# USAC RFP: Penetration Testing as a Service - Requirements Matrix

- Company: Find Evil LLC
- SAM URL: https://sam.gov/opp/b13eeb1c32b14563bee9f39cadf3a7fb

This solicitation includes 34 required obligations and 5 attachment-derived requirements.

## Matrix Summary
- Requirements: 51
- Sections: 8
- Evidence confidence: High confidence
- Mandatory: 34
- Hidden: 5

## What to Verify Before Drafting Starts
- Due date: Submit the proposal by March 30, 2026.
- Submission method: Proposals must be submitted via email to Procurement@usac.org with a copy to Mustafa.Kamal@usac.org no later than Monday, March 30, 2026, 11:00 AM ET. The subject line must only be 'RFP IT-26-027'.
- Pricing sheet: Price the bid sheet by daily rate for the base year and all four option years.
- Legal certification: The Offeror's submission must include a statement certifying that the USAC Standard Terms and Conditions set forth in the RFP have been reviewed by the Offeror's office of general counsel (or equivalent legal representative).

## Requirements by Section

### Security / Privacy
- Requirement: Contractor must comply with Data Security Laws (FISMA, NIST SP 800-53 Rev 5). Any Cloud Service Offering used must be FedRAMP Authorized at a moderate risk level.
  - Obligation: Required
  - What to prepare: Technical Approach / Security Compliance
  - Row confidence: High confidence
  - Citation: PRIVACY AND SECURITY ADDENDUM, 2. SECURITY PROVISIONS · p.40
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: PRIVACY AND SECURITY ADDENDUM, 2. SECURITY PROVISIONS
  - Page: 40
  - Relevant passage: 2.1. Data Security Laws Compliance. Contractor shall comply with the Data Security Laws. For any Contractor IT using a Cloud Service Offering that accesses, stores, or otherwise processes USAC Data, and/or PII, Contractor shall provide documentation and proof of FedRAMP Authorization for use at a moderate risk before any such cloud-based Service may be used.
  - Evidence confidence: High confidence
- Requirement: Contractor must notify USAC at incident@USAC.org and Privacy@USAC.org within one (1) hour of becoming aware of an actual or suspected Cybersecurity Incident or Privacy Incident.
  - Obligation: Required
  - Row confidence: High confidence
  - Citation: PRIVACY AND SECURITY ADDENDUM, 2.14. Cybersecurity Incidents and Privacy Incidents · p.43
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: PRIVACY AND SECURITY ADDENDUM, 2.14. Cybersecurity Incidents and Privacy Incidents
  - Page: 43
  - Relevant passage: Any Event identified as a Cybersecurity Incident or Privacy Incident requires that USAC be notified at incident@USAC.org and Privacy@USAC.org within one (1) hour of becoming aware of an actual or suspected Cybersecurity Incident or Privacy Incident.
  - Evidence confidence: High confidence
- Requirement: Vendor must submit its insider threat program to USAC's Chief Privacy Officer and Chief Information Security Officer within 90 days of the Effective Date of the Contract.
  - Obligation: Required
  - Row confidence: High confidence
  - Citation: PRIVACY AND SECURITY ADDENDUM, 2. SECURITY PROVISIONS · p.41
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: PRIVACY AND SECURITY ADDENDUM, 2. SECURITY PROVISIONS
  - Page: 41
  - Relevant passage: Vendor must submit its insider threat program to USAC's Chief Privacy Officer and Chief Information Security Officer within 90 days of the Effective Date of the Contract.
  - Evidence confidence: High confidence
- Requirement: Contractor shall not use, implement, build, or deploy AI tools, services, or code of any type without prior written approval from USAC. Approved AI must include human oversight and cannot be used for autonomous decisions in sensitive areas.
  - Obligation: If Applicable
  - Applicability / trigger: If AI tools are proposed or used
  - Row confidence: High confidence
  - Citation: PRIVACY AND SECURITY ADDENDUM, 3. TECHNOLOGY CONSIDERATIONS · p.47
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: PRIVACY AND SECURITY ADDENDUM, 3. TECHNOLOGY CONSIDERATIONS
  - Page: 47
  - Relevant passage: Contractor shall not use, implement, build, or deploy AI tools, services, or code of any type without prior written approval from USAC. Approved AI must include human oversight and cannot be used for autonomous decisions in sensitive areas.
  - Evidence confidence: High confidence
- Requirement: Contractor must maintain ISO 27001 compliance certification and SOC 2 Type II reports for all Contractor IT used in performance of the Services, and provide them to USAC within 10 calendar days of the Effective Date.
