SP 91503: Cybersecurity Assessment and Pen Testing

CHA ITS SP 91503 Cybersecurity Assessment & Pen Testing
SMALL PURCHASE REQUEST FORM
PART 1 - REQUESTOR AND SCOPE OF SERVICES INFORMATION
PROJECT TITLE ITS 91503 Cybersecurity Assessment & Pen Testing
REQUESTING DEPARTMENT / DIVISION Procurement & Contracts / Information Technology
REQUEST ISSUED 10/13/2026
QUOTE DUE DATE AND TIME 10/27/2026 at 1:00 PM CT
PERFORMANCE PERIOD 1 YEAR BASE TEAM & 2-1 YEAR OPTIONS
Initial and Option Periods (if applicable)
PROJECTED CONTRACT START DATE 12/1/2026
CONTACT PERSON NAME/EMAIL Frederica Juste - FJuste@thecha.org
PART 2 - SCOPE OF WORK
The Chicago Housing Authority is seeking qualified cybersecurity firms to evaluate the Chicago Housing Authority's
(CHA) overall security posture by identifying technical, procedural, and human vulnerabilities across internal and
external systems.
In addition to the execution of this CHA quote form, submissions shall include a separate 3-4-page pdf document
including the firm's experience & details for project implementation. The selected vendor shall have the minimum
qualifications of:
* U.S based testing personnel and U.S data residency for all collected artifacts.
* 3 or more years of proven experience in penetration testing.
* Certifications strongly preferred: OSCP, OSCE, GPEN, or equivalent
* Minimum of 3 detailed projects from clients (public sector or housing authority engagement
preferred) within the past 36 months.
* Bio & resume of lead tester included with submission
* Sample back-out plan for any testing activity that inadvertently impacts CHA systems or user access.
In coordination with CHA's internal security staff & offering an objective, third-party perspective, culminates in
actionable recommendations to enhance CHA's network defense strategy. Assessments are conducted once per
calendar year shall begin promptly following award of the contract. Due to time constraints, base year 1 shall begin
10/19 and services shall be finalized by 12/4. All reports shall be due 12/11. Should CHA choose to exercise any
available option terms, services shall begin in Q3 of that calendar year.
Specific test phases shall be conducted using unauthenticated (non credentialed) access and without any
Domain Administrator or other privileged credentials, ensuring the assessment accurately reflects external

adversary capabilities
Project Management Requirements
* Dedicated project manager who will serve as CHA's primary point of contact.
* Kickoff meeting to define expectations, schedule, communication cadence, and establish technical points of
contact.
* Provide a project schedule including milestones, testing windows, and defined blackout periods.
* Provide source IP ranges to CHA prior to the commencement of any assessment

CHA ITS SP 91503 Cybersecurity Assessment & Pen Testing
* Provide regular weekly progress updates, with additional ad hoc briefings when significant issues or
incidents are discovered.
* Final session to review findings and recommendations with CHA stakeholders.
Services include but are not limited to the following areas:
Internet External Vulnerability & Security Testing
1. External Vulnerability Scan
* Identify services running on Internet-facing hosts and assess them for vulnerabilities.
Scans will be conducted without authorized credentials to simulate realistic threat
actor conditions. All identified vulnerabilities must be validated or evaluated to
minimize false positives.
* Exploitation will stop at the point of proof of compromise and not cause business
interruption. Proof shall be provided with a screenshot or extracted token.
2. Web Application Security Testing
* Perform authenticated and unauthenticated testing of web applications (20 external, 11
internal).
* Identify and exploit vulnerabilities including but not limited to the OWASP Top 10.
* Reference testing checklist OWASP WSTG (web security testing guide).
* API endpoints (REST/GraphQL/SOAP) explicitly in scope, with OWASP API Security.
* Hybrid testing approach involving Blackbox testing for external applications and grey-box
testing for internal applications.
3. Authentication & Authorization Controls
* Test for common vulnerabilities such as brute force attacks, weak credentials, and
session management flaws.
* Attempt to bypass authentication mechanisms and gain unauthorized access.
* Verify proper access controls and role-based permissions are enforced.
Internet Internal Vulnerability & Security Testing - Physical or virtual appliances are permitted with prior CHA
approval for internal network assessments.
1. Internal Vulnerability Scan
* The vendor will conduct internal vulnerability assessments without deploying client
software or persistent agents. This process will involve identifying active services on
hosts and testing for vulnerabilities associated with known exploits. Scanning shall be
performed without requiring the installation of tools on CHA devices.
* The vendor shall assess the agreed-upon subnets, provided post-award, and validate
test results to minimize false positives.
2. Internal Penetration Testing
* Targeted penetration tests on key assets and systems, both with and without valid
credentials to simulate both insider threats and adversarial persistence.
3. Domain Security and Password Audit
* Evaluate password strength across systems and audit password-related policies,
including complexity requirements, expiration rules, and MFA enforcement.
* Provide actionable guidance for improving password practices and policy compliance.
4. Domain Controller Testing
* Hardening Assessment - Evaluate Domain Controller hardening against industry
benchmarks (e.g., CIS, Microsoft Security Baselines), including patch levels, service
configurations, SMB/LDAP security, logging, and secure channel protections.
* Credential & Hash Protection Review - Assess protections for stored credentials,
cached hashes, LSASS memory, and credential guard implementations.
* Identify risks related to pass the hash, pass the ticket, and Kerberoasting.

