Chicago Housing AuthorityIssuing agency·Chicago, IL·via a public procurement portalThe Chicago Housing Authority is seeking qualified cybersecurity firms to evaluate the Chicago Housing Authority’s
(CHA) overall security posture by identifying technical, procedural, and human vulnerabilities across internal and
external systems.
In addition to the execution of this CHA quote form, submissions shall include a separate 3–4-page pdf document
including the firm’s experience & details for project implementation. The selected vendor shall have the minimum
qualifications of:
• U.S based testing personnel and U.S data residency for all collected artifacts.
• 3 or more years of proven experience in penetration testing.
• Certifications strongly preferred: OSCP, OSCE, GPEN, or equivalent
• Minimum of 3 detailed projects from clients (public sector or housing authority engagement
preferred) within the past 36 months.
• Bio & resume of lead tester included with submission
• Sample back-out plan for any testing activity that inadvertently impacts CHA systems or user access.
In coordination with CHA’s internal security staff & offering an objective, third-party perspective, culminates in
actionable recommendations to enhance CHA’s network defense strategy. Assessments are conducted once per
calendar year shall begin promptly following award of the contract. Due to time constraints, base year 1 shall begin
10/19 and services shall be finalized by 12/4. All reports shall be due 12/11. Should CHA choose to exercise any
available option terms, services shall begin in Q3 of that calendar year.
Specific test phases shall be conducted using unauthenticated (non‑credentialed) access and without any
Domain Administrator or other privileged credentials, ensuring the assessment accurately reflects external
adversary capabilities
Project Management Requirements
• Dedicated project manager who will serve as CHA’s primary point of contact.
• Kickoff meeting to define expectations, schedule, communication cadence, and establish technical points of
contact.
• Provide a project schedule including milestones, testing windows, and defined blackout periods.
• Provide source IP ranges to CHA prior to the commencement of any assessment
PROJECT TITLE ITS 91503 Cybersecurity Assessment & Pen Testing
REQUESTING DEPARTMENT / DIVISION Procurement & Contracts / Information Technology
REQUEST ISSUED 10/13/2026
QUOTE DUE DATE AND TIME 10/27/2026 at 1:00 PM CT
PERFORMANCE PERIOD
Initial and Option Periods (if applicable) 1 YEAR BASE TEAM & 2-1 YEAR OPTIONS
PROJECTED CONTRACT START DATE 12/1/2026
CONTACT PERSON NAME/EMAIL Frederica Juste – FJuste@thecha.org
CHA ITS SP 91503 Cybersecurity Assessment & Pen Testing
• Provide regular weekly progress updates, with additional ad hoc briefings when significant issues or
incidents are discovered.
• Final session to review findings and recommendations with CHA stakeholders.
Services include but are not limited to the following areas:
Internet External Vulnerability & Security Testing
Released: 10/13/2026. Due: 10/27/2026. Contact: Frederica Juste.
Responses are submitted through the CHA Supplier Portal (https://supplier.thecha.org); no manual submissions are accepted.
The scope of work includes Internet External Vulnerability & Security Testing (external vulnerability scan, web application security testing of 20 external and 11 internal applications, authentication & authorization controls), Internet Internal Vulnerability & Security Testing (internal vulnerability scan, internal penetration testing, domain security and password audit, domain controller testing, workstation vulnerability assessment, cloud security testing assessment), Wireless Security Testing (comprehensive wireless assessment of CHA’s 802.11 environment), and Advanced Social Engineering & Phishing Exercise (simulate social engineering attack including phishing campaign, vishing, spear phishing, impersonation, tailgating, dumpster diving, USB drops, click baiting, and prepending). The vendor must also provide a back-out and contingency plan, and deliver reporting including an executive summary, summary of findings, proof of exploitation, remediation recommendations, comprehensive reporting, a data handling statement, and a presentation and debrief.
We post new it & software opportunities in Illinois as agencies publish them. Get them in one email — free, and unsubscribe whenever.
Most Illinois work asks for the two below, and the solicitation documents are where it’s stated. One prequalification covers both — on this bid and the next.
A surety’s written statement that it expects to bond you up to a stated amount, subject to final underwriting. It’s what an agency asks to see before they take your bid seriously.
Source: Chicago Housing Authority (solicitation SP-91503), retrieved via a public procurement portal. View the official posting, and always confirm requirements and deadlines with the issuing agency.
