Awarded vendors
- Deloitte & Touche LLP
Description
The contract is a three‑year, fixed‑price effort to build a comprehensive incident‑response and recovery capability for Covered California. The awardee will design, document, test, and maintain policies, procedures, playbooks, training, and governance structures covering environmental, cyber‑security, and technology‑availability incidents across all 19 business divisions (≈1,500 users). The contractor must update existing Business Continuity Plans and Technology Response Plans, completely rewrite the Security Response Plan, develop RACI matrices, expand incident‑response literacy, and provide ongoing support. The solicitation caps total contract value at $2.9 M, with annual funding limits of $0.9 M (Year 1) and $1.0 M (Years 2‑3). Proposals were due August 8 2024, with proposer interviews August 26‑28 2024, and the intent‑to‑award announced September 20 2024. No amendment options or renewal clauses are included.
• Scope: Full‑enterprise incident‑management program (environmental, cyber, IT) for 19 divisions.
• Deliverables: Updated BCPs/TRPs, rewritten SRP, RACI matrices, training, testing/exercises, ongoing support.
• Financials: Max $2.9 M total; fixed‑price, no overtime reimbursement.
• Timeline: Performance period Oct 1 2024 – Sep 30 2027.