Agency / customer
USAC (FCC-associated)
Requirements Matrix
Find Evil LLC
USAC RFP: Penetration Testing as a Service
Decision
Pursue the USAC PTaaS opportunity strictly as a subcontractor.
While Find Evil LLC offers elite DFIR and multi-cloud forensics expertise, the solicitation focuses heavily on Penetration Testing as a Service. A lack of federal past performance and pending socio-economic certifications limit competitive standing for a prime bid.
Case workspace - 5 views
Due date
2026-03-30
Place of performance
Washington, DC 20005
Requirements
51
Total rows with evidence
Sections
8
Grouped by category
Evidence confidence
High confidence
Evidence strength
Mandatory
34
Must-meet requirements
What to verify before drafting starts
Check these first before proposal work begins.
Due date
Submit the proposal by March 30, 2026.
Submission method
Proposals must be submitted via email to Procurement@usac.org with a copy to Mustafa.Kamal@usac.org no later than Monday, March 30, 2026, 11:00 AM ET. The subject line must only be 'RFP IT-26-027'.
Pricing sheet
Price the bid sheet by daily rate for the base year and all four option years.
Legal certification
The Offeror's submission must include a statement certifying that the USAC Standard Terms and Conditions set forth in the RFP have been reviewed by the Offeror's office of general counsel (or equivalent legal representative).
Security / Privacy11 rows
Contractor must comply with Data Security Laws (FISMA, NIST SP 800-53 Rev 5). Any Cloud Service Offering used must be FedRAMP Authorized at a moderate risk level.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
PRIVACY AND SECURITY ADDENDUM, 2. SECURITY PROVISIONS
Page
40
Relevant passage
2.1. Data Security Laws Compliance. Contractor shall comply with the Data Security Laws. For any Contractor IT using a Cloud Service Offering that accesses, stores, or otherwise processes USAC Data, and/or PII, Contractor shall provide documentation and proof of FedRAMP Authorization for use at a moderate risk before any such cloud-based Service may be used.
Contractor must notify USAC at incident@USAC.org and Privacy@USAC.org within one (1) hour of becoming aware of an actual or suspected Cybersecurity Incident or Privacy Incident.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
PRIVACY AND SECURITY ADDENDUM, 2.14. Cybersecurity Incidents and Privacy Incidents
Page
43
Relevant passage
Any Event identified as a Cybersecurity Incident or Privacy Incident requires that USAC be notified at incident@USAC.org and Privacy@USAC.org within one (1) hour of becoming aware of an actual or suspected Cybersecurity Incident or Privacy Incident.
Vendor must submit its insider threat program to USAC's Chief Privacy Officer and Chief Information Security Officer within 90 days of the Effective Date of the Contract.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
PRIVACY AND SECURITY ADDENDUM, 2. SECURITY PROVISIONS
Page
41
Relevant passage
Vendor must submit its insider threat program to USAC's Chief Privacy Officer and Chief Information Security Officer within 90 days of the Effective Date of the Contract.
Contractor shall not use, implement, build, or deploy AI tools, services, or code of any type without prior written approval from USAC. Approved AI must include human oversight and cannot be used for autonomous decisions in sensitive areas.
If Applicable
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
PRIVACY AND SECURITY ADDENDUM, 3. TECHNOLOGY CONSIDERATIONS
Page
47
Trigger condition
If AI tools are proposed or used
Relevant passage
Contractor shall not use, implement, build, or deploy AI tools, services, or code of any type without prior written approval from USAC. Approved AI must include human oversight and cannot be used for autonomous decisions in sensitive areas.
Contractor must maintain ISO 27001 compliance certification and SOC 2 Type II reports for all Contractor IT used in performance of the Services, and provide them to USAC within 10 calendar days of the Effective Date.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
PRIVACY AND SECURITY ADDENDUM, 2.20. Additional Requirements for Services in Contractor IT
Page
45
Relevant passage
Contractor shall maintain ISO 27001 compliance certification and notify USAC of any changes to its compliance. Contractor shall provide USAC with its ISO 27001 compliance certification within ten (10) calendar days of the Effective Date. • Contractor shall maintain administrative, technical, physical, and procedural information security controls as demonstrated in Service Organization Controls (“SOC”) 2 Type II reports
Email draft details and reproduction steps for critical or high findings to the USAC product manager within one (1) business day.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
1. One time (within five
Page
10
Relevant passage
Finding and cover each Significant Alert of Finding reported during the test. 5. Email Alert within one (1) business day of Critical or High finding to USAC project manager.
