RFP 2018-04 Information Security Third Party Assessment Solicitation

This contract awards a two‑year, time‑and‑material engagement to perform a comprehensive information‑security third‑party assessment for Covered California, focusing on the CalHEERS system, headquarters, and service centers, and aligning with CMS MARS‑E, NIST SP 800‑53 (moderate baseline), and FIPS 200 standards. The vendor must conduct vulnerability assessments, penetration testing, web‑application testing, wireless assessments, configuration reviews, forensic copying, and produce a Security Assessment Report (SAR) with required deliverables. The contract is capped at $802,000 total, with a maximum of $465,000 invoicable in the first year and $337,000 in the second year, and includes a potential one‑year extension. • Scope includes external/internal network testing, web‑app penetration testing (three URLs), wireless network assessment (2‑6 controllers), and risk assessment. • Vendor must meet stringent personnel qualifications (CISSP/CISM/GIAC/SANS certifications, ≥5 years relevant experience; project manager ≥15 years). • No travel reimbursement; all work must be completed before invoicing, and payment is contingent on acceptance of deliverables.