26-0220687.CDT.Bugcrowd

The State of California’s Department of Technology is seeking a renewal of its Bugcrowd vulnerability‑disclosure platform on a fixed‑price SaaS basis. The contract covers the provision of a crowd‑control and triage engine, a “Professional” Vulnerability Disclosure Program (VDP), a reward‑pool administration, platform licensing for up to 12 months, ongoing support, and a required secondary backup site. Bids must be submitted in two separate emails (RFQ response and cost worksheet) by the deadline, and the award will be made to the lowest responsive bidder after applying any small‑business, DVBE, or TACPA preferences. • Provides a cloud‑based bug‑bounty platform with automated triage, validation, and reward‑pool management. • Includes full‑service VDP support, platform access, and 24/7 support for the contract period (through 13 June 2027). • Requires a secondary backup site ≥ 250 miles from the primary production site and compliance with numerous state‑wide non‑discrimination, security, and reporting mandates.