For contracts involving new IT systems or tools, provide a monthly vulnerability report and a risk mitigation plan addressing identified vulnerabilities.
If Applicable
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
18. Notification and Assistance . Contractor will cooperate with USAC in any litigation and
Page
45
Trigger condition
Applies only if the contract includes new IT systems/tools.
Relevant passage
Vulnerabilities in the applicable timeframes set forth in such policies. Contractor shall provide a monthly vulnerability report and a risk mitigation plan to address any identified vulnerabilities.
For contracts involving new IT systems or tools, provide a POA&M to address vulnerabilities promptly and prioritize remediation based on severity and risk.
If Applicable
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
18. Notification and Assistance . Contractor will cooperate with USAC in any litigation and
Page
45
Trigger condition
Applies only if the contract includes new IT systems/tools.
Relevant passage
Officer, and Contractor shall remedy such vulnerabilities as soon as possible. Contractor shall provide USAC a POA&M to address such vulnerabilities promptly and shall prioritize remediation based on the risks implicated by such vulnerabilities. 2.20.
For contracts involving new IT systems or tools, report critical and high vulnerabilities promptly to USAC’s Chief Information Officer and Chief Information Security Officer and begin remediation immediately.
If Applicable
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
18. Notification and Assistance . Contractor will cooperate with USAC in any litigation and
Page
45
Trigger condition
Applies only if the contract includes new IT systems/tools.
Relevant passage
For contracts involving new IT systems or tools, report critical and high vulnerabilities promptly to USAC’s Chief Information Officer and Chief Information Security Officer and begin remediation immediately.
For contracts involving new IT systems or tools, respond to USAC information-security questionnaires and related security documentation requests within ten (10) business days or in the timeframe requested by USAC.
If Applicable
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
2. SECURITY PROVISIONS
Page
40
Trigger condition
Applies only if the contract includes new IT systems/tools.
Relevant passage
Necessary for the parties to perform their obligations under the Data Security Laws; (iii) complete any security questionnaires, IT rules of behavior, certifications, assessments, or workforce training reasonably requested by USAC in a timely manner; and (iv) receive prior written authorization from USAC to access USAC IT Systems from
For contracts involving new IT systems or tools, ensure cloud or COTS offerings can use USAC’s OKTA instance for user authentication and provisioning.
If Applicable
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
3. TECHNOLOGY CONSIDERATIONS
Page
46
Trigger condition
Applies only if the contract includes new IT systems/tools.
Relevant passage
The following requirements: 3.1.1. The Software must be able to utilize USAC’s instance of OKTA’s identity and access management software for user authentication and provisioning. OKTA is a FedRAMP Authorized CSP identity and access management product used by USAC. 3.1.2.
Submission10 rows
Proposals must be submitted via email to Procurement@usac.org with a copy to Mustafa.Kamal@usac.org no later than Monday, March 30, 2026, 11:00 AM ET. The subject line must only be 'RFP IT-26-027'.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 1. GENERAL, B. PERIOD FOR ACCEPTANCE OF OFFERS
Page
51
Relevant passage
Be submitted to USAC Procurement Department, no later than Monday, March 30, 2026, 11:00 AM ET (“Proposal Due Date”). • Be submitted in the form of one electronic copy submitted to Procurement@usac.org with copy to Mustafa.Kamal@usac.org. The subject line for all email communication related to this solicitation must only be RFP IT-26-027.
Proposals must be presented in four separate volumes (Corporate Information, Technical Capability, Past Performance, Price). Each volume must be submitted in PDF format as a separate attachment to a single email. Times New Roman 12-point font is required (minimum 9-point for diagrams/tables).
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 4. PROPOSAL FORMAT & E. Presentation and Page Limitations
Page
52
Relevant passage
Proposals shall be presented in four separate volumes: 1. Volume 1 – Corporate Information 2. Volume 2 – Technical Capability 3. Volume 3 – Past Performance 4. Volume 4 – Price Each volume of the proposal should be submitted in PDF format as a separate attachment to a single email Proposals must be prepared using Times New Roman font.
