Acceptable Risk Controls for ARC-AMPE 3rd Party Attestation

The State of Idaho Department of Health is seeking a vendor to perform third-party attestation and web application testing for the Acceptable Risk Controls for Affordable Care Act, Medicaid, and Partner Entities (ARC-AMPE) program. The vendor will be responsible for testing five specific web applications, which handle sensitive data including PII, PHI, and FTI. The testing will be conducted using a Grey Box approach and will include vulnerability and penetration testing. The vendor will be required to provide a fully burdened rate for the entire year of services and will be expected to work with the Department to develop a work plan and budget for any additional services required. • The vendor must have prior experience with ARC-AMPE attestation, but does not need to be certified or authorized by CMS or any federal body. • The vendor will be provided with test credentials, staging environments, and sandbox access for the five web applications. • The vendor will be required to provide a narrative description of their prior experience with ARC-AMPE or MARS-E attestation. • The vendor will be required to provide named resumes for key personnel. • The vendor will be expected to emulate a siloed pen test approach and will not be permitted to conduct destructive tests. • The vendor will be required to provide deliverables including attestation letters, Letters of Assessment, and auditor-ready appendices.