  - Obligation: Required
  - Row confidence: High confidence
  - Citation: PRIVACY AND SECURITY ADDENDUM, 2.20. Additional Requirements for Services in Contractor IT · p.45
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: PRIVACY AND SECURITY ADDENDUM, 2.20. Additional Requirements for Services in Contractor IT
  - Page: 45
  - Relevant passage: Contractor shall maintain ISO 27001 compliance certification and notify USAC of any changes to its compliance. Contractor shall provide USAC with its ISO 27001 compliance certification within ten (10) calendar days of the Effective Date. • Contractor shall maintain administrative, technical, physical, and procedural information security controls as demonstrated in Service Organization Controls (“SOC”) 2 Type II reports
  - Evidence confidence: High confidence
- Requirement: Email draft details and reproduction steps for critical or high findings to the USAC product manager within one (1) business day.
  - Obligation: Required
  - What to prepare: Critical/high finding alert
  - Row confidence: High confidence
  - Citation: 1. One time (within five · p.10
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: 1. One time (within five
  - Page: 10
  - Relevant passage: Finding and cover each Significant Alert of Finding reported during the test. 5. Email Alert within one (1) business day of Critical or High finding to USAC project manager.
  - Evidence confidence: High confidence
- Requirement: For contracts involving new IT systems or tools, provide a monthly vulnerability report and a risk mitigation plan addressing identified vulnerabilities.
  - Obligation: If Applicable
  - Applicability / trigger: Applies only if the contract includes new IT systems/tools.
  - What to prepare: Monthly vulnerability report and risk mitigation plan
  - Row confidence: High confidence
  - Citation: 18. Notification and Assistance . Contractor will cooperate with USAC in any litigation and · p.45
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: 18. Notification and Assistance . Contractor will cooperate with USAC in any litigation and
  - Page: 45
  - Relevant passage: Vulnerabilities in the applicable timeframes set forth in such policies. Contractor shall provide a monthly vulnerability report and a risk mitigation plan to address any identified vulnerabilities.
  - Evidence confidence: High confidence
- Requirement: For contracts involving new IT systems or tools, provide a POA&M to address vulnerabilities promptly and prioritize remediation based on severity and risk.
  - Obligation: If Applicable
  - Applicability / trigger: Applies only if the contract includes new IT systems/tools.
  - What to prepare: POA&M
  - Row confidence: High confidence
  - Citation: 18. Notification and Assistance . Contractor will cooperate with USAC in any litigation and · p.45
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: 18. Notification and Assistance . Contractor will cooperate with USAC in any litigation and
  - Page: 45
  - Relevant passage: Officer, and Contractor shall remedy such vulnerabilities as soon as possible. Contractor shall provide USAC a POA&M to address such vulnerabilities promptly and shall prioritize remediation based on the risks implicated by such vulnerabilities. 2.20.
  - Evidence confidence: High confidence
- Requirement: For contracts involving new IT systems or tools, report critical and high vulnerabilities promptly to USAC’s Chief Information Officer and Chief Information Security Officer and begin remediation immediately.
  - Obligation: If Applicable
  - Applicability / trigger: Applies only if the contract includes new IT systems/tools.
  - What to prepare: Critical/high vulnerability notification workflow
  - Row confidence: High confidence
  - Citation: 18. Notification and Assistance . Contractor will cooperate with USAC in any litigation and · p.45
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: 18. Notification and Assistance . Contractor will cooperate with USAC in any litigation and
  - Page: 45
  - Relevant passage: For contracts involving new IT systems or tools, report critical and high vulnerabilities promptly to USAC’s Chief Information Officer and Chief Information Security Officer and begin remediation immediately.
  - Evidence confidence: High confidence
- Requirement: For contracts involving new IT systems or tools, respond to USAC information-security questionnaires and related security documentation requests within ten (10) business days or in the timeframe requested by USAC.
  - Obligation: If Applicable
  - Applicability / trigger: Applies only if the contract includes new IT systems/tools.
  - What to prepare: Security questionnaires / certifications / training
  - Row confidence: High confidence
  - Citation: 2. SECURITY PROVISIONS · p.40
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: 2. SECURITY PROVISIONS
  - Page: 40
  - Relevant passage: Necessary for the parties to perform their obligations under the Data Security Laws; (iii) complete any security questionnaires, IT rules of behavior, certifications, assessments, or workforce training reasonably requested by USAC in a timely manner; and (iv) receive prior written authorization from USAC to access USAC IT Systems from
  - Evidence confidence: High confidence
- Requirement: For contracts involving new IT systems or tools, ensure cloud or COTS offerings can use USAC’s OKTA instance for user authentication and provisioning.
  - Obligation: If Applicable
  - Applicability / trigger: Applies only if the contract includes new IT systems/tools.
  - What to prepare: OKTA-compatible cloud deployment
  - Row confidence: High confidence
  - Citation: 3. TECHNOLOGY CONSIDERATIONS · p.46
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: 3. TECHNOLOGY CONSIDERATIONS
  - Page: 46
  - Relevant passage: The following requirements: 3.1.1. The Software must be able to utilize USAC’s instance of OKTA’s identity and access management software for user authentication and provisioning. OKTA is a FedRAMP Authorized CSP identity and access management product used by USAC. 3.1.2.
