1-IEHP-RFN-06731 RFN Template 7-16-25 Final.pdf

Request for Needs Rev. 07-16-2025 Page 1 of 4

IEHP-RFN-06731

Request for Needs

Application Security Posture Management (ASPM) Issued Date: October 15th

SECTION 1 - PURPOSE

Inland Empire Health Plan (IEHP) is issuing this ‘Request for Needs’ (RFN) document to schedule strategy discussions from interested Suppliers with experience in providing a comprehensive Application Security Posture Management (ASPM) tool designed to enhance the protection of our healthcare web applications and the sensitive patient data they manage. By unifying vulnerability management, enabling continuous monitoring and threat detection, and facilitating risk-based prioritization, this tool aims to strengthen our security posture significantly. It will ensure seamless integration with our DevOps processes, offering an intuitive interface for both the security team and developers, thereby streamlining security workflows. The anticipated ASPM tool will not only help in achieving compliance with stringent healthcare regulations, such as HIPAA and HITRUST but also in minimizing the risks associated with data breaches. Through automating manual security tasks and providing scalable solutions tailored to our evolving needs, we expect to enhance operational efficiency, achieve cost savings, and ensure the long-term protection of patient data against emerging cyber threats.

The intent of these discussions is to gather information and obtain feedback from Suppliers to assist IEHP in developing a more accurate Scope of Work and overall approach for an upcoming Proof of Concept (POC) phase to validate solution fit.

Participation in this RFN is required for Suppliers seeking consideration for contract award. IEHP is committed to a fair, open, and competitive procurement process in accordance with California public contracting laws and internal procurement policies.

SECTION 2 – CONTACT

All questions, inquires, or communications regarding this RFN must be directed to the Contact listed below. Suppliers must not contact any other IEHP employee.

Danielle Burnett Danielle.Burnett@iehp.org

SECTION 3 - FORMAT

IEHP will conduct these informal strategy discussions via a virtual conference call (via Microsoft Teams). The discussions will be performed individually on a “1-on-1” basis between each interested Supplier and IEHP. IEHP anticipates spending about 1-hour on each call. The content and topics of the strategy discussions are provided in Section 7. IEHP is NOT requesting or seeking a formal written response to these questions or topics.

Request for Needs Rev. 07-16-2025 Page 2 of 4

All information will be collected and discussed via the virtual call. There are no minimum or maximum requirements on Supplier personnel that can attend and participate in this meeting. However, IEHP anticipates that the Supplier will have 1-3 personnel that can speak to technical and functional aspects of this project in attendance for this discussion.

The Supplier will bear their own costs associated with this RFN process (IEHP will not reimburse the Supplier). IEHP does not intend to disclose the individual contents of each Supplier discussion, but rather use the information gathered from each discussion to help shape the strategy and path forward on a future POC phase to validate solution fit. However, information provided by a Supplier may be disclosed through the Public Records Act. Therefore, the Supplier should not include information in their response that is proprietary or confidential.

SECTION 4 - KEY DATES

The critical dates for this RFN are shown below. These dates may be changed/adjusted by IEHP if necessary.

Supplier Question Submission Deadline:

10/22/25 2:00 pm PT

RSVP Form Submission Deadline: 11/5/25 2:00 pm PT Virtual Discussions: Week of 11/10/25

SECTION 5 - ALLOTTED TIME SLOTS AND SUBMISSION GUIDELINES:

Suppliers that would like to participate in these strategy discussions must complete and submit Attachment A to RSVP electronically by the deadline stated above. This initial response is not a full proposal. It is intended to confirm interest and basic responsiveness, allowing IEHP to identify qualified suppliers for further engagement.

Following review of initial submissions, IEHP may invite selected suppliers to participate in interviews. Based on interview outcomes, IEHP may downselect suppliers for a limited proof-of-concept (POC) phase. Full proposals may be requested at a later stage, if necessary, prior to final negotiations.

Due to time and resource constraints, IEHP anticipates performing discussions with the first 5 Suppliers that submit an RSVP. IEHP reserves the right to conduct discussions with additional suppliers if necessary. Timeslots will be scheduled on a first-come, first-served basis. Once your time-slot is confirmed, IEHP will provide a link to the conference-call or video-call.

SECTION 6 - PROJECT BACKGROUND

This section provides a brief overview of the outcomes, objectives and expectations of the future state or scope of work of the upcoming project. The information provided in this section is for general background to assist with the strategy discussions.