CHA ITS SP 91503 Cybersecurity Assessment & Pen Testing
* Active Directory Certificate Services (ADCS) misconfigurations - ESC1 through ESC13.
5. Workstation Vulnerability Assessment
* Authenticated scans on all workstations.
* Identify end-of-life systems, unpatched vulnerabilities, misconfigurations, and any
additional security risks.
* Scans shall not require the installation of any agent or software on CHA endpoints.
6. Cloud Security Testing Assessment
* Review Microsoft Entra ID configurations and identify vulnerabilities (conditional
access, MFA bypass, legacy auth), M365 tenant security (Exchange, SharePoint,
Teams).
* Review and identify hybrid identity attack paths (AD Connect, PHS/PTA), OAuth app
consent abuse, and cloud storage misconfigurations.
Wireless Security Testing
1. Conduct a comprehensive wireless assessment of CHA's 802.11 environment:
* Identify rogue access points.
* PMKID capture / 4-way handshake offline cracking attempts.
* Attempt to break or bypass encryption protocols by testing WPA2/WPA3 enterprise
network transition mode downgrade attacks.
* Tests for vulnerabilities include war driving, Evil twin attacks, Wireless spoofing,
Insecure Wi-Fi configurations, MFA effectiveness and wireless session persistence.
* Identify vulnerabilities for Corporate and Guest networks in addition to any security
vulnerabilities that could compromise CHA Wireless.
* Attempt to bypass Network Access Controls and identify vulnerable security gaps.
Advanced Social Engineering & Phishing Exercise - Defined target population provided by CHA
1. Simulate Social Engineering Attack
* Modern social engineering attack scenarios to evaluate employee awareness and
procedural weaknesses. All attacks must be non-malicious, non-destructive, and pre-
approved by CHA prior to issuance.
* Phishing Campaign
Design and execute a phishing campaign using mined or provided email addresses
o
if it cannot be obtained through other means. CHA managed employee cell phone
numbers will be provided.
The phishing campaign shall include email and text messages for CHA owned
o
phones.
Evaluate click rates, credential submission, and employee engagement.
o
No collection of actual CHA user credentials - landing pages should record click +
o
submit event only, never store passwords.
Results and statistics must be included in the final report. Include a debrief plan
o
for users who 'failed' that emphasizes training.
* The vendor will perform additional social engineering tests to evaluate the organization's
resilience to human-based attack vectors. Physical security assessments such as tailgating,
dumpster diving and USB drops will be only authorized for pre-coordinated facilities
(written authorized approval required). Testing tactics may include:
Vishing & Spear phishing
o
Impersonation & Tailgating
o
Dumpster Diving (conceptual or physical with written authorized approval)
o

