13-IEHP-RFP-25-06890 Application Control and Endpoint Security Software Solution Final POSTED.pdf

Request for Proposal Rev. 09-24-2025

Request for Proposal #25-06890

Application Identification and Access Control Solution

10801 6th Street Rancho Cucamonga, CA 91730

This RFP and any ensuing Addenda are available at the following link:

http://iehp.bonfirehub.com

NOTE: BIDDERS ARE RESPONSIBLE TO READ ALL INFORMATION THAT IS STATED IN THIS

REQUEST FOR PROPOSAL AND PROVIDE A RESPONSE AS REQUIRED

http://iehp.bonfirehub.com/

Timeline

1. The following timeline is based on IEHP’s requirements and will be strictly adhered to unless modified by written addendum:

Date: Description:

02/26/2026 RFP release date 03/10/2026 Bidder Questions Due (2:00 p.m. PT) 03/26/2026 Bidder’s Proposals Due (2:00 p.m. PT) April-May 2026 (if applicable)

Bidder Demonstrations

IEHP anticipates holding Bidder Presentations/Demonstrations in April-May 2026, as indicated in the RFP Timeline above. IEHP may choose to hold presentations/demonstrations with all, some or no Bidders, at its sole discretion, pursuant to this RFP.

2. The period of performance anticipated for this RFP shall be for an initial term of one

(1) year. This RFP does not commit IEHP to award a contract, and there is no obligation by IEHP to purchase any specified amount of goods or services. IEHP will award a contract, if any, in its best interest and based on a proposal that best meets its needs as set forth herein.

3. IEHP reserves the right to award to multiple Bidders, based on IEHP’s needs, at IEHP’s sole discretion.

TABLE OF CONTENTS

A. SOLICITATION INTRODUCTION

1. Background of IEHP

2. Key Principles

3. Primary Goals

4. Program Objectives

5. Key Selection Criteria

6. Program Outcomes

7. Target Population/Historical Information

B. PROPOSAL COMPONENTS

Instructions Proposal Guidelines Bidder Acknowledgements Required Documents Required Data Company Profile Company Evaluation Criteria Scope of Services Demonstration Cost Proposal/Pricing Narrative Security Questionnaires Exhibit A: RFP Bidder Terms and Conditions Exhibit B: IEHP Standard Contract Terms Exhibit C: IT Security Documents

A. Solicitation Introduction

1. Background of IEHP

Inland Empire Health Plan (IEHP) is a local public entity of the State of California and is a rapidly growing Medi-Cal and IEHP DualChoice (HMO D-SNP [Dual Eligible Special Needs Plans]) health plan in California. Since September of 1996, IEHP has consistently focused on our mission: “We heal and inspire the human spirit”. As a result of the Healthcare Reform and participation in the California Coordinated Care Initiatives, IEHP grew to over 1 million members. With a provider network of over 7,500 providers and more than 3,200 employees, we now serve more than 1.4million residents of the Riverside and San Bernardino counties who are enrolled in Medi-Cal, D-SNP, or Covered California.

IEHP’s Membership totals as of February 2026 are listed in the table below:

Line of Business Member Count Medi-Cal 1,385,423

D-SNP 38,721

Covered California 31,767 Total Membership 1,455,911

2. Key Principles

This RFP contains a list of requirements for an Application Identification and Access Control Solution on behalf of IEHP. IEHP’s Procurement Department is soliciting responses from qualified vendors to address the stated requirements of this RFP. A “Qualified Bidder”, for the purpose of this RFP, is one that can reliably and independently provide the required services to IEHP for the entire term of the agreement.

3. Primary Goals

The primary goal is to contract with a vendor to implement an enterprise-wide application to prevent unauthorized application installation and execution, reduce malware and ransomware risk, and enforce granular control over application behavior and user privileges. The solution must integrate seamlessly with existing ecosystem.

4. Program Objectives

The objectives of contracting with a vendor for an Application Identification and Access Control Solution are to strengthen IEHP’s security posture and ensure comprehensive control, visibility, and governance across all endpoints.

• Enforce deny-by-default application execution policies across all endpoints.

• Automate discovery, profiling, and allowlisting of applications.

• Provide monthly scanning and reporting of application inventory.

• Detect and manage unauthorized plug-ins and extensions across:

• Browsers (Chrome, Edge, Firefox)

• IDEs (Visual Studio, RStudio, Python IDEs)

• Kubernetes and Tanzu environments

• Enable granular control of applications and extensions.

• Provide centralized policy management with real-time propagation.

• Ensure minimal disruption to end users and IT operations.

• Integrate with existing security tools (Microsoft Intune, Defender for Endpoint, Entra ID, and Purview) and automated workflows.

