wireless, and social‑engineering vectors. The contractor must deliver detailed technical findings, remediation recommendations, and a final report, with a retest of critical/high findings within 90 days. The work must commence promptly after award (starting 19 Oct 2026) and be completed, including reporting, by 4 Dec 2026, with the final report due 11 Dec 2026. The contract is a one‑year base period with two optional one‑year extensions. Key requirements include U.S.–based staff, relevant certifications (OSCP/OSCE/GPEN), at least three recent public‑sector penetration‑testing projects, and extensive insurance coverage.
• External & internal vulnerability scanning and manual penetration testing (including web‑app, API, domain controller, and workstation assessments).
• Cloud security review of Microsoft Entra ID and M365 services, wireless network testing, and a phishing/social‑engineering campaign targeting up to 1,500 employees.
• Deliverables: executive summary, detailed findings (CVSS, CVE, MITRE ATT&CK mapping), remediation roadmap, machine‑readable data, data‑handling statement, and a presentation/debrief.
• Mandatory post‑award paperwork (utilization plan, HUD certifications, insurance certificates) must be submitted within five business days of award.
Attached files
Contact
Frederica Juste