  - Evidence confidence: High confidence

### Submission
- Requirement: Proposals must be submitted via email to Procurement@usac.org with a copy to Mustafa.Kamal@usac.org no later than Monday, March 30, 2026, 11:00 AM ET. The subject line must only be 'RFP IT-26-027'.
  - Obligation: Required
  - What to prepare: Email Submission
  - Row confidence: High confidence
  - Citation: SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 1. GENERAL, B. PERIOD FOR ACCEPTANCE OF OFFERS · p.51
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 1. GENERAL, B. PERIOD FOR ACCEPTANCE OF OFFERS
  - Page: 51
  - Relevant passage: Be submitted to USAC Procurement Department, no later than Monday, March 30, 2026, 11:00 AM ET (“Proposal Due Date”). • Be submitted in the form of one electronic copy submitted to Procurement@usac.org with copy to Mustafa.Kamal@usac.org. The subject line for all email communication related to this solicitation must only be RFP IT-26-027.
  - Evidence confidence: High confidence
- Requirement: Proposals must be presented in four separate volumes (Corporate Information, Technical Capability, Past Performance, Price). Each volume must be submitted in PDF format as a separate attachment to a single email. Times New Roman 12-point font is required (minimum 9-point for diagrams/tables).
  - Obligation: Required
  - What to prepare: Four PDF Volumes
  - Row confidence: High confidence
  - Citation: SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 4. PROPOSAL FORMAT & E. Presentation and Page Limitations · p.52
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 4. PROPOSAL FORMAT & E. Presentation and Page Limitations
  - Page: 52
  - Relevant passage: Proposals shall be presented in four separate volumes: 1. Volume 1 – Corporate Information 2. Volume 2 – Technical Capability 3. Volume 3 – Past Performance 4. Volume 4 – Price Each volume of the proposal should be submitted in PDF format as a separate attachment to a single email Proposals must be prepared using Times New Roman font.
  - Evidence confidence: High confidence
- Requirement: Each volume must contain a cover page including: Org name, contact name, contact info, Unique Entity ID, date of submittal, a statement verifying the proposal is valid for 120 days, and the signature of a duly authorized representative.
  - Obligation: Required
  - What to prepare: Cover Pages
  - Row confidence: High confidence
  - Citation: SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 5. PROPOSAL COVER PAGE · p.53
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 5. PROPOSAL COVER PAGE
  - Page: 53
  - Relevant passage: Each volume must contain a cover page including: Org name, contact name, contact info, Unique Entity ID, date of submittal, a statement verifying the proposal is valid for 120 days, and the signature of a duly authorized representative.
  - Evidence confidence: High confidence
- Requirement: Volume 1 must not exceed 4 pages and must include the Cover Page, Executive Summary (no pricing info), Confidentiality and Information Security statement, and Conflict of Interest statement.
  - Obligation: Required
  - What to prepare: Volume 1
  - Row confidence: High confidence
  - Citation: SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 6. PROPOSAL CONTENT & E. Presentation and Page Limitations · p.53
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 6. PROPOSAL CONTENT & E. Presentation and Page Limitations
  - Page: 53
  - Relevant passage: Volume 1 must not exceed 4 pages and must include the Cover Page, Executive Summary (no pricing info), Confidentiality and Information Security statement, and Conflict of Interest statement.
  - Evidence confidence: High confidence
- Requirement: Volume 2 must not exceed 12 pages (excluding Attachment A - Resumes). It must include the Cover Page, Technical Approach, Capabilities, and Key Personnel details.
  - Obligation: Required
  - What to prepare: Volume 2
  - Row confidence: High confidence
  - Citation: SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 6. PROPOSAL CONTENT & E. Presentation and Page Limitations · p.54
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 6. PROPOSAL CONTENT & E. Presentation and Page Limitations
  - Page: 54
  - Relevant passage: Volume 2 must not exceed 12 pages (excluding Attachment A - Resumes). It must include the Cover Page, Technical Approach, Capabilities, and Key Personnel details.
  - Evidence confidence: High confidence
- Requirement: Volume 3 must not exceed 5 pages. It must include a Cover Page, description of recent experience, and a list of 2 to 3 current or recently completed contracts (no older than 3 years) for similar services. Each project overview shall not exceed 1 page.
  - Obligation: Required
  - What to prepare: Volume 3
  - Row confidence: High confidence
  - Citation: SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 6. PROPOSAL CONTENT & E. Presentation and Page Limitations · p.55
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 6. PROPOSAL CONTENT & E. Presentation and Page Limitations
  - Page: 55
  - Relevant passage: Volume 3 must not exceed 5 pages. It must include a Cover Page, description of recent experience, and a list of 2 to 3 current or recently completed contracts (no older than 3 years) for similar services. Each project overview shall not exceed 1 page.
