Organizational Continuity and Resiliency Portfolio (OCRP) Limited Penetration Test Engagement

The Port of Seattle is seeking a qualified consultant for the Organizational Continuity and Resiliency Portfolio (OCRP) Limited Penetration Test Engagement. The project involves performing penetration testing and Red Team testing across prioritized environments to validate alerting, logging, monitoring, and incident response workflows. All activities must align with industry standards, specifically NIST SP 800-115, MITRE ATT&CK, and the OWASP Top 10 for Web Applications and APIs. The engagement is expected to last six months with a total not-to-exceed fee of 75,000 dollars. Work will be performed primarily remotely, though on-site access is available as needed. A critical requirement is that all testing must be conducted from within the United States and all data must remain in the US. The consultant must provide staff with at least three years of experience in their area of expertise and obtain Port approval for all tools and techniques used. Selection is based on a best-value determination, prioritizing specialized experience and technical expertise. Deliverables are subject to a strict quality assurance process, with a target of achieving Port approval within two review cycles.