Red and Purple Team Security Services

The vendor is required to provide red and purple team security services as part of agency comprehensive cyber security program.
- Security posture by ensuring a systematic and continuous program is in place to identify and assess security vulnerabilities, uncover gaps, test assumptions, exercise response plans, explore alternative attack scenarios, and reveal limitations and risks within agency security operations.
- Red team activities
•    Internal and external vulnerability scans 
•    Penetration tests to discover weaknesses, identify threats, uncover vulnerabilities, perform Analysis, and recommend countermeasures 
•    Attack simulations, including vulnerability assessments and penetration tests, against agency security posture while remaining undetected by the security incident response team
- Purple team activities
•    Facilitating cross-training sessions to share knowledge and skills
•    Analyzing the root causes of simulated breaches
•    Running attack scenario workshops to refine incident response plans
•    Launching controlled cyber-attacks to validate the effectiveness of security controls, identify vulnerabilities, and recommend improvements
- Tasks
1. Red team services
•    Internal and external penetration testing
•    Social engineering
•    Physical security testing
•    Wireless network testing
•    Web application testing
•    Network exploitation
•    Malware deployment
•    Attack simulations
•    Advanced persistent threat (APT) simulations
•    Insider threat simulations
•    Cloud security assessments
•    Threat intelligence integration
•    Red team reporting and metrics
•    Zero-day exploit testing
2. Purple team services
•    Collaborative attack simulations 
•    Cross-training sessions 
•    Root cause analysis
•    Attack scenario workshops 
•    Vulnerability exploitation 
•    Security control validation 
•    Breach and attack simulation (BAS)
•    Detection and response enhancement 
•    Threat hunting exercises 
•    Security metrics and reporting 
•    Continuous improvement workshops
3. Tabletop exercising
•    Scenario development facilitation
•    Role assignment
•    Discussion and analysis
•    Documentation
•    Reporting
•    Post-incident review sessions.

- Contract Period/Term: 7 years
- Questions/Inquires Deadline: September 24, 2025