  - Evidence confidence: High confidence
- Requirement: Volume 4 must not exceed 4 pages. It must include a Cover Page and completed pricing information in Attachment 1 – Bid Sheet. The proposed price must be fully loaded.
  - Obligation: Required
  - What to prepare: Volume 4
  - Row confidence: High confidence
  - Citation: SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 6. PROPOSAL CONTENT & E. Presentation and Page Limitations · p.56
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 6. PROPOSAL CONTENT & E. Presentation and Page Limitations
  - Page: 56
  - Relevant passage: Volume 4 must not exceed 4 pages. It must include a Cover Page and completed pricing information in Attachment 1 – Bid Sheet. The proposed price must be fully loaded.
  - Evidence confidence: High confidence
- Requirement: The Offeror's submission must include a statement certifying that the USAC Standard Terms and Conditions set forth in the RFP have been reviewed by the Offeror's office of general counsel (or equivalent legal representative).
  - Obligation: Required
  - What to prepare: Certification Statement
  - Row confidence: High confidence
  - Citation: SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 1. GENERAL, A. CONTRACT TERMS AND CONDITIONS · p.51
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 1. GENERAL, A. CONTRACT TERMS AND CONDITIONS
  - Page: 51
  - Relevant passage: Offeror’s submission must include a statement certifying that the USAC Standard Terms and Conditions set forth in this RFP have been reviewed by Offeror’s office of general counsel (or equivalent legal representative).
  - Evidence confidence: High confidence
- Requirement: Any deviations from, or exceptions to, the requirements in the RFP must be clearly identified in a separate Attachment to the proposal titled 'Exceptions to RFP Terms'.
  - Obligation: If Applicable
  - Applicability / trigger: If Offeror has exceptions to RFP terms
  - What to prepare: Exceptions to RFP Terms Attachment
  - Row confidence: High confidence
  - Citation: SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 1. GENERAL, A. CONTRACT TERMS AND CONDITIONS · p.51
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 1. GENERAL, A. CONTRACT TERMS AND CONDITIONS
  - Page: 51
  - Relevant passage: Offeror’s proposal may identify deviations from, or revisions, exceptions or additional terms (collectively “exceptions”) to the RFP, but only if such exceptions are clearly identified in a separate Attachment to the proposal, “Exceptions to RFP Terms.”
  - Evidence confidence: High confidence
- Requirement: The RFP is subject to the terms of the Confidentiality Agreement (Attachment 2) which must be executed by the Offeror and submitted along with any proposal. It may be submitted in PDF format as a separate attachment and does not count towards page limits.
  - Obligation: Required
  - What to prepare: Executed Confidentiality Agreement
  - Row confidence: High confidence
  - Citation: SECTION A: About Us, 3. CONFIDENTIALITY · p.4
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: SECTION A: About Us, 3. CONFIDENTIALITY
  - Page: 4
  - Relevant passage: The RFP is subject to the terms of the Confidentiality Agreement (Attachment 2) which must be executed by the Offeror and submitted along with any proposal. It may be submitted in PDF format as a separate attachment and does not count towards page limits.
  - Evidence confidence: High confidence

### Deliverables
- Requirement: Contractor must perform penetration testing on 16 to 20 USAC mission systems at least annually in pre-production environments. Testing includes Ethical Hacking, Web Application, and Application Code testing.
  - Obligation: Required
  - What to prepare: Technical Approach
  - Row confidence: High confidence
  - Citation: SECTION B: STATEMENT OF WORK, 5. SCOPE OF WORK AND DELIVERABLES · p.7
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: SECTION B: STATEMENT OF WORK, 5. SCOPE OF WORK AND DELIVERABLES
  - Page: 7
  - Relevant passage: Contractor must perform penetration testing on 16 to 20 USAC mission systems at least annually in pre-production environments. Testing includes Ethical Hacking, Web Application, and Application Code testing.
  - Evidence confidence: High confidence
- Requirement: Contractor shall offer optional services to conduct three corporate-level social engineering campaigns annually, including Phishing, Vishing, Smishing, and AI emulation.
  - Obligation: If Applicable
  - Applicability / trigger: If optional services are exercised
  - What to prepare: Technical Approach
  - Row confidence: High confidence
  - Citation: SECTION B: STATEMENT OF WORK, 5. SCOPE OF WORK AND DELIVERABLES · p.9
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: SECTION B: STATEMENT OF WORK, 5. SCOPE OF WORK AND DELIVERABLES
  - Page: 9
  - Relevant passage: Contractor shall offer optional services to conduct three corporate-level social engineering campaigns annually, including Phishing, Vishing, Smishing, and AI emulation.
