RFP 2026-01 Information Security Services

Covered California seeks a qualified contractor to act as an extension of its Information Security Office, delivering full‑time and project‑based security services over a five‑year period. The work includes providing security professionals, conducting penetration testing and independent risk/compliance assessments for CalHEERS and agency systems, and aligning all activities with CMS ARC‑AMPE controls based on the NIST SP 800‑53 moderate baseline. The contractor must operate independently of internal staff, support future privacy/security requirements, and not have provided IT services to Covered California or CalHEERS in the prior two years. • Provide ongoing information‑security staffing reporting to the CISO. • Perform penetration testing, risk assessments, and compliance reviews for health‑care eligibility systems. • Align deliverables with ARC‑AMPE and NIST SP 800‑53 moderate‑baseline controls.