• Ensure compliance with HIPAA, NIST 800-171/800-53, CMS, and DHCS security requirements.

5. Key Selection Criteria

At the discretion of the Evaluation Team, 65 points will be allocated between the scope and company scores, 30 points will be assigned to price, and 5 points will be given for local preference. If demos are held, an additional 10 points will be allocated to demo scores. IEHP reserves the right, at its sole discretion, to award the contract to the responsive, responsible Bidder whose Proposal is most advantageous to IEHP;

price, delivery, and other factors considered. Additional information on evaluation criteria can be found in Exhibit A (RFP Bidder Terms and Conditions).

6. Program Outcomes

The outcome expectation of the successful solution includes deny-by-default application execution, full visibility into unauthorized software and plug-ins, centralized policy management, and monthly scanning and reporting of installed applications and components.

7. FDR Status – NO

The services outlined in this RFP are classified as non-delegated administrative or healthcare services. The contractor will not be recognized as a first-tier, downstream, and related entity (FDR) vendor, and therefore is not subject to the associated requirements. However, if the status changes, as determined by IEHP, the contractor will be required to comply with all relevant FDR requirements.

8. Piggyback Provision

Other public agencies, municipalities, and government entities within the State of California may, at their discretion and with the awarded vendor’s consent, utilize this Request for Proposal (RFP) and any resulting agreement. Any such use shall be arranged directly between the vendor and the participating entity, independent of IEHP. IEHP does not assume any responsibility or liability for contracts entered into by other entities under this provision.

B. Proposal Guidelines

Instructions:

9. This document is provided to Bidders as a reference. Bidders are not required to enter answers to Bidder questions in this document. All required questions will be found under the associated solicitation number on the Bonfire website at http://iehp.bonfirehub.com.

a. All requested documents from each section shall be uploaded to their corresponding document slot at http://iehp.bonfirehub.com.

b. All questions from each section shall be answered by Bidders in the corresponding questionnaire and/or bid table located at

10. Follow the instructions in each section of this RFP.

11. All Proposals must include a detailed description of each proposed service to be provided.

12. Responses that do not comply with submission instructions may be delayed or not accepted for review.

13. Bidders that do not follow the bid instructions found in the Bidder Terms and Conditions document, attached hereto as Exhibit A, may be found to be “non-responsive” and disqualified from the bid process, at the sole discretion of IEHP.

14. A duly authorized officer of the organization must sign your RFP response.

15. IEHP reserves the right to modify or terminate the RFP process at any time. IEHP may amend or modify the project scope of services prior to the award of contract, as necessity may dictate, reject any and all proposals submitted (and rebid, if necessary), accept any or all proposals submitted, negotiate with any qualified source, or cancel, in part or in its entirety, this RFP if it is in the best interest of IEHP.

16. IEHP may keep submissions and negotiations confidential until the Governing Board approves the final contract and/or a contract is issued. Proposals may contain financial statements or other information which constitute a trade secret. In order to protect such data from disclosure, please identify the pages by clearly marking the applicable pages as confidential.

17. Upon receipt of this RFP, recipients are expected to read and understand the service priorities and requirements that have been defined by IEHP. Opportunity will be given to ask questions and receive clarification. The character and operating principles of the successful vendor are important to IEHP. The following sections ask questions about the history and purpose of the vendor’s company. Please answer the specific questions. If additional information would be informative to IEHP, please add it to the http://iehp.bonfirehub.com/ https://iehp.bonfirehub.com/ last question in each question set.

18. Each proposal will be reviewed by IEHP’s Procurement team to determine if the proposal is responsive to the submission requirements outlined in the RFP. A responsive proposal, for the purpose of this RFP, is one which follows the requirements of this RFP, includes all documentation, is submitted in the format specified in this RFP document, is submitted on time, and has the appropriate signatures required on each document. Failure to comply with these requirements may result in the proposal being deemed non-responsive and, therefore, rejected, at the sole discretion of IEHP.

19. An Evaluation Committee comprised of IEHP stakeholders will review each bidder’s responses to the questions contained in this RFP. If the respondent cannot represent and warrant the business requirements listed herein, the proposal may be rejected, at the sole discretion of IEHP.

20. The Evaluation Committee will review, evaluate, and score the proposals. The best response(s) may be recommended for another round of evaluation at IEHP’s sole discretion. IEHP reserves the right to conduct as many rounds of evaluations as it deems to be reasonable or necessary in the public interest. Each round of evaluation may result in modification of scores, further clarification or addenda being issued, and changes in the RFP process.

21. Upon evaluation of the criteria and the rating and ranking, the Evaluation Committee may choose to conduct an oral presentation/demonstration with any bidder(s). Upon completion of the oral presentations/demonstrations, the Evaluation Committee members may re-evaluate, re-score and/or re-rank the proposals remaining in consideration.