  - Evidence confidence: High confidence
- Requirement: Contractor shall offer optional physical testing for Wi-Fi networks and physical access at USAC's HQ location annually.
  - Obligation: If Applicable
  - Applicability / trigger: If optional services are exercised
  - What to prepare: Technical Approach
  - Row confidence: High confidence
  - Citation: SECTION B: STATEMENT OF WORK, 5. SCOPE OF WORK AND DELIVERABLES · p.9
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: SECTION B: STATEMENT OF WORK, 5. SCOPE OF WORK AND DELIVERABLES
  - Page: 9
  - Relevant passage: C. Physical Environment Testing (Optional) i. Wi-Fi testing of USAC’s Corporate (secure) and Guest (insecure) Wi-Fi networks at USAC’s HQ ii.
  - Evidence confidence: High confidence
- Requirement: Contractor must provide specific deliverables according to the schedule in Section B.5.C, including Kickoff Meeting, Onboarding Plan, Core System Pen Test Plans/Reports, Significant Alerts of Findings, Weekly/Monthly Status Reports, and a Transition Out Plan.
  - Obligation: Required
  - Row confidence: High confidence
  - Citation: SECTION B: STATEMENT OF WORK, 5. SCOPE OF WORK AND DELIVERABLES, C. Deliverables · p.9
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: SECTION B: STATEMENT OF WORK, 5. SCOPE OF WORK AND DELIVERABLES, C. Deliverables
  - Page: 9
  - Relevant passage: Contractor must provide specific deliverables according to the schedule in Section B.5.C, including Kickoff Meeting, Onboarding Plan, Core System Pen Test Plans/Reports, Significant Alerts of Findings, Weekly/Monthly Status Reports, and a Transition Out Plan.
  - Evidence confidence: High confidence
- Requirement: Hold the contract kickoff meeting within five (5) business days of contract award.
  - Obligation: Required
  - What to prepare: Kickoff meeting and technical planning
  - Row confidence: High confidence
  - Citation: 1. One time (within five · p.10
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: 1. One time (within five
  - Page: 10
  - Relevant passage: IT-26-027 | Request for Proposals (RFP) Page 10 of 11 Available for Public Use 1. One time (within five (5) business days of Contract award) Kickoff Meeting Official kick-off of Contract to introduce teams, Contractor approach, and coordinate technical planning for test execution. 2.
  - Evidence confidence: High confidence
- Requirement: For each system tested, submit a draft penetration test plan ten (10) business days before test kickoff and a final plan five (5) business days before test kickoff.
  - Obligation: Required
  - What to prepare: Draft and final penetration test plan for each system
  - Row confidence: High confidence
  - Citation: 1. One time (within five · p.10
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: 1. One time (within five
  - Page: 10
  - Relevant passage: Contractor personnel, test accounts, tools, and coordination of support by USAC teams. 3. One draft Plan (ten (10) business days before test kickoff) and one final Plan (five (5) business days before test kickoff) for each system tested for up to twenty (20) systems.
  - Evidence confidence: High confidence
- Requirement: For each system tested, provide a draft report at the conclusion of the test and a final report within ten (10) business days after the test concludes.
  - Obligation: Required
  - What to prepare: Draft and final penetration test report for each system
  - Row confidence: High confidence
  - Citation: 1. One time (within five · p.10
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: 1. One time (within five
  - Page: 10
  - Relevant passage: Responsible for coordination for access and readiness to commence testing on schedule. 4. One draft Report at conclusion of each test and one final Report (ten (10) business days after conclusion of test) ) for each system tested for up to twenty (20) systems.
  - Evidence confidence: High confidence
- Requirement: If optional social engineering tests are performed, publish the annual social engineering assessment report with outcomes, key risks, and next-year recommendations.
  - Obligation: If Applicable
  - What to prepare: Social engineering assessment report
  - Row confidence: High confidence
  - Citation: Deliverables · p.9
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: Deliverables
  - Page: 9
  - Relevant passage: Urrent fraud scenarios and security threats known or prescient. iv. Contractor will publish a Social Engineering Assessment Report annually after all tests are completed with recommendations for Social Engineering testing in the coming year along with outcomes and key risks identified by the tests. c.
  - Evidence confidence: High confidence
- Requirement: If optional physical environment testing is performed, publish a report with findings and recommendations for improvement.
  - Obligation: If Applicable
  - What to prepare: Physical environment penetration test report
  - Row confidence: High confidence
  - Citation: 9. Once annually, fifteen · p.11
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: 9. Once annually, fifteen
  - Page: 11
  - Relevant passage: Testing for USAC’s HQ location. 10. Once annually, fifteen (15) days after the test (OPTIONAL) Physical Environment Penetration Test Report Contractor will publish outcome of the Physical Environment Penetration Test in a report with recommendations for improvement. 11.