Each volume must contain a cover page including: Org name, contact name, contact info, Unique Entity ID, date of submittal, a statement verifying the proposal is valid for 120 days, and the signature of a duly authorized representative.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 5. PROPOSAL COVER PAGE
Page
53
Relevant passage
Each volume must contain a cover page including: Org name, contact name, contact info, Unique Entity ID, date of submittal, a statement verifying the proposal is valid for 120 days, and the signature of a duly authorized representative.
Volume 1 must not exceed 4 pages and must include the Cover Page, Executive Summary (no pricing info), Confidentiality and Information Security statement, and Conflict of Interest statement.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 6. PROPOSAL CONTENT & E. Presentation and Page Limitations
Page
53
Relevant passage
Volume 1 must not exceed 4 pages and must include the Cover Page, Executive Summary (no pricing info), Confidentiality and Information Security statement, and Conflict of Interest statement.
Volume 2 must not exceed 12 pages (excluding Attachment A - Resumes). It must include the Cover Page, Technical Approach, Capabilities, and Key Personnel details.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 6. PROPOSAL CONTENT & E. Presentation and Page Limitations
Page
54
Relevant passage
Volume 2 must not exceed 12 pages (excluding Attachment A - Resumes). It must include the Cover Page, Technical Approach, Capabilities, and Key Personnel details.
Volume 3 must not exceed 5 pages. It must include a Cover Page, description of recent experience, and a list of 2 to 3 current or recently completed contracts (no older than 3 years) for similar services. Each project overview shall not exceed 1 page.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 6. PROPOSAL CONTENT & E. Presentation and Page Limitations
Page
55
Relevant passage
Volume 3 must not exceed 5 pages. It must include a Cover Page, description of recent experience, and a list of 2 to 3 current or recently completed contracts (no older than 3 years) for similar services. Each project overview shall not exceed 1 page.
Volume 4 must not exceed 4 pages. It must include a Cover Page and completed pricing information in Attachment 1 – Bid Sheet. The proposed price must be fully loaded.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 6. PROPOSAL CONTENT & E. Presentation and Page Limitations
Page
56
Relevant passage
Volume 4 must not exceed 4 pages. It must include a Cover Page and completed pricing information in Attachment 1 – Bid Sheet. The proposed price must be fully loaded.
The Offeror's submission must include a statement certifying that the USAC Standard Terms and Conditions set forth in the RFP have been reviewed by the Offeror's office of general counsel (or equivalent legal representative).
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 1. GENERAL, A. CONTRACT TERMS AND CONDITIONS
Page
51
Relevant passage
Offeror’s submission must include a statement certifying that the USAC Standard Terms and Conditions set forth in this RFP have been reviewed by Offeror’s office of general counsel (or equivalent legal representative).
Any deviations from, or exceptions to, the requirements in the RFP must be clearly identified in a separate Attachment to the proposal titled 'Exceptions to RFP Terms'.
If Applicable
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 1. GENERAL, A. CONTRACT TERMS AND CONDITIONS
Page
51
Trigger condition
If Offeror has exceptions to RFP terms
Relevant passage
Offeror’s proposal may identify deviations from, or revisions, exceptions or additional terms (collectively “exceptions”) to the RFP, but only if such exceptions are clearly identified in a separate Attachment to the proposal, “Exceptions to RFP Terms.”
The RFP is subject to the terms of the Confidentiality Agreement (Attachment 2) which must be executed by the Offeror and submitted along with any proposal. It may be submitted in PDF format as a separate attachment and does not count towards page limits.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
SECTION A: About Us, 3. CONFIDENTIALITY
Page
4
Relevant passage
The RFP is subject to the terms of the Confidentiality Agreement (Attachment 2) which must be executed by the Offeror and submitted along with any proposal. It may be submitted in PDF format as a separate attachment and does not count towards page limits.
Deliverables9 rows
Contractor must perform penetration testing on 16 to 20 USAC mission systems at least annually in pre-production environments. Testing includes Ethical Hacking, Web Application, and Application Code testing.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
SECTION B: STATEMENT OF WORK, 5. SCOPE OF WORK AND DELIVERABLES
Page
7
Relevant passage
Contractor must perform penetration testing on 16 to 20 USAC mission systems at least annually in pre-production environments. Testing includes Ethical Hacking, Web Application, and Application Code testing.
Contractor shall offer optional services to conduct three corporate-level social engineering campaigns annually, including Phishing, Vishing, Smishing, and AI emulation.