22. The price proposal will be evaluated relative to the combination of the technical proposal, including an evaluation of how well it matches the bidder’s understanding of IEHP’s needs described in this Solicitation, the bidder’s assumptions, and the value of the proposed solution and/or services. The pricing evaluation is used as part of the evaluation process to determine the bidder that will provide the best overall value to

IEHP.

23. IEHP may direct negotiations with its first-choice bidder, negotiations with multiple

Bidders, and/or may request for best and final offers. The discussions may include price and conditions attendant to price. This RFP includes IEHP’s standard, required contract terms, attached hereto as Exhibit B, which IEHP expects to be incorporated into a final contract form together with other terms and conditions. Failure to accept IEHP’s standard terms may result in the Bidder being removed from consideration.

24. Notwithstanding the foregoing, if IEHP believes IEHP and the said bidder(s) cannot reach agreement on a contract, IEHP shall exercise its right to terminate or suspend negotiations and may begin negotiations with the other bidder(s). This process may continue until a contract acceptable to IEHP has been executed or all proposals are rejected. No bidder shall have any rights against the IEHP arising from such negotiations or termination thereof.

25. A Bidder’s protest of any IEHP decision to eliminate the Bidder from further consideration for an award, or to award a contract to another Bidder, shall be made in writing and submitted to IEHP by 5:00 p.m. on the fifth (5th) day following notice to the Bidder or award of the contract, whichever occurs first. The written protest shall be submitted to procurement@iehp.org The written protest shall fully describe each and every basis for protest and shall describe the manner in which IEHP failed to act within its discretion or abused its discretion. For avoidance of doubt, IEHP’s intent is to reserve its discretion under this RFP to maximum amount allowed by law, and this RFP shall be construed in favor of reserving IEHP’s discretion in all circumstances. Failure to timely and completely submit a protest shall constitute a final and conclusive waiver of any and all rights to bring a legal action to challenge an award of a contract pursuant to this RFP. IEHP will not consider untimely protests or protests where the Bidder failed to timely object pursuant to Section 1 of the Bidder Acknowledgements below. All Bidders expressly acknowledge that IEHP may proceed with awarding and implementing a contract pursuant to this RFP while any protest, or legal action related to a protest, is pending.

1. Clarifications, Exceptions, or Deviations

a. All Bidders shall describe any exception or deviation from the requirements of the RFP in Question Set 1 of Questionnaire Q-25IW. Each clarification, exception, or deviation must be clearly identified. If your firm has no clarifications, exceptions, or deviations, a statement to that effect shall be included. IEHP’s standard contract terms are discussed in the RFP Bidder Terms and Conditions document incorporated herein by this reference, and attached hereto as Exhibit A.

b. Any objection by a Bidder to the prescribed procedures, terms, conditions or requirements set forth in this RFP or any of its component documents must be submitted to IEHP as part of, or contemporaneously, with the Bidder’s proposal. Failure to timely submit an objection, or failure to submit a proposal, shall constitute a final and conclusive waiver of any and all rights to thereafter such objection for any purpose including, without limitation, any protest or legal action to challenge an award of a contract pursuant to this

RFP.

c. All Bidders must specify any additional documents that IEHP will need to sign along with the standard Agreement (e.g., appendices, requirements documents, third-party agreements, service level agreements, compliance certifications, etc.) in Question Set 1 of Questionnaire Q-25IW. These documents must also be uploaded to the “Bidder Attachments” document slot.

d. All Bidders must specify any additional costs that IEHP will be required to pay outside of the standard agreement (e.g., third-party fees) in Question Set 1 of Questionnaire Q-25IW. These costs should also be included in Bid Table BT-

02-GR.

2. Evidence of Insurability/Business Licenses

All Bidders shall submit evidence of all required insurance in the corresponding document slot on the Bonfire website. An Acord cover page will suffice and if awarded the contract the bidder has ten (10) calendar days to produce the required insurances, including a certified endorsement naming IEHP as additionally insured.

The bidder shall certify to the possession of any and all current required licenses or certifications. Do not purchase additional insurance until this bid has been awarded.

Provide a copy of current business license or other applicable licenses. Failure to provide the required document may be grounds for disqualification of bidder from the RFP process, at IEHP's discretion.

3. IEHP General Compliance Requirements for Contractors

If the services provided pursuant to this RFP are designated as delegated administrative or healthcare services, the contractor will be considered a First-Tier, Bidder Acknowledgements

Downstream, and Related Entity (FDR) vendor. IEHP will require all temporary FDR staff and contractors to participate in General Compliance Training as required by State and Federal regulations. The training is followed by a quiz designed to check the bidder’s knowledge about compliance topics. This is a mandatory training which includes the following objectives: understand the purpose of a Compliance Program and its functions; learn the 7 Elements of an Effective Compliance Program; and learn about IEHP’s Fraud, Waste and Abuse and HIPAA Programs, including reporting requirements and how to report suspected non-compliance.

