Cybersecurity Penetration & Vulnerability Testing Services

Description

PURCHASING DEPARTMENT Newport News Public Schools 757-591-4525/ FAX 757-591-4593 12465 WARWICK BOULEVARD • NEWPORT NEWS, VIRGINIA 23606-3041 April 28, 2026 Addendum #2 FOR IMMEDIATE ATTENTION ADDENDUM NO. 2 TO ALL OFFERORS: Reference – Request for Proposal: For Delivery To: Bid Submittals Due: RFP #019-0-2026/HM Cybersecurity Penetration & Vulnerability Testing Newport News Public Schools May 8, 2026 at 10:00 AM EDT (CHANGED) Responses to Offerors questions are as follows: 1. Network & Infrastructure Scope a) Are all approximately 40,000 devices and all 50+ facilities in scope for testing, or will a subset or sampling methodology be used? ANSWER: Ideally, we would like to review our entire network for potential vulnerabilities. We are open to narrowing down the scope to a smaller subset of devices and or/network segments. Please provide specific details on pricing/costs for both options. b) How many public-facing IP addresses, domains, and internet-accessible systems are in scope for external vulnerability assessment and penetration testing? ANSWER: Assessment scope includes a single /24 network (254 usable addresses) and 1 domain. c) How many internal IP addresses, subnets, or VLANs are in scope for internal vulnerability assessment and penetration testing? ANSWER: Assessment scope includes a /16 network of up to 65,534 usable addresses. d) Are there any systems, networks, or environments explicitly out of scope due to operational or life-safety considerations? ANSWER: All networks and systems are in scope for this engagement, with no exclusions. e) Are there legacy, IoT, OT, HVAC, or CCTV systems that require modified or limited testing approaches? ANSWER: Legacy, IoT, OT, HVAC, and CCTV systems are in scope. Testing will be conducted using non-disruptive methods. Any active or potentially disruptive testing will be scheduled during approved maintenance windows and require explicit approval prior to execution. 2. Wireless Environment a) Section III.B.3.c references four wireless networks. Are these four distinct SSIDs, and are they located at a single facility or distributed across multiple locations? ANSWER: The correct SSID count is 6, distributed across all physical sites. b) How many facilities are expected to be included in wireless penetration testing? ANSWER: There are 4 locations within the City of Newport News, Virginia. Locations will include schools and administrative sites (approximately 50 sites total).