Request for Proposals - FY26 Cyber Risk Assessment and Vulnerability Scan

The City of Paducah (KY) is requesting proposals from qualified firms to provide a cyber risk assessment and vulnerability scan. Details of the City of Paducah’s technology environment will be disclosed during the mandatory in-person pre-submission meeting. All attendees will be required to sign a confidentiality agreement prior to details being disclosed.

Cyber Risk Assessment and Vulnerability Scan - RFP Packet

In an effort to better understand our current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments; the City requires the following services to be performed by qualified firms:

Cyber Risk Assessment - Qualified firms shall provide a systematic process aimed at identifying vulnerabilities and threats within the City of Paducah’s technology environment in order to assess the likelihood of a security event, and determine potential impact of such occurrence. The assessment shall also provide recommendations for additional security controls to address the City of Paducah’s specific challenges and mitigate risks of breaches or other disruptive incidents.

Vulnerability Scan - Qualified firms shall use computer programs designed to assess computers, networks, systems, and applications for known weaknesses. The scan results shall also provide the City of Paducah with insights into corrective actions, compliance with regulatory frameworks, and recommendations for a strong cybersecurity posture.

Considerations - The City of Paducah supports public safety departments. All services performed shall not impact Police, Fire, nor E911 services outside of scheduled maintenance windows.

Pre-submission Meeting -  In order to not inadvertently disclose potential vulnerabilities to would-be attackers, prospective bidders shall attend a mandatory, in-person, pre-bid meeting where additional information can be given. Virtual attendance will not be permitted. Failure to attend this meeting will disqualify you as a potential bidder. The meeting will be held 14 days prior to the bid opening, at 2:00 p.m. on February 16, 2026, at the City Hall, 2nd Floor Commission Chambers, 300 S. Fifth Street, Paducah, KY. Questions made in writing (email) will be responded to up to 72 hours prior to the bid opening. If questions are submitted, the question(s) and answer(s) are forwarded to all potential bidders in order to maintain a fair and competitive process.

Proposal Deadline - Three copies of sealed Proposals conforming to the requirements set out below must be received via U.S. Mail or Courier no later than 2:00 p.m., February 23, 2026. Submittals shall be submitted to

Paducah City Clerk

300 South Fifth Street

PO Box 2267

Paducah, KY 42002