4. IEHP Background Check Requirements for Bidders

IEHP may require all individuals assigned to provide services to IEHP pursuant to this RFP, to undergo a background check prior to commencement of performance, at the Contractor’s expense, to include any and all background checks required by law.

5. Out of Country Services Notice

a. IEHP will only consider service offerings within the continental United States, defined as the 49 States including Alaska and the District of Columbia: excluding Hawaii.

b. Proposed solutions that create, transmit, receive and/or maintain IEHP data must always reside within the United States.

c. IEHP’s data must always remain in the United States.

d. All persons, electronic processes, information systems, and computer devices accessing IEHP’s information systems and/or data in any capacity as part of the proposed solution must be physically located in the United States.

6. Executive Order N-6-22 – Russia Sanctions

On March 4, 2022, California Governor Gavin Newsom issued Executive Order N-6- 22 (the EO) regarding Economic Sanctions against Russia and Russian entities and individuals. “Economic Sanctions” refers to sanctions imposed by the U.S.

government in response to Russia’s actions in Ukraine, as well as any sanctions imposed under state law. The EO directs all California state agencies and departments to terminate contracts with, and to refrain from entering any new contracts with, individuals or entities that are determined to be a target of Economic Sanctions. All contractors and grantees are obligated to comply with the Economic Sanctions. Accordingly, should the State of California (the State) or IEHP determine Contractor is a target of Economic Sanctions or is conducting prohibited transactions with sanctioned individuals or entities, that shall be grounds for termination of this Agreement. Contractor shall be provided with advance written notice of such termination, allowing Contractor at least thirty (30) calendar days to provide a written response. Termination shall be at the sole discretion of the State or

IEHP.

All required documents listed below shall be uploaded to their corresponding document slot in the Requested Information section at http://iehp.bonfirehub.com.

Note: Failure to provide the required documents listed below at time of bid may be grounds for disqualification of bidder from the RFP process, at IEHP's sole discretion.

1. Principal Certification Binding Bidder’s Response (IEHP-provided form)

2. Certification of Non-Debarment (IEHP-provided form)

3. Non-Collusion Declaration (IEHP-provided form)

4. Local Preference Affidavit (If applicable – IEHP-provided form)

5. Contractor’s Certificate Regarding Workers’ Compensation (IEHP-Provided form)

6. Acknowledgment of Non-Negotiable Contract Terms (IEHP-Provided form)

7. Company W-9 Form listing company’s Tax Identification Number (TIN)

8. Evidence of Insurability (ACORD Certificate of Insurance)

9. Business License(s)

10. Proof of Registration: Documentation verifying corporate registration with the

California Secretary of State or if not a corporation, proof of tax registration with the California Franchise Tax Board.

11. Company Hierarchy/Organizational Chart

12. Credentials/Certifications/Licenses Document

13. Account Management Narrative

14. List of three (3) contracts of similar value awarded to your company in the past three

(3) years. Include the year, type of services, dollar amounts, services provided, location, contracting company, contact name, and phone number.

15. Policy and Procedures document detailing Bidder’s background checking procedures and the name of any external company utilized to perform this service.

16. Pricing Narrative

17. Redacted Pricing Narrative

18. IEHP Security Risk Assessment

19. Data Sharing Assessment

20. Vendor Security Documents Checklist

21. Bidder’s Security Documents

22. Sample Standard Reports

23. Sample Proposed Document

24. Annual Report for publicly traded companies, or if privately held, details of financial stability.

25. Bidder’s Standard Agreement Template, including detailed pricing and Scope of

Work (for consideration). If not available, include a detailed proposal on Bidder’s letterhead including detailed pricing and Scope of Work (for consideration).

26. References (Questionnaire Q-17JR)

27. Cost Proposal (Bid Table BT-02GR)

28. Company Profile and Evaluation Criteria (Questionnaire Q-25IW)

29. Bidder Response Questions (Questionnaire Q-89TY)

30. Pre-Recorded Demo

Required Documents

All required data listed below shall be answered in the Requested Information section at

Note: Failure to provide the required data listed below at time of bid may be grounds for disqualification of bidder from the RFP process, at IEHP's sole discretion.

1. IEHP is a public agency with a Board of Directors composed of elected officials and public members. The elected officials are restricted from voting on any action concerning a contract whose owners have made a campaign contribution of $250 or more in the previous 12 months. To assist them in their decision-making process, please indicate the owners of the company, and if any contributions were made to the Elected Officials.