  - Evidence confidence: High confidence

### Pricing
- Requirement: Pricing must be submitted using Attachment 1 - Bid Sheet. The proposed price must be a fully loaded firm fixed price including wages, overhead, G&A, taxes, and profit. Travel expenses are not reimbursable.
  - Obligation: Required
  - What to prepare: Attachment 1 - Bid Sheet
  - Row confidence: High confidence
  - Citation: SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 6. PROPOSAL CONTENT, D. Price Proposal (Volume 4) · p.56
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 6. PROPOSAL CONTENT, D. Price Proposal (Volume 4)
  - Page: 56
  - Relevant passage: Pricing must be submitted using Attachment 1 - Bid Sheet. The proposed price must be a fully loaded firm fixed price including wages, overhead, G&A, taxes, and profit. Travel expenses are not reimbursable.
  - Evidence confidence: High confidence
- Requirement: Price the bid sheet by daily rate for the base year and all four option years.
  - Obligation: Required
  - What to prepare: Attachment 1 – Bid Sheet
  - Row confidence: High confidence
  - Citation: Attachment 1 - Bid Sheet | | | | | | | |
  - Source document: RFP-IT-26-027-Attachment-1-Bid-Sheet.xlsx
  - Section: Attachment 1 - Bid Sheet | | | | | | | |
  - Relevant passage: Price the bid sheet by daily rate for the base year and all four option years.
  - Evidence confidence: High confidence
- Requirement: Provide pricing for small, medium, and large system-test sizes in Attachment 1 – Bid Sheet.
  - Obligation: Required
  - What to prepare: Attachment 1 – Bid Sheet
  - Row confidence: High confidence
  - Citation: Attachment 1 - Bid Sheet | | | | | | | |
  - Source document: RFP-IT-26-027-Attachment-1-Bid-Sheet.xlsx
  - Section: Attachment 1 - Bid Sheet | | | | | | | |
  - Relevant passage: | | | | | Base Year | Option Year 1 | Option Year 2 | Option Year 3 | Option Year 4 | 1 | Small (Low) | 5 | | | | | | 2 | Medium (Moderate) | 7 | | | | | | 3 | Large (High) | 4 | | | | | | Core System Tests Sub-Total | | | | | | | | Social Engineering Testing (Optional) | | | | | | | | Physical Environment Testing (Optional) | | | | | |
  - Evidence confidence: High confidence
- Requirement: Include optional pricing line items for social engineering testing and physical environment testing in Attachment 1 – Bid Sheet.
  - Obligation: If Applicable
  - What to prepare: Optional pricing line items
  - Row confidence: High confidence
  - Citation: Attachment 1 - Bid Sheet | | | | | | | |
  - Source document: RFP-IT-26-027-Attachment-1-Bid-Sheet.xlsx
  - Section: Attachment 1 - Bid Sheet | | | | | | | |
  - Relevant passage: 7 | | | | | | 3 | Large (High) | 4 | | | | | | Core System Tests Sub-Total | | | | | | | | Social Engineering Testing (Optional) | | | | | | | | Physical Environment Testing (Optional) | | | | | | | | Optional Tests Sub-Total | | | | | | | | Grand Total | | | | | | | | Other (describe) | | | | | | | | Total NTE Price | | | | | | | |
  - Evidence confidence: High confidence
- Requirement: Complete Attachment 1 – Bid Sheet with company name, authorized representative, signature, title, and date.
  - Obligation: Required
  - What to prepare: Signed Attachment 1 – Bid Sheet
  - Row confidence: High confidence
  - Citation: Attachment 1 - Bid Sheet | | | | | | | |
  - Source document: RFP-IT-26-027-Attachment-1-Bid-Sheet.xlsx
  - Section: Attachment 1 - Bid Sheet | | | | | | | |
  - Relevant passage: | | | | | Company Name: ________________________________________________ | | | | | | | | Authorized Representative: _______________________________________ | | | | | | | | Signature:______________________________________________________ | | | | | | | | Print Name:____________________________________________________ | | | | | | | |
  - Evidence confidence: High confidence
- Requirement: USAC encourages offerors to propose alternative pricing they normally provide for Penetration Testing as a Service.
  - Obligation: If Applicable
  - What to prepare: Alternative PTaaS pricing
  - Row confidence: High confidence
  - Citation: 1. A cover page, as outlined above. · p.56
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: 1. A cover page, as outlined above.
  - Page: 56
  - Relevant passage: In Attachment 1 – Bid Sheet. As noted on the bid sheet, USAC requests offerors to propose alternative pricing that they normally provide relative to their approach for providing Penetration Testing as a Service.
  - Evidence confidence: High confidence

### Evaluation
- Requirement: USAC will evaluate offers based on Technical, Past Performance, and Price factors.