CHA ITS SP 91503 Cybersecurity Assessment & Pen Testing
USB Drops
o
Click Baiting
o
Prepending
o
Back-Out & Contingency Plan
To mitigate operational risk during testing, the vendor shall provide:
* Attack narrative / kill chain section mapped to MITRE ATT&CK tactics & techniques per findings
* Established and documented a back-out plan for any testing activity that inadvertently impacts CHA
systems or user access.
* Clear and immediate escalation path for CHA technical staff.
* Availability during testing windows to promptly remediate or roll back unintended consequences.
Reporting & Key Deliverables
1. Executive Summary
* High-level overview of testing scope, tools of use, methodology, and overall
cybersecurity health.
2. Summary of Findings
* Categorized by severity and business impact.
* CVSS scores and CVE references, where applicable.
* Mapped attack narrative to MITRE ATT&CK tactics & techniques per finding if
applicable.
3. Proof of Exploitation
* Detailed documentation and screenshots of successful exploit paths.
4. Remediation Recommendations
* Prioritized list of corrective actions, categorized by urgency and effort required.
* Root cause patterns, program-level improvements.
* Upfront cost effective & high-priority remediations
* Link to vendor-neutral industry resources for remediation where available.
5. Comprehensive Reporting
* Executive summary, detailed findings, and proof of exploitation. Each finding shall be
assigned a risk rating based on industry standards (e.g., CVSS, CVE), with
accompanying remediation guidance and reference links to vendor-neutral resources.
* Information based on ease of exploitation & documented proof of compromise and
validate that proper access controls, input sanitization, and session management are
enforced.
* Findings delivered in a structured/machine-readable format (CSV or JSON) in addition
to PDF, so CHA can import into its vulnerability tracking system.
* Provide retests for all critical and high findings within 90 days of final report delivery.
6. Data Handling Statement
* All CHA data transmitted/stored by vendor shall be encrypted in transit via protocol
TLS 1.2 and above - rest via Advanced Encryption Standard with a 256-bit key or
above.
* Third-party reporting portal (if applicable) must use MFA for authorized CHA security
team and leadership.
* Written confirmation that all collected data has been securely deleted or destroyed
within 30 days of final report with a transfer of all documentation and materials to
CHA.
7. Presentation and Debrief
* Presentation of results including Q&A session with CHA's ITS security team.

CHA ITS SP 91503 Cybersecurity Assessment & Pen Testing
Prohibited & Restricted Activities
* Installation of client-side software agents or tools on CHA systems.
* Testing against third-party applications, devices/systems or cloud systems not owned by CHA without
prior written authorization.
* Persistence mechanisms left on CHA systems beyond the engagement.
* Collection of actual CHA user credentials
* Password cracking against production Active Directory using online methods that would cause account
lockouts.
* Denial-of-Service (DoS) or Distributed Denial-of-Service (DDoS) without CHA approval.
* Exploitation of vulnerabilities causing service interruption or data loss (unless approved).
* Modification or deletion of client data & Exfiltration of sensitive data
* Use of client credentials outside the test scope and contract terms awarded.
* Publishing or external disclosure of findings without CHA written approval.
* SAST (static application security testing) on CHA applications.
Testing shall be performed with no disruption to CHA business operations. Assessments should be mapped to
recommended industry standard methodologies such as NIST Cybersecurity framework 2.0 categories, NIST SP 800-
115, OWASP WSTG & OWASP Top 10, MITRE ATT&CK framework and the CIS Critical Security Controls (CIS Controls)
for benchmarking.
Operating System: Windows
* Physical & Virtual Hosts - Hypervisor & Storage Server
* Testing 3 Web Applications <100 Pages per application under 1 role. (SSIDs - 2)
* .NET server & .NET MVC ASP.NET (Separate servers Web, Application, & Database layers)
* Network Stacks - IPv4 & IPv6
* Internal Network (Qty - Networks/Subnet) - 15/24
* External Network (Qty- Subnet/IP address) - 3 /30, 3 /29, and 3 /27 (External Services - >5)
Bidder's Unit Bidder's Unit Bidder's Unit
Price Price Price
Spe cification/Service Description
*Base *Option *Option
Year 1 Year 2 Year 3
Internet External Vulnerability
Security Assessment
Internet Internal Vulnerability
Security Assessment
Wireless Security Testing
Advanced Social Engineering &
Phishing Exercise (<1500
Employees)
Detailed Reporting Summaries,
Analytics & Recommendations
TOTAL Annual Pricing
AGGREGATE TOTAL
(1 YR BASE + 2-1 YR OPTIONS)
Test performed in production environment with No privilege then low privilege perspective