2. In accordance with 42 C.F.R. 438.610, 422.503 (b)(4)(vi)(F), 423.504 (b)(4)(vi)(F) and California Welfare and Institutions Code, §§ 14043.6 and 14123, IEHP is prohibited from employing, contracting, or issuing payments to an individual or entity that is excluded, ineligible, or terminated from participation in State and Federal health care programs. Contract awards are contingent upon the bidder, its principals’ and subcontractors’, eligibility to participate in State and Federal health care programs.

Bidders must certify that it or any of its subcontractors do not appear on State and Federal exclusionary lists in the Requested Data section of their response on Bonfire.

3. Bidder’s DUNS Number

Required Data

Company Profile

This section of the proposal is designed to establish the Bidder as an entity with the ability and experience to operate the program or provide goods and/or services as specified in the RFP. The Company Profile should be concise and clear, including descriptive information regarding service delivery. All Bidders shall answer these questions in Question Set 2 of Questionnaire Q-25IW, unless specifically stated otherwise below. Questions that also require the upload of a (Required Document) to the associated document slot are noted.

Questions that require an answer in the form of (Required Data) are also noted.

2.1 Company Name and Corporate Structure:

2.1.1 Business name and legal business status (i.e., partnership, corporation, etc.).

2.2 Company overview related to RFP services or activities performed, including:

2.2.1 Company hierarchy (President, Vice President, Company Officers, etc.) and an organizational chart. The organizational chart shall clearly identify all staff members that will provide services under this contract. Upload this document to the corresponding document slot on Bonfire. (Required Document)

2.2.2 Number of years in business under the present business name, as well as prior business names, and the number of years of experience providing the proposed, equivalent, or related services.

2.2.3 Location of the office from which the work under this contract will be provided, and the staff allocation at that office.

2.3 Provision of Services:

2.3.1 Please provide a detailed response discussing how Bidder plans on providing the services requested in this RFP; specifically, whether services will be provided by Bidder’s own forces, subcontractors.

2.4 Financial Interests:

2.4.1 Please indicate whether the Bidder holds controlling or interests in any other organization or is owned or controlled by any other person or organization. If none, please state N/A. Governmental agencies are exempt from this requirement.

2.4.2 Provide any financial interests in any other business. Individuals who are personally performing the contracted services and governmental agencies are exempt from this requirement.

2.4.3 Please indicate if the Bidder is privately or publicly held. If private, please provide details of financial stability. If public, please provide ticker symbol and copy of your most recent annual report.

2.5 Company Structure/Staffing:

2.5.1 Please describe any organizational changes (mergers, acquisitions, divestitures) that have occurred in the past five (5) years.

2.5.2 Please indicate whether Bidder has organizational changes (mergers, acquisitions, divestitures) planned within the next five (5) years.

2.5.3 Please indicate whether Bidder has any layoffs, or personnel expansions planned within the next five (5) years.

2.6 Legal:

2.6.1 Provide a detailed explanation of any litigation involving the Bidder or any principal officers thereof in connection with any contract within the last five (5) years. Is your firm, or the principals corresponding with your firm, under investigation, being sued, suing, or affiliated in any lawsuit or alternative dispute resolution with any governmental agency? If none, state N/A.

2.6.2 Has your company ever been or are you currently subject to any federal or state regulatory enforcement action including but not limited to exclusion and/or suspension from participation in a federal program?

2.6.3 List the officers of your organization who are authorized to negotiate the agreement with IEHP if awarded, and their positions within your organization.

2.6.4 Provide details of any failure or refusal to complete a contract. If none, that must be stated.

2.6.5 Has your company ever been or are you currently subject to any federal or state regulatory enforcement action including but not limited to exclusion and/or suspension from participation in a federal program?

2.6.6 State whether your company, or the principals corresponding with your company, are under investigation, being sued, suing, or affiliated in any lawsuit or alternative dispute resolution with any governmental agency. If so, please provide details.

2.7 Certification of Non-Debarment: (Required Document)

2.7.1 IEHP receives Federal and State funds. All Bidders must sign and submit the Certification of Non-Debarment document provided by IEHP in Bonfire that verifies that the bidder is not listed on any of the exclusion lists notated in the section below.

If awarded a contract, awarded vendor must notify IEHP immediately if debarred at any time during the contract period.

a. The Department of Health & Human Services (DHHS), Office of Inspector General (OIG), and List of Excluded Individuals and Entities (LEIE). Please visit https://exclusions.oig.hhs.gov.

b. General Services Administration (GSA), and the System for Award Management (SAM.gov). Please visit https://www.sam.gov.

c. California Department of Health Care Services (DHCS), and Medi-Cal Suspended and Ineligible Provider List (S&I List). Please visit https://mcweb.apps.prd.cammis.medi-cal.ca.gov/references/sandi.

d. Medicare Opt-Out List. Please visit https://data.cms.gov/tools/provider-opt-out-affidavits-look-up-tool.