If Applicable
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
SECTION B: STATEMENT OF WORK, 5. SCOPE OF WORK AND DELIVERABLES
Page
9
Trigger condition
If optional services are exercised
Relevant passage
Contractor shall offer optional services to conduct three corporate-level social engineering campaigns annually, including Phishing, Vishing, Smishing, and AI emulation.
Contractor shall offer optional physical testing for Wi-Fi networks and physical access at USAC's HQ location annually.
If Applicable
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
SECTION B: STATEMENT OF WORK, 5. SCOPE OF WORK AND DELIVERABLES
Page
9
Trigger condition
If optional services are exercised
Relevant passage
C. Physical Environment Testing (Optional) i. Wi-Fi testing of USAC’s Corporate (secure) and Guest (insecure) Wi-Fi networks at USAC’s HQ ii.
Contractor must provide specific deliverables according to the schedule in Section B.5.C, including Kickoff Meeting, Onboarding Plan, Core System Pen Test Plans/Reports, Significant Alerts of Findings, Weekly/Monthly Status Reports, and a Transition Out Plan.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
SECTION B: STATEMENT OF WORK, 5. SCOPE OF WORK AND DELIVERABLES, C. Deliverables
Page
9
Relevant passage
Contractor must provide specific deliverables according to the schedule in Section B.5.C, including Kickoff Meeting, Onboarding Plan, Core System Pen Test Plans/Reports, Significant Alerts of Findings, Weekly/Monthly Status Reports, and a Transition Out Plan.
Hold the contract kickoff meeting within five (5) business days of contract award.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
1. One time (within five
Page
10
Relevant passage
IT-26-027 | Request for Proposals (RFP) Page 10 of 11 Available for Public Use 1. One time (within five (5) business days of Contract award) Kickoff Meeting Official kick-off of Contract to introduce teams, Contractor approach, and coordinate technical planning for test execution. 2.
For each system tested, submit a draft penetration test plan ten (10) business days before test kickoff and a final plan five (5) business days before test kickoff.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
1. One time (within five
Page
10
Relevant passage
Contractor personnel, test accounts, tools, and coordination of support by USAC teams. 3. One draft Plan (ten (10) business days before test kickoff) and one final Plan (five (5) business days before test kickoff) for each system tested for up to twenty (20) systems.
For each system tested, provide a draft report at the conclusion of the test and a final report within ten (10) business days after the test concludes.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
1. One time (within five
Page
10
Relevant passage
Responsible for coordination for access and readiness to commence testing on schedule. 4. One draft Report at conclusion of each test and one final Report (ten (10) business days after conclusion of test) ) for each system tested for up to twenty (20) systems.
If optional social engineering tests are performed, publish the annual social engineering assessment report with outcomes, key risks, and next-year recommendations.
If Applicable
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
Deliverables
Page
9
Relevant passage
Urrent fraud scenarios and security threats known or prescient. iv. Contractor will publish a Social Engineering Assessment Report annually after all tests are completed with recommendations for Social Engineering testing in the coming year along with outcomes and key risks identified by the tests. c.
If optional physical environment testing is performed, publish a report with findings and recommendations for improvement.
If Applicable
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
9. Once annually, fifteen
Page
11
Relevant passage
Testing for USAC’s HQ location. 10. Once annually, fifteen (15) days after the test (OPTIONAL) Physical Environment Penetration Test Report Contractor will publish outcome of the Physical Environment Penetration Test in a report with recommendations for improvement. 11.
Pricing6 rows
Pricing must be submitted using Attachment 1 - Bid Sheet. The proposed price must be a fully loaded firm fixed price including wages, overhead, G&A, taxes, and profit. Travel expenses are not reimbursable.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
SECTION E: INSTRUCTIONS AND EVALUATION CRITERIA, 6. PROPOSAL CONTENT, D. Price Proposal (Volume 4)
Page
56
Relevant passage
Pricing must be submitted using Attachment 1 - Bid Sheet. The proposed price must be a fully loaded firm fixed price including wages, overhead, G&A, taxes, and profit. Travel expenses are not reimbursable.
Price the bid sheet by daily rate for the base year and all four option years.
Required
Where this comes from
Source document
RFP-IT-26-027-Attachment-1-Bid-Sheet.xlsx
Section
Attachment 1 - Bid Sheet
Relevant passage
Price the bid sheet by daily rate for the base year and all four option years.
Provide pricing for small, medium, and large system-test sizes in Attachment 1 – Bid Sheet.
