Adversarial Assessment

Rhode Island Student Loan Authority (RISLA) is seeking a qualified cybersecurity firm to conduct a full‑scale adversarial penetration assessment of its internal and external IT environment, including a targeted phishing campaign against 20 staff members. The effort must identify critical vulnerabilities, achieve domain‑admin level access, and expose risks to personally identifiable information, with detailed reporting and optional remediation support. • Scope covers ~75 internal IPs, 4 external IPs, 45 desktops, 12 virtual servers (including Azure resources), network printers, switches, a firewall, and 6 public‑facing websites. • Deliverables include an executive summary, technical risk matrix (CVSS‑based), and final audit report delivered via secure encrypted transfer; interim report triggers 50 % payment. • Vendor must have ≥3 years experience, lead auditor with OSCP/GPEN/GXPN, U.S.-based team, professional liability & cyber insurance, and must submit a detailed manual testing methodology (automated‑only approaches are disqualified). • Timeline: testing Oct‑Dec 2026, initial report within 5 business days post‑test, final report by Jan 1 2027. Pricing to be provided as fixed‑fee for Year 1 (2026) with optional three‑year extension.