This document outlines the critical need for an Application Security Posture Management (ASPM) tool to safeguard our healthcare web applications and the sensitive patient data they handle. While existing security measures may be in place, a dedicated ASPM tool offers comprehensive protection and streamlines security workflows, ensuring compliance and mitigating cyber threats.

• Enhanced coverage through all levels

• One stop shop for all application security controls implementation

• Excellent visibility into core secure SDLC shortcomings

• Reporting and fixes

• Detection, Triage and prioritization

• Feature rich comprehensiveness

Request for Needs Rev. 07-16-2025 Page 3 of 4

SECTION 7 - SCRIPT FOR STRATEGY DISCUSSIONS

IEHP intends to discuss the following items during the strategy discussions with each Supplier. Note: A written response is NOT required or requested.

1. What types of applications and environments do you support?

2. How do you discover applications, dependencies, and environments?

3. What integrations do you offer with my existing security tools?

4. How do you handle applications that are in development, pre-production, and production environments?

5. Can you integrate with my CI/CD pipeline to provide security feedback earlier in the development process?

6. How frequently are your integrations updated to maintain compatibility with evolving technologies?

7. How do you identify and prioritize security risks within my application portfolio?

8. What data points do you consider when assessing risk?

9. Can you provide a risk score or rating for each application and/or individual vulnerability?

10. How do you handle known false positives and provide mechanisms for suppression or remediation verification?

11. Do you provide recommendations for remediation or mitigation of identified risks?

12. Can you help us understand the impact of potential vulnerabilities on my business?

13. What type of dashboards and reporting do you offer to visualize our application security posture?

14. Can you generate reports for specific applications, teams, or compliance requirements?

15. Do you offer trend analysis and historical data tracking to monitor improvements over time?

16. Can you export data for use in other systems or for custom reporting?

17. How do you handle sensitive data and ensure compliance with privacy regulations?

18. Do you provide alerts and notifications for critical security events or policy violations?

19. Can you help us define and enforce security policies across my application portfolio?

20. Do you offer pre-built policies for common security standards and compliance frameworks?

21. How do you ensure that security policies are consistently applied across all applications and environments?

22. Can you automate the process of verifying compliance with security policies?

23. Do you provide audit trails and documentation to support compliance audits?

24. How do you handle policy exceptions and provide mechanisms for approval and tracking?

25. How does your solution scale to handle a large and growing application portfolio?

26. What is the performance impact of your solution on my applications and infrastructure?

27. Do you offer different deployment options?

28. What are the resource requirements for running your solution?

29. Do you offer SLAs that guarantee uptime and performance?

30. How do you handle data residency requirements and ensure compliance with local regulations?

31. What level of support do you provide?

32. What is your average response time for support requests?

33. Do you offer training programs to help my team learn how to use your solution?

34. Do you have a dedicated customer success manager to help me achieve my security goals?

35. What documentation and resources are available to help me troubleshoot issues?

36. What is your product roadmap and how do you incorporate customer feedback?

37. What security measures do you have in place to protect my data that is stored in your system?

38. Do you have any third-party security certifications?

39. How do you handle vulnerabilities in your own software?

40. What is your data retention policy?

41. Where is my data stored?

42. What is your pricing model?

43. Are there any hidden costs or add-ons?

44. Do you offer volume discounts?

45. What is the licensing agreement?

46. Can I try your solution before I buy it?

47. What is the total cost of ownership for your solution?

Request for Needs Rev. 07-16-2025 Page 4 of 4

A T T A C H M E N T A S t r a t e g y D i s c u s s i o n R S V P F o r m

Suppliers that would like to participate in strategy discussions must complete and submit this Attachment no later than 2:00 pm PT on Friday, October 31, 2025. Interested Suppliers should RSVP as soon as possible. Time-slots will be scheduled on a first-come, first-served basis. Once your timeslot is confirmed, IEHP will provide a link to the conference-call or video-call.

S U P P L I E R I N F O R M A T I O N

Full Legal Name of Supplier:

Contact Name and Title:

Contact Phone:

Contact Email:

S U P P L I E R I N F O R M A T I O N Please identify the timeslots that your team would be available to participate in strategy discussions with IEHP. Due to the number of Suppliers that may RSVP, please identify all date(s)/time(s) that will work for your team.

DATE TIME AVAILABILITY

□ Yes □ No

□ Yes □ No

□ Yes □ No

□ Yes □ No

□ Yes □ No

Please complete and submit this Attachment to IEHP Contact: Danielle.Burnett@iehp.org mailto:Danielle.Burnett@iehp.org