Required
Where this comes from
Source document
RFP-IT-26-027-Attachment-1-Bid-Sheet.xlsx
Section
Attachment 1 - Bid Sheet
Relevant passage
| | | | | Base Year | Option Year 1 | Option Year 2 | Option Year 3 | Option Year 4 | 1 | Small (Low) | 5 | | | | | | 2 | Medium (Moderate) | 7 | | | | | | 3 | Large (High) | 4 | | | | | | Core System Tests Sub-Total | | | | | | | | Social Engineering Testing (Optional) | | | | | | | | Physical Environment Testing (Optional) | | | | | |
Include optional pricing line items for social engineering testing and physical environment testing in Attachment 1 – Bid Sheet.
If Applicable
Where this comes from
Source document
RFP-IT-26-027-Attachment-1-Bid-Sheet.xlsx
Section
Attachment 1 - Bid Sheet
Relevant passage
7 | | | | | | 3 | Large (High) | 4 | | | | | | Core System Tests Sub-Total | | | | | | | | Social Engineering Testing (Optional) | | | | | | | | Physical Environment Testing (Optional) | | | | | | | | Optional Tests Sub-Total | | | | | | | | Grand Total | | | | | | | | Other (describe) | | | | | | | | Total NTE Price | | | | | | | |
Complete Attachment 1 – Bid Sheet with company name, authorized representative, signature, title, and date.
Required
Where this comes from
Source document
RFP-IT-26-027-Attachment-1-Bid-Sheet.xlsx
Section
Attachment 1 - Bid Sheet
Relevant passage
| | | | | Company Name: ________________________________________________ | | | | | | | | Authorized Representative: _______________________________________ | | | | | | | | Signature:______________________________________________________ | | | | | | | | Print Name:____________________________________________________ | | | | | | | |
USAC encourages offerors to propose alternative pricing they normally provide for Penetration Testing as a Service.
If Applicable
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
1. A cover page, as outlined above.
Page
56
Relevant passage
In Attachment 1 – Bid Sheet. As noted on the bid sheet, USAC requests offerors to propose alternative pricing that they normally provide relative to their approach for providing Penetration Testing as a Service.
Evaluation5 rows
USAC will evaluate offers based on Technical, Past Performance, and Price factors.
Reference
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
3. Price Evaluation:
Page
58
Relevant passage
Proposals (RFP) Page 58 of 59 Available for Public Use Experience and past performance information will be evaluated to assess the risks associated with Offeror’s performance of this effort, considering the relevance, how recent the project is (no older than three (3) years from the date of the solicitation), and quality of Offeror’s
USAC will evaluate whether proposed pricing is realistic and reasonable, and unrealistic or unreasonable pricing will not be considered for award.
Reference
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
3. Price Evaluation:
Page
58
Relevant passage
Total prices of Offerors when making the award, USAC will also evaluate whether the proposed prices are realistic (i.e., reasonably sufficient to perform the requirements) and reasonable. Proposals containing prices that are determined to be unrealistic or unreasonable will not be considered for award. 8.
USAC intends to make award on a best-value basis considering Technical, Past Performance, and Price.
Reference
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
2. Page Limitation
Page
57
Relevant passage
Solicitation to the responsible Offeror whose offer conforming to the solicitation will be most advantageous to USAC, price and other factors considered. The following factors shall be used to evaluate offers and select the awardee – Technical, Past Performance, and Price. 7.1.
Address the Technical subfactors of Technical Approach, Capabilities, and Key Personnel in the technical proposal.
Reference
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
2. Page Limitation
Page
57
Relevant passage
1. Technical: The technical sub-factors listed below in descending order of importance: a. Technical Approach b. Capabilities c. Key Personnel 7.2. Experience and Past Performance: [[PAGE 58]] Universal Service Administrative Co.
Do not exceed the volume page limits; proposals exceeding the page count may be considered technically unacceptable and may receive no further consideration.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
2. Page Limitation
Page
57
Relevant passage
Five (5) pages. d. Volume 4 – Price; may not exceed four (4) pages. Any proposals received exceeding the page count will be considered technically unacceptable and may not receive further consideration. 7.