2.8 Financial Stability:

2.8.1 Please detail your insurance coverage, including the name of the carrier and coverage level for General Liability.

2.8.2 Please detail your insurance coverage, including the name of the carrier and coverage level for Tech Errors & Omissions (E&O).

2.8.3 Please detail your insurance coverage, including the name of the carrier and coverage level for Cyber Crime Insurance

2.8.4 Please provide your revenue for last five (5) fiscal years.

2.8.5 Please provide your profit/(loss) for last five (5) fiscal years.

2.8.6 Please provide your company ratings (i.e., A.M. Best, Better Business Bureau, etc.).

2.8.7 Please provide your annual R&D budget for the last five (5) fiscal years (break out by product offerings).

2.8.8 Explain how your company is planning to meet the increase in demand for your product (including implementation, training, and support) over the next five (5) years.

2.9 Eligibility to Participate in Federal and State Health Care Programs (Required Data)

2.9.1 In accordance with 42 C.F.R. 438.610, 422.503 (b)(4)(vi)(F), 423.504 (b)(4)(vi)(F) and California Welfare and Institutions Code, §§ 14043.6 and 14123, IEHP is prohibited from employing, contracting, or issuing payments to an individual or entity that is excluded, ineligible, or terminated from participation in State and Federal health care https://exclusions.oig.hhs.gov/ https://www.sam.gov/ https://mcweb.apps.prd.cammis.medi-cal.ca.gov/references/sandi https://data.cms.gov/tools/provider-opt-out-affidavits-look-up-tool programs. Contract awards are contingent upon the bidder, its principals’ and subcontractors’, eligibility to participate in State and Federal health care programs.

Bidders must certify that it or any of its subcontractors do not appear on State and Federal exclusionary lists in the Requested Data section of their response on Bonfire.

Company Evaluation Criteria

This section of the proposal is designed to further establish the Bidder as an entity with the ability and experience to operate the program or provide goods and/or services as specified in the RFP. The Company Profile should be concise and clear, including descriptive information regarding service delivery. All Bidders shall answer these questions in Question Set 3 of Questionnaire Q-25IW, unless specifically stated otherwise below. Questions that also require the upload of a (Required Document) to the associated document slot are noted.

3.1 Differentiators

3.1.1 What do you consider to be your company’s strengths, and how do you see your company as differentiated from other Bidders?

3.1.2 Is there any other information you would like IEHP to know about your company including value-added services?

3.2. Account Management Team

3.2.1 In the corresponding document slot on Bonfire, please provide the name(s) and general background(s) of each member of your account management team that will be assigned to IEHP. Include the information below:

• Functional area to which each person reports

• Years of service with your organization

• Total years of experience with commercial product implementation and operations

• Number of public entity accounts currently handled

• General size of the accounts (in terms of number of employees)

3.3 Organizational Information:

3.3.1 Provide a summary of the work plan and/or methodology and physical resources (staff and equipment) your company will commit to ensure successful services are provided pursuant to this RFP.

3.3.2 Will IEHP have a dedicated team assigned throughout the implementation? If so, who? Provide the organizational structure and experience for each team member, if not outlined above.

3.3.3 How would the account service team be structured after the implementation?

3.3.4 What is your company’s Mission Statement?

3.3.5 Summarize your company’s billing procedures.

3.3.6 What office will support IEHP?

3.3.7 Please indicate your company’s total number of employees this year and last year.

3.3.8 Please indicate your company’s total number of contractors this year and last year.

3.4 Administration:

3.4.1 Describe any customer and/or member services available online.

3.4.2 Could IEHP link their website to your website?

3.4.3 Do you have a customer service department? If so, what is the phone number, and the hours of operation?

3.4.4 Please describe how your customer service department is organized. Would IEHP receive a dedicated team?

3.5 Experience:

3.5.1 Describe your company’s experience/history with providing the services requested in this RFP.

3.5.2 Describe your company’s experience working with public entities, including but not limited to Health Maintenance Organizations.

3.5.3 Describe your company’s relationship and experience with governmental or public-sector oversight bodies (e.g., state or federal regulatory agencies, public compliance organizations).

3.6.1 Credentials/Resumes/Certifications/Licenses: (Required Document)

In the corresponding document slot on Bonfire, please provide information for all employees/subcontractors responsible for administering or providing services.

