Description
The State of Colorado is seeking a qualified vendor to perform a SOC 1 Type II readiness assessment and subsequent audit for its CBMS and PEAK systems. The engagement covers a readiness assessment (RA) to be completed before the audit period, followed by a full SOC 1 Type II examination covering the fiscal year July 1 2026 – June 30 2027. The scope is limited to the CBMS and PEAK applications, with a Salesforce front‑end, AWS backend, and Oracle database, and includes sub‑service organizations (AWS, Salesforce) using a carve‑out or inclusive method at the vendor’s discretion. The state expects a single SOC 1 report, with optional post‑audit support and a potential five‑year contract (one mandatory year plus up to four option years). The maximum contract value may not exceed $350,000.
• Scope: SOC 1 Type II readiness assessment + audit for CBMS & PEAK only
• Duration: FY26 (July 1 2026 – June 30 2027) – roughly 1 year
• Contract ceiling: $350,000 USD (maximum)
• Deliverables: RA report, SOC 1 Type II audit report, draft/final report cycles, post‑audit support methodology
• Sub‑service orgs: AWS, Salesforce (carve‑out or inclusive)
• Reporting schedule: kickoff mid‑June, fieldwork July‑August, draft September, final October (per Office of the State Auditor)
• Optional: multi‑year pricing, up to four additional option years
• Vendor responsibilities: perform RA, conduct audit, provide remediation recommendations (no remediation work), maintain key personnel, comply with any background‑check/security requirements.
Attached files
Contact
Michael Whalen(Buyer)