Security Configuration & Compliance Testing

The contract requires the implementation and documentation of security controls aligned with IRS Publication 1075 and HIPAA regulations to ensure the protection of sensitive federal and health information. This includes conducting comprehensive vulnerability assessments and penetration testing to identify and remediate security weaknesses, as well as developing and maintaining audit-ready security documentation that demonstrates ongoing compliance and control effectiveness. The work must be performed to support an environment subject to strict federal data privacy and security mandates, with all deliverables designed to withstand rigorous external audits. This is a subcontract under NAICS code 541690, posted on July 28, 2026, with a response deadline of August 31, 2026. The place of performance is designated as Other, and the contracting entity is the Kentucky office of the Personnel-Office of Secretary. The solicitation is managed through the Kentucky Virtual State System, and all proposers must ensure their submissions meet the technical and compliance requirements specified, focusing on actionable security implementation and documentation rather than advisory services.