RFP 2021-05: Information Security 3rd Party Assessment Services

This contract is a three‑year, fixed‑price engagement for a comprehensive information‑security assessment of Covered California’s systems, including CalHEERS, headquarters, and service centers. The work must follow CMS MARS‑E, NIST 800‑53 moderate controls, and FIPS 200, delivering a Security Assessment Report, remediation recommendations, and related documentation. The awardee, Entisys Solutions, will conduct vulnerability scanning, penetration testing, static code review, and incident‑response support, working within California business hours with no overtime or travel reimbursement. The contract value is capped at $950,000, with an option to extend one additional year. • Scope covers full security assessment, SAR, SAP, code review (~2 M LOC), and annual pen‑tests. • Vendor must hold CISSP/CISM/GIAC certification and at least five years of relevant experience; project manager needs ≥ 15 years. • Contract term: Dec 1 2021 – Nov 30 2024, possible one‑year extension; funding approx. $316,667 per year.