CHA ITS SP 91503 Cybersecurity Assessment & Pen Testing
*CHA reserves the right to increase or delete any scheduled items, and/or increase or reduce the quantity of any
scheduled item as deemed necessary, to waive informalities and technicalities, and to make other changes and
modifications consistent with CHA's policies, and the laws and regulations governing HUD programs.
All Quote Responses Must Be Typed & Signed by an Authorized Representative from the Respondent's company.
PART 3 - VENDOR INFORMATION
_______________________
(PROVIDE CORPORATE NAME ATTACHED TO FEDERAL TAX ID NUMBER ON LINE ABOVE) has
thoroughly read all pages of ITS 91503 Cybersecurity Assessment & Pen Testing all associated addenda
(if applicable) and can provide the services as described at the offer submitted on this Quote Form.
CONTACT INFORMATION FOR CORPORATE OFFICIAL AUTHORIZED TO BIND RESPONDENT
DATE
CORPORATE AUTHORIZED
REPRESENTATIVE
CORPORATE OFFICIAL E-MAIL
ADDRESS
COMPANY PHONE NUMBER
COMPANY ADDRESS
CORPORATE AUTHORIZED
REPRESENTATIVE SIGNATURE
The successful Respondent(s) will be required to submit mandatory CHA forms and affidavits
within five (5) days of notice of award found at https://www.thecha.org/contracting-
opportunities/forms-and-documents.
The mandatory forms will be requested from the successful respondents prior to contract
award. Forms should be completed, signed, and notarized where required or marked "not
applicable" where appropriate. The mandatory forms are:
* Utilization Plan**
* Compliance Certification Form
* Contractors Affidavit
* Economic Disclosure Statement Form
* HUD-50071 - Certification of Payments to Influence Federal Transactions
* HUD 5369-A Representations, Certifications and Other Statements of Bidders
* Required Insurance Certificate (see below Insurance Requirements)
Failure by the Respondent to provide such information within the allotted time will
render the Respondent ineligible for award.
CHA may reject any or all quotes. Action to reject all quotes shall be taken only for unreasonably high
prices, error in the solicitation, cessation of need, unavailability of funds, failure to secure adequate
competition, or any other reason deemed appropriate by CHA.

CHA ITS SP 91503 Cybersecurity Assessment & Pen Testing
Insurance Requirements
Prior to the commencement of this Agreement, the Vendor shall procure and maintain at all times during
the term of this Agreement insurance against claims for bodily injury or property damage which may
arise from or in connection with services performed under this Agreement and from the negligent acts,
omissions and errors of the Vendor, its officers, agents, representatives or employees. The insurance
carriers used must be authorized to conduct business in the State of Illinois and shall have an A.M. Best
rating of not less than A: VII.
Contractor's insurance policies shall contain no exclusions for work performed under the Agreement for
Chicago Housing Authority or Low-Income Housing exposure. Policies must waive subrogation or any
other right of recovery Contractor or its insurer(s) may have against CHA because of payments made for
injuries or damages arising out of your ongoing operations of "your work" done under a contract with
CHA.
Minimum Coverage and Limit Requirements
1. Commercial General Liability: General Liability Insurance on an occurrence basis with limits not less than
$1,000,000 per occurrence with an aggregate of not less than $2,000,000 covering bodily injury and
property damage. This coverage shall also include, but not be limited to, contractual liability, products
and completed operations, personal and advertising injury.
2. Workers' Compensation and Employer's Liability: Coverage must be in accordance with the laws of the
State of Illinois and include a waiver of subrogation in favor of Chicago Housing Authority.
Coverage A - Statutory Limits
Coverage B - Employers Liability - $500,000 bodily injury or disease each accident; each
employee
3. Auto Liability: Required when any vehicles (owned, hired and/or non-owned) are used in connection
with the Services to be performed, coverage limits of not less than $1,000,000 per occurrence combined
single limit for Bodily Injury and Property Damage.
4. Professional Liability: Coverage is required when services are performed by licensed professionals
and/or Scope involves performing any financial, auditing, consulting, design, engineering, surveying,
testing, or other professional services. Professional Liability insurance appropriate to the Contractor's
profession shall provide coverage for the acts, errors, or omissions with a limit of not less than $1,000,000
per claim or occurrence. When policies are renewed or replaced, the policy retroactive date must
coincide with, or precede, the start of Services under the Agreement. A claims-made policy which is not
renewed or replaced must have an extended reporting period of two (2) years following termination of
Agreement.
5. Technology Errors & Omissions (including Cyber Liability): Required when Vendor/Consultant provides
technology services or technology products under this Agreement, insurance appropriate to the
professional services being performed shall provide coverage for the acts, errors, or omissions of
Vendor/Consultant with a limit of not less than $1,000,000 per occurrence or claim and $2,000,000 in
aggregate. Coverage shall be sufficiently broad to respond to the duties and obligations as is undertaken
by the Vendor in this agreement and shall include, but not be limited to, claims involving security breach,
system failure, data recovery, business interruption, cyber extortion, social engineering, infringement of
intellectual property, including but not limited to infringement of copyright, trademark, trade dress,
invasion of privacy violations, information theft, damage to or destruction of electronic information,
release of private information, and alteration of electronic information. The policy shall provide coverage
for breach response costs, regulatory fines and penalties as well as credit monitoring expenses.

