2026 Penetration Testing RFP RIHousing

The Rhode Island Housing and Mortgage Finance Corporation (RIHousing) is seeking proposals from qualified vendors to perform penetration tests of its network, applications, and buildings over a two-year period. The selected vendor will be required to perform four separate tests at six-month intervals, including social engineering, web application testing, physical penetration testing, external network penetration testing, and wireless security testing. The vendor will be required to deliver a final report to RIHousing within five business days of completing the final pen testing, including vulnerabilities identified, recommended remediation, and temporary mitigations. • The scope of the test will include approximately 300 public IP addresses, five wildcard domains, five web applications, and one physical location. • The vendor will be required to receive approval from RIHousing before the testing window. • The vendor will be required to promptly notify Terry Lehane, Director of Information Technology, in the event of a compromised application or critical risk finding. • The vendor will participate in a review call with RIHousing's Information Security team to discuss discovered vulnerabilities.