# City of Sebastian MyVendorLink #RFP 26-067-SH

Kissimmee Utility Authority cybersecurity penetration testing and risk assessment services

**Posted:** October 22, 2026
**Respond By:** November 17, 2026
**Identifier:** RFP 26-067-SH
**NAICS:** 541512, 541519

Kissimmee Utility Authority (KUA) is seeking cybersecurity assessment services for its information technology environment.
- **Government buyer:** Kissimmee Utility Authority (KUA), Information Technology Department; Kissimmee, Osceola County, Florida.
- **Scope of services:**
  - Perform internal and external network penetration testing, including black-box and white-box testing.
  - Scan and assess public-facing infrastructure, wired and wireless networks, and internal systems.
  - Analyze cybersecurity risks, identify weaknesses, and prioritize findings.
  - Review existing cybersecurity policies, procedures, and security controls.
  - Deliver executive, technical, and detailed findings reports with remediation recommendations.
  - Conduct a return visit or remote validation testing to verify remediation.
- **Notable requirements:** Align the assessment with NIST Cybersecurity Framework 2.0; coordinate testing with KUA, use approved procedures and authorized testing windows, protect confidential information, and minimize operational disruption. Operational Technology (OT) and SCADA systems are excluded.
- **OEMs and vendors:** No service provider, reseller, or product OEM is named in the opportunity. No products, part numbers, or quantities are specified.

### Description

Kissimmee Utility Authority (KUA) is seeking qualified firms to provide cybersecurity penetration testing, vulnerability scanning, and risk analysis services. Work includes internal and external network penetration testing, black-box and white-box testing, vulnerability assessments, review of security policies and controls, and reports with findings and remediation recommendations. The contractor must coordinate testing with KUA, minimize disruption, protect confidential information, and follow approved procedures and the NIST Cybersecurity Framework 2.0. OT and SCADA systems are excluded, and return or remote validation testing is required to verify remediation.

[View original listing](https://www.myvendorlink.com/external/biddetails)