Provide a summary list of the organizational personnel that will actively participate and contribute their skills to this project. Include in this list:

• Name

• Job title

• Work location and

• Responsibilities

• Qualifications/Experience

• Relevant experience in projects of similar size and complexity. (Responses may be one page per individual.)

• Education

• Certifications/licenses, if applicable

• Years of service with your organization

• Total years of experience

• List other pertinent information that will assist in evaluating Bidder’s qualifications.

3.7 Awarded Contracts:

3.7.1 In the corresponding document slot, provide a list of three (3) contracts of similar value awarded to your company in the past three (3) years. Include the year, type of services, dollar amounts, services provided, location, contracting company, contact name, and phone number.

Scope of Services

Summary of Services The following criteria will be required of the Awarded Vendor:

The platform should support visibility into unauthorized software, library and dependencies, plug-ins and extensions, and integrations across browsers, IDEs, and containerized environments. Monthly scanning and reporting of all installed applications, browser extensions, and software components is required.

IEHP Asset Inventory

IEHP outlines its current IT asset inventory to help vendors provide pricing.

• Windows 10 Endpoints: 5,000

• Windows Servers: 700

• Linux Machines: 130

• macOS Machines: 50

• iPhones (Mobile Devices): 1,700

• Android Devices: 250

• Active Directory (AD) Accounts: 7,000

Vendors should use these figures to estimate licensing and maintenance costs.

A. Core Capabilities

• Application Allowlisting with deny-by-default enforcement.

• Ringfencing to restrict application permissions and prevent unauthorized actions such as macro, PowerShell or CMD executions.

• Detect and report unauthorized software, browser extensions, and IDE plug-ins (e.g., Visual Studio, RStudio, Python IDEs), and prevent profile synchronization between personal accounts to business accounts.

• Monitor and control integrations with Kubernetes and Tanzu environments, which may not pertain to the production environment, but may apply to endpoints running local containers or virtual machines (VMs).

• Elevation Control to manage admin privileges at the application level.

• Configuration Management for enforcing security baselines.

• Block all application executables from any source (e.g., USB, network shares, cloud storage, etc.).

• Policy Simulation to test deny rules before enforcement.

• Patch Management to integrate with SCCM, Intune, or Patch My PC.

• Sandbox Testing for new or unverified applications.

• Real-time Policy Propagation.

B. Integration Requirements

• Native or API-based integration with:

• User directory services

• Software inventory consolidation systems

• Platforms supporting automated workflows

• Azure AD (Entra ID)

C. Compliance & Reporting

• Support for HIPAA, NIST 800-171, CMS, DHCS, CIS, and CISA.

• Exportable logs and audit trails.

• Policy mapping to compliance frameworks.

• Continuous risk monitoring and configuration benchmarking.

D. Platform Requirements

• Support for Windows 10+, Server 2012+, macOS, Linux, IOS and Android.

• Centralized dashboard for device and applications telemetry and compliance.

• Unified management console with dynamic policy allocation.

• Automated policy updates based on threat intelligence feeds

Monthly Summary Report.

The Contractor shall provide a Monthly Summary Report to the Information Technology Risk & Compliance Department by the 5th workday of each month following the previous month in which services were provided. The metrics and figures below are examples only and are intended to illustrate the type of information to be provided.

The report shall include, but is not limited to:

1. Executive Summary

• Overview of application control activities

• Key highlights (e.g., number of blocked attempts, new policies enforced)

• Summary of compliance posture

2. Policy Enforcement Overview

• Total Applications Whitelisted: 1,245

• New Applications Approved This Month: 37

• Applications Blocked: 112

• Unauthorized Installation Attempts: 29

• Browser Extensions Blocked: 18

• AI Tool Usage Attempts Blocked: 6

3. Incident Summary

Date Device/User Application/Extension Action Taken Notes Nov 3 jwu-laptop01 ChatGPT Desktop App Blocked Unauthorized AI tool usage Nov 10 mkim-desktop02 Zoom Plugin Blocked Not on approved list Nov 21 jsmith-laptop03 VS Code Extension Alert & Blocked Security risk flagged

4. Compliance Metrics

• Devices in Full Compliance: 96%

• Devices with Exceptions: 4%

• Users with Repeated Violations: 3 users flagged for review

• Policy Updates Applied: 2 major updates (AI usage policy, extension control)

5. AI Usage Monitoring

• AI Tools Attempted: ChatGPT, GitHub Copilot

• Blocked Attempts: 6

• Approved AI Tools: None

• Policy Enforcement: Strict block on all AI-related executables and browser-based access

6. Recommendations

• Review flagged users for potential training or policy updates

• Consider expanding whitelist to include commonly requested safe tools

• Continue monitoring AI usage trends and update policies accordingly

7. Appendices

• Full list of blocked applications/extensions

• Change log of whitelisting policies

• Device compliance report (CSV available upon request)

Failure to Report Contractor shall document and report to the Information Technology Risk & Compliance Department for services rendered. The Contractor must submit the report within 5 business day of the program or service.

