RFP 2026-01 Information Security Services

Covered California is seeking a qualified contractor to provide a comprehensive suite of information‑security services and act as the independent assessor for its health‑exchange environment (including CalHEERS). The effort covers governance, risk & compliance, security architecture, incident response, third‑party risk management, technical security advisory, threat detection, data‑protection, independent ARC‑AMPE/NIST assessments, penetration testing, and digital forensics over a five‑year base term with optional extensions. The contractor must staff at least three full‑time security professionals (one designated manager), meet stringent background‑clearance requirements, and comply with California and federal security regulations. The contract’s maximum base‑term value is $12.5 M (≈ $2.5 M per year), with a possible ceiling of $17.5 M if extensions are exercised. Preference incentives are available for small‑business and DVBE firms. • Deliver governance, risk, and compliance support aligned with ARC‑AMPE, IRS Pub 1075, and NIST SP 800‑53 rev 5. • Provide security architecture design, incident‑response management, third‑party risk assessments, and ongoing technical advisory across cloud and on‑prem environments. • Conduct annual independent security/privacy assessments, penetration testing, and digital forensics, with all deliverables subject to Covered California acceptance.