  - Obligation: Reference
  - What to prepare: Proposal response aligned to stated evaluation factors
  - Row confidence: High confidence
  - Citation: 3. Price Evaluation: · p.58
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: 3. Price Evaluation:
  - Page: 58
  - Relevant passage: Proposals (RFP) Page 58 of 59 Available for Public Use Experience and past performance information will be evaluated to assess the risks associated with Offeror’s performance of this effort, considering the relevance, how recent the project is (no older than three (3) years from the date of the solicitation), and quality of Offeror’s
  - Evidence confidence: High confidence
- Requirement: USAC will evaluate whether proposed pricing is realistic and reasonable, and unrealistic or unreasonable pricing will not be considered for award.
  - Obligation: Reference
  - What to prepare: Realistic and reasonable pricing
  - Row confidence: High confidence
  - Citation: 3. Price Evaluation: · p.58
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: 3. Price Evaluation:
  - Page: 58
  - Relevant passage: Total prices of Offerors when making the award, USAC will also evaluate whether the proposed prices are realistic (i.e., reasonably sufficient to perform the requirements) and reasonable. Proposals containing prices that are determined to be unrealistic or unreasonable will not be considered for award. 8.
  - Evidence confidence: High confidence
- Requirement: USAC intends to make award on a best-value basis considering Technical, Past Performance, and Price.
  - Obligation: Reference
  - What to prepare: Proposal aligned to best-value evaluation basis
  - Row confidence: High confidence
  - Citation: 2. Page Limitation · p.57
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: 2. Page Limitation
  - Page: 57
  - Relevant passage: Solicitation to the responsible Offeror whose offer conforming to the solicitation will be most advantageous to USAC, price and other factors considered. The following factors shall be used to evaluate offers and select the awardee – Technical, Past Performance, and Price. 7.1.
  - Evidence confidence: High confidence
- Requirement: Address the Technical subfactors of Technical Approach, Capabilities, and Key Personnel in the technical proposal.
  - Obligation: Reference
  - What to prepare: Technical volume aligned to subfactors
  - Row confidence: High confidence
  - Citation: 2. Page Limitation · p.57
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: 2. Page Limitation
  - Page: 57
  - Relevant passage: 1. Technical: The technical sub-factors listed below in descending order of importance: a. Technical Approach b. Capabilities c. Key Personnel 7.2. Experience and Past Performance: [[PAGE 58]] Universal Service Administrative Co.
  - Evidence confidence: High confidence
- Requirement: Do not exceed the volume page limits; proposals exceeding the page count may be considered technically unacceptable and may receive no further consideration.
  - Obligation: Required
  - What to prepare: Compliant page-limited proposal
  - Row confidence: High confidence
  - Citation: 2. Page Limitation · p.57
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: 2. Page Limitation
  - Page: 57
  - Relevant passage: Five (5) pages. d. Volume 4 – Price; may not exceed four (4) pages. Any proposals received exceeding the page count will be considered technically unacceptable and may not receive further consideration. 7.
  - Evidence confidence: High confidence

### Key Personnel / Staffing
- Requirement: The Contractor's team must be staffed with a Contract Engagement Manager. The Offeror shall propose additional Key Personnel such as engineers, consultants, and/or IT lead. Resumes for all Key Personnel must be submitted as Attachment A, no longer than 2 pages per resume.
  - Obligation: Required
  - What to prepare: Resumes (Attachment A)
  - Row confidence: High confidence
  - Citation: SECTION B: STATEMENT OF WORK, 6. KEY PERSONNEL & SECTION E: 6. PROPOSAL CONTENT · p.12
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: SECTION B: STATEMENT OF WORK, 6. KEY PERSONNEL & SECTION E: 6. PROPOSAL CONTENT
  - Page: 12
  - Relevant passage: The Contractor's team must be staffed with a Contract Engagement Manager. The Offeror shall propose additional Key Personnel such as engineers, consultants, and/or IT lead. Resumes for all Key Personnel must be submitted as Attachment A, no longer than 2 pages per resume.
  - Evidence confidence: High confidence
- Requirement: Contractor Staff are required to be in the USAC office at least 2 days per week. Contractors required to report in person must reserve workspaces in advance using USAC's hoteling system.
  - Obligation: Required
  - Row confidence: High confidence
  - Citation: SECTION B: STATEMENT OF WORK, 4. PLACE OF PERFORMANCE · p.5
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: SECTION B: STATEMENT OF WORK, 4. PLACE OF PERFORMANCE
  - Page: 5
  - Relevant passage: Presently, USAC has a hybrid work approach requiring Contractor Staff (as defined in Section C.1.G) to be in the USAC office at least 2 days per week. Contractors that are required to report in person must reserve their workspaces in designated areas in advance using USAC’s hoteling system.
  - Evidence confidence: High confidence
- Requirement: Conduct background checks on contractor staff and provide evidence of those checks to USAC upon request.