CHA ITS SP 91503 Cybersecurity Assessment & Pen Testing
Related Insurance Requirements
The Certificate of Insurance evidencing the minimum coverages required herein shall be in force on the
Effective Date of the Contract and continuously throughout the duration. The required documentation
must be received prior to the commencement of work under this Agreement.
It is understood and agreed to by the parties hereto that Chicago Housing Authority and others listed
below shall be included as Additional Insureds on Vendor's liability policies, with the exception of
Professional Liability and Employer's Liability and such insurance is primary to and will not seek
contribution from any insurance, deductibles, self-insured retentions and/or self-insured programs
available to Chicago Housing Authority.
Certificate Holder: Chicago Housing Authority
60 E Van Buren
Chicago, IL 60605
Additional Insureds: Collectively referred to as the "Additional Insureds" shall include Chicago
Housing Authority, Chicago Housing Administration, LLC; and/or other
Partnership, Limited Liability Company as established by CHA; its respective
commissioners, board members, officers, directors, agents, property
management firms, agents, employees, invitees and visitors.
Primary Coverage: For any claims related to this Agreement, the Vendor's insurance coverage shall
be the primary policy. The Vendor expressly understands and agrees that any
insurance or self-insurance programs maintained by the CHA shall apply in
excess of and shall not contribute with insurance provided by the Vendor.
Prior to the issuing of the Notice to Proceed by the CHA, the Vendor shall submit a Certificate of Insurance
via PINS Advantage Certificate Tracking System, evidencing compliance with the insurance requirements
set forth above. You will receive an email with instructions for the submission of your insurance. Copies
of the endorsement(s) adding the CHA to Vendor's policy as an additional insured are required upon
request. Updated Certificates of Insurance are required for policies which renew during the term of this
Agreement or extensions thereof. Under no circumstances shall the Vendor allow any required coverage
to lapse, cancel or non-renew throughout the duration of the Agreement or extensions thereof.
At the CHA's option, non-compliance will result in (1) all payments due the Vendor being withheld until
the Vendor has complied with the Agreement; or (2) the Vendor will be assessed Five Hundred Dollars
($500.00) for every day of non-compliance; or (3) the Vendor will be immediately removed from the
premises and the Agreement will be terminated for default. The receipt of any certificates does not
constitute agreement by the CHA that the insurance requirements in the Agreement have been fully met
or that the insurance policies indicated on the certificate comply with all Agreement requirements. The
insurance policies shall provide for thirty (30) days prior written notice to be given to the CHA in the
event coverage is substantially changed, canceled or non-renewed.
The Authority in no way warrants that the minimum limits contained herein are sufficient to protect the
Authority from liabilities that might arise out of the performance of the work under this Agreement by
the Vendor or its Subcontractors. The Vendor shall assess its own risks and, if it deems appropriate and/or
prudent, maintain higher limits and/or broader coverages. If the Vendor maintains broader coverage
and/or higher limits than the minimum requirements above, CHA and Additional Insured require and
shall be entitled to same. The Vendor is not relieved of any liability or other obligations assumed or
pursuant to the contract by reason of its failure to obtain or maintain sufficient insurance.

