Town-Wide Penetration Testing

The Town of Nantucket is seeking a qualified responder to conduct town-wide penetration testing, including internal and external penetration tests, vulnerability scanning, and network analysis. The selected consultant will provide a comprehensive report of findings, including severity ratings and prioritized recommendations for remediation. The project is expected to last for 5 months, from February 1, 2026, to June 30, 2026. • The scope of work includes external penetration testing, internal penetration testing, and reporting and findings. • The consultant must have proven experience with municipal, government, or similar organizations, and relevant certifications such as OSCP, CEH, GPEN, or CISSP. • The consultant must provide a detailed report of findings, including severity ratings and prioritized recommendations for remediation. • The consultant must have adequate cyber liability insurance and proof of coverage. • The consultant must be willing to enter into the Town's standard form of contract.