  - Obligation: Required
  - What to prepare: Background-check evidence
  - Row confidence: High confidence
  - Citation: Key Personnel / Staffing · p.25
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: Key Personnel / Staffing
  - Page: 25
  - Relevant passage: Negligent, or that constitute a breach of the Visitor Form and/or the Contract. Contractor shall conduct background checks on Contractor Staff and provide evidence of the background checks to USAC upon request. 20. KEY PERSONNEL USAC may specify which Contractor employees are Key Personnel under the Contract.
  - Evidence confidence: High confidence
- Requirement: Keep key personnel in their assigned roles for the contract term and obtain USAC’s prior written approval before changing, removing, or reducing their time commitment.
  - Obligation: Required
  - What to prepare: Key personnel continuity / substitution plan
  - Row confidence: High confidence
  - Citation: Key Personnel / Staffing · p.25
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: Key Personnel / Staffing
  - Page: 25
  - Relevant passage: Or a part of the Contract if Contractor changes the position, role, or time commitment of Key Personnel, or removes Key Personnel from the Contract, without USAC’s prior written approval.
  - Evidence confidence: High confidence

### Contractual / Admin
- Requirement: Submit the transition-out plan no later than sixty (60) days before the end of the contract period of performance, including knowledge transfer and offboarding steps.
  - Obligation: Required
  - What to prepare: Transition-out plan
  - Row confidence: High confidence
  - Citation: Contractual / Admin · p.11
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: Contractual / Admin
  - Page: 11
  - Relevant passage: Submit the transition-out plan no later than sixty (60) days before the end of the contract period of performance, including knowledge transfer and offboarding steps.
  - Evidence confidence: High confidence
- Requirement: Contractor staff attending USAC headquarters must complete the USAC Visitor Form and wear a badge while on premises.
  - Obligation: Required
  - What to prepare: USAC Visitor Form
  - Row confidence: High confidence
  - Citation: Contractual / Admin · p.6
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: Contractual / Admin
  - Page: 6
  - Relevant passage: Headquarters for meetings or to conduct audits, Contractor Staff will be considered as visitors. All visitors are required to complete USAC's Visitor Form, and wear a badge while on premises. The Kick-Off Meeting and all in -person meetings will be held at USAC Headquarters or other reasonable locations designated by USAC.
  - Evidence confidence: High confidence
- Requirement: Avoid material exceptions to the RFP; material or unacceptable exceptions may render the proposal technically unacceptable or ineligible for award.
  - Obligation: Required
  - What to prepare: Exceptions attachment or compliant terms
  - Row confidence: High confidence
  - Citation: Contractual / Admin · p.51
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: Contractual / Admin
  - Page: 51
  - Relevant passage: In a separate Attachment to the proposal, “Exceptions to RFP Terms.” Proposals that include material exceptions to the RFP may be considered unacceptable and render Offeror ineligible for award unless the Offeror withdraws or modifies any unacceptable exceptions prior to USAC’s selection of the successful Offeror for award.
  - Evidence confidence: High confidence
- Requirement: Maintain an active SAM.gov registration and not be excluded from government contracting for responsibility determination.
  - Obligation: Required
  - What to prepare: Active SAM.gov registration
  - Row confidence: High confidence
  - Citation: Contractual / Admin · p.58
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: Contractual / Admin
  - Page: 58
  - Relevant passage: Contracting, as listed on the excluded parties list in https://www.sam.gov, and 6. Offeror has an active registration in https://www.sam.gov. [[PAGE 59]] Universal Service Administrative Co.
  - Evidence confidence: High confidence

### Schedule
- Requirement: Submit questions by Monday, March 9, 2026, by 11:00 AM ET.
  - Obligation: Required
  - Row confidence: High confidence
  - Citation: Schedule · p.1
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: Schedule
  - Page: 1
  - Relevant passage: Proposal (“RF P”) Solicitation Number: IT-26-027 Solicitation Issue Date: Tuesday, March 3, 2026 Question Due Date: Monday, March 9, 2026, by 11:00 AM ET Q&A Response Due Date: Friday, March 13, 2026 Proposal Due Date: Monday, March 30, 2026, by 11:00 AM ET CONTRACT TO BE ISSUED BY: Universal Service Administrative Co.
  - Evidence confidence: High confidence
- Requirement: Submit the proposal by March 30, 2026.
  - Obligation: Required
  - What to prepare: Complete proposal submission
  - Row confidence: High confidence
  - Citation: Schedule · p.1
  - Source document: RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
  - Section: Schedule
  - Page: 1
  - Relevant passage: Date: Monday, March 9, 2026, by 11:00 AM ET Q&A Response Due Date: Friday, March 13, 2026 Proposal Due Date: Monday, March 30, 2026, by 11:00 AM ET CONTRACT TO BE ISSUED BY: Universal Service Administrative Co.
  - Evidence confidence: High confidence