CHA ITS SP 91503 Cybersecurity Assessment & Pen Testing
The Vendor shall require all subcontractors to carry the insurance required and adhere to the same
requirements and conditions as outlined above.
The Vendor expressly understands and agrees that any insurance or self-insurance programs maintained
by the CHA shall apply in excess of and will not contribute with insurance provided by the Vendor and/or
any of its subcontractors.
PART 4 - ADMINISTRATIVE TERMS AND CONDITIONS
* Required CHA Vendor Registration
In order to do business with CHA, Respondent must be a registered vendor prior to submitting
a response. If Respondent has already registered with CHA, the Respondent's (Vendor) profile
must be up to date. Respondent is responsible for contacting their local authorities to ensure
that Respondent has complied with all laws and is authorized and/or licensed to do business
in the Territory. All applicable fees associated therewith are the responsibility of Respondent
now or hereafter in effect during the contract. Respondent and its employees, agents and
subcontractors shall also comply with all Federal, State and local laws regarding business
permits and licenses that may be required to carry out the services performed under the
contract.
* Acceptance Period
All Respondents submitting a quote must agree to honor the terms and conditions contained
herein for a period of one hundred twenty (120) days.
* Quote Signature
The person signing the Quote Form must be a person authorized to bind the Respondent
contractually. Unsigned offers will be rejected. Unsigned offers cannot be signed after the
quote has been received.
* Ownership of Documents
All work products generated, prepared, assembled and provided to CHA pursuant to this RFQ
become the property of CHA upon receipt. Work products include but are not limited to
reports, memoranda, data, survey responses, presentations, and other materials of any
nature, or information related to any of the foregoing, which are or were generated in
connection with the scope of services described in the contract. Respondents shall not
copyright, or cause to be copyrighted, any portion of any document submitted to CHA as a
result of this RFQ.
* Contractor Status
The Contractor shall be an independent Contractor and will not be an employee of CHA.
* Funding Limitations
This procurement may be funded, in whole or in part, by grant funds provided by the U.S.
Department of Housing and Urban Development ("HUD"). CHA will not be bound to any
contract if funding has been disallowed by HUD.
* Taxes
CHA is exempt from sales tax. The Contractor agrees to pay all taxes incurred in the performance
of an awarded contract. Freight, handling costs, and taxes shall not be charged to the CHA.
* Advertising
Respondent agrees not to use the fact of or the results from submission of a quote as a part
of any commercial advertising. CHA does not permit the use of CHA's relationship with an
entity of purposes of marketing efforts unless CHA specifically agrees otherwise.

CHA ITS SP 91503 Cybersecurity Assessment & Pen Testing
* Government Restrictions
In the event any governmental restrictions may be imposed which would necessitate
alteration of the material, quality, workmanship or performance of the goods or the material,
quality, workmanship or performance of the goods or services offered, it shall be the
responsibility of the successful Respondent to immediately notify CHA in writing specifying
the regulation which requires an alteration. CHA reserves the right to accept any such
alteration, including any reasonable price adjustments occasioned thereby, or to cancel the
contract at no expense to CHA.
* Compliance & Law
The Respondent shall comply with all applicable Federal, State and local laws, regulations,
ordinances and requirements applicable to the work described herein including, but not
limited to, those applicable laws, regulations and requirements governing equal employment
opportunity programs, subcontracting with small and minority firms, women's business
enterprise, and labor surplus area firms, equal opportunity for businesses and unemployed
and underemployed persons (as referenced in Section 3 of The Housing and Urban
Development Act of 1968, as amended, 12 U.S.C. 1701u (Section 3), the Americans with
Disabilities Act, Section 504 of the Rehabilitation Act of 1973, the Davis-Bacon Act, and those
laws and regulations concerning the abatement and remediation of asbestos and lead-based
paint, and shall provide for such compliance in the contract documents.
To the extent the work required under this contract is related to development, Respondent
shall further comply with the applicable Annual Contributions Contract (ACC) related to such
development. To the extent such work is related to a mixed finance development,
Respondent shall comply with the provisions of 24 CFR ' 941.208. The Respondent shall
obtain, at Respondent's expense, such permits, certificates and licenses as may be required
in the performance of the work specified.
M/W/DBE and/or
Vendor Name Certification Attached (Y/N)
Section 3 Status
DPC_5-2023