Key Personnel / Staffing4 rows
The Contractor's team must be staffed with a Contract Engagement Manager. The Offeror shall propose additional Key Personnel such as engineers, consultants, and/or IT lead. Resumes for all Key Personnel must be submitted as Attachment A, no longer than 2 pages per resume.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
SECTION B: STATEMENT OF WORK, 6. KEY PERSONNEL & SECTION E: 6. PROPOSAL CONTENT
Page
12
Relevant passage
The Contractor's team must be staffed with a Contract Engagement Manager. The Offeror shall propose additional Key Personnel such as engineers, consultants, and/or IT lead. Resumes for all Key Personnel must be submitted as Attachment A, no longer than 2 pages per resume.
Contractor Staff are required to be in the USAC office at least 2 days per week. Contractors required to report in person must reserve workspaces in advance using USAC's hoteling system.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
SECTION B: STATEMENT OF WORK, 4. PLACE OF PERFORMANCE
Page
5
Relevant passage
Presently, USAC has a hybrid work approach requiring Contractor Staff (as defined in Section C.1.G) to be in the USAC office at least 2 days per week. Contractors that are required to report in person must reserve their workspaces in designated areas in advance using USAC’s hoteling system.
Conduct background checks on contractor staff and provide evidence of those checks to USAC upon request.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
Key Personnel / Staffing
Page
25
Relevant passage
Negligent, or that constitute a breach of the Visitor Form and/or the Contract. Contractor shall conduct background checks on Contractor Staff and provide evidence of the background checks to USAC upon request. 20. KEY PERSONNEL USAC may specify which Contractor employees are Key Personnel under the Contract.
Keep key personnel in their assigned roles for the contract term and obtain USAC’s prior written approval before changing, removing, or reducing their time commitment.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
Key Personnel / Staffing
Page
25
Relevant passage
Or a part of the Contract if Contractor changes the position, role, or time commitment of Key Personnel, or removes Key Personnel from the Contract, without USAC’s prior written approval.
Contractual / Admin4 rows
Submit the transition-out plan no later than sixty (60) days before the end of the contract period of performance, including knowledge transfer and offboarding steps.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
Contractual / Admin
Page
11
Relevant passage
Submit the transition-out plan no later than sixty (60) days before the end of the contract period of performance, including knowledge transfer and offboarding steps.
Contractor staff attending USAC headquarters must complete the USAC Visitor Form and wear a badge while on premises.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
Contractual / Admin
Page
6
Relevant passage
Headquarters for meetings or to conduct audits, Contractor Staff will be considered as visitors. All visitors are required to complete USAC's Visitor Form, and wear a badge while on premises. The Kick-Off Meeting and all in -person meetings will be held at USAC Headquarters or other reasonable locations designated by USAC.
Avoid material exceptions to the RFP; material or unacceptable exceptions may render the proposal technically unacceptable or ineligible for award.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
Contractual / Admin
Page
51
Relevant passage
In a separate Attachment to the proposal, “Exceptions to RFP Terms.” Proposals that include material exceptions to the RFP may be considered unacceptable and render Offeror ineligible for award unless the Offeror withdraws or modifies any unacceptable exceptions prior to USAC’s selection of the successful Offeror for award.
Maintain an active SAM.gov registration and not be excluded from government contracting for responsibility determination.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
Contractual / Admin
Page
58
Relevant passage
Contracting, as listed on the excluded parties list in https://www.sam.gov, and 6. Offeror has an active registration in https://www.sam.gov. [[PAGE 59]] Universal Service Administrative Co.
Schedule2 rows
Submit questions by Monday, March 9, 2026, by 11:00 AM ET.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
Schedule
Page
1
Relevant passage
Proposal (“RF P”) Solicitation Number: IT-26-027 Solicitation Issue Date: Tuesday, March 3, 2026 Question Due Date: Monday, March 9, 2026, by 11:00 AM ET Q&A Response Due Date: Friday, March 13, 2026 Proposal Due Date: Monday, March 30, 2026, by 11:00 AM ET CONTRACT TO BE ISSUED BY: Universal Service Administrative Co.
Submit the proposal by March 30, 2026.
Required
Where this comes from
Source document
RFP-IT-26-027-Penetration-Testing-as-a-Service.pdf
Section
Schedule
Page
1
Relevant passage
Date: Monday, March 9, 2026, by 11:00 AM ET Q&A Response Due Date: Friday, March 13, 2026 Proposal Due Date: Monday, March 30, 2026, by 11:00 AM ET CONTRACT TO BE ISSUED BY: Universal Service Administrative Co.
No rows match the active filters.