Bidder Response Questions (Questions in this section must be answered in Questionnaire Q-89TY, unless specifically stated otherwise)

1.0 General & Operational:

1.0.1 Does the product provide coverage on Windows 7 and above?

1.0.2 Will non-Windows operating systems like Linux RHEL, Ubuntu, and macOS need an agent?

1.0.3 Can the proposed solution ensure that agent resource utilization remains low, averaging below 1% CPU?

1.0.4 Does it support multiple channels for automated agent updates, including delayed updates, immediate updates, manual updates, or other methods?

1.0.5 Does it support showcasing offline, inactive, and active devices with up-to-date information every 60 seconds?

1.0.6 Does it ensure agents deploy policy and propagate to machines within 60 seconds of deployment?

1.0.7 Does it support agent installation with GPO, SCCM, Intune, and have multiple installer versions including MSIs, EXEs, and scripts for multiple deployment methods?

2.0 Application Control Capability:

2.0.1 Does it have the ability to support application whitelisting and access control?

2.0.2 Does it have the ability to provide inventory for browser extensions and utilities?

2.0.3 Does the product provide inventory for IDE extensions?

2.0.4 Does the product provide inventory for Docker containers?

2.0.5 Does it have the ability to perform automated policy creation for the application allow list to specify what is authorized to run and block the rest by default?

2.0.6 Does it have the ability to perform automated custom rule creation for allow list based on application-specific behaviors?

2.0.7 Does it have the ability to perform live simulation of denies to ensure policies can be created and problems can be rectified before enforcing an active block mode?

2.0.8 Can the product automatically track updated file changes by hash, ensuring when applications update, new files are not blocked as they are already added to the whitelist directly from the vendor?

2.0.9 Does it have the ability to ensure ease of deletion of applications from the whitelist in a single click to block them from running once identified on machines?

2.0.10 Does it have the ability to test requested applications from end users in an integrated virtual environment for application testing?

2.0.11 Does it have the ability to create policies based on files executed in a sandboxing environment prior to execution, which look at application behavior?

2.0.12 Does it have the ability to approve applications for users, groups, or the entire organization in a seamless workflow?

2.0.13 Does it have the ability to create exclusions for hash, certificate, process, path, SHA, created by, and published?

2.0.14 Does it contain a centralized logging console of all information including executions, reads, writes, moves, deletes, process size, certificates, through which policies can be created in a single-click manner?

2.0.15 Does it have the ability to integrate AD groups to policies for dynamic policy allocation?

2.0.16 Does it have the ability to block browser extensions, Microsoft Store apps, EXEs, scripts, DLLs, .bat, and other file types by default that attempt to run on machines if not on the allow list?

2.0.17 Does it have the ability to block in all contexts including but not limited to system, user, local admin, and domain admin by default if the file trying to execute is not on the allowed list?

2.0.18 Does it have the ability to add dependencies into application policies to permit custom and bespoke applications?

2.0.19 Does it have the ability to map out application behaviors and dependencies to better understand what they require and block by default unauthorized application activities?

2.0.20 Does it have the ability to enforce a hash-based application whitelist?

2.0.21 Does it have the ability to limit application interactions to only what is required, blocking unauthorized actions by default?

2.0.22 Does it have the ability to prevent applications from accessing the registry by default if not required?

2.0.23 Does it have the ability to create policies to prevent applications from accessing unauthorized IP addresses and allow only what is required?

2.0.24 Does it have the ability to create policies to prevent applications from accessing unauthorized files, folders, and data, allowing only what is required?

2.0.25 Does it have the ability to create policies to prevent applications from accessing other applications or moving laterally, allowing only what is required?

2.0.26 Does it have the ability to create exclusions for what IP addresses, files, or other applications a specific restricted app can access?

2.0.27 Does it have the ability to create custom groups for ease of policy allocation?

2.0.28 Does it have the ability to track and list all local administrator accounts?

2.0.29 Does it have the ability to allow certain applications for certain users only?

2.0.30 Does it have the ability to segregate tenants into multiple sub-organizations and groups?

2.0.31 Does it provide an interface for an end-user store from which users can autonomously download and install published applications that IT/security has preauthorized?

3.0 Endpoint Privilege Control:

3.0.1 Does it have the ability to elevate applications to run as admin if required for self-end user install permanently?

3.0.2 Does it have the ability to elevate applications to run as admin if required temporarily with a time-based option?

3.0.3 Does it have the ability to remove remotely all local administrator accounts that are not required?

3.0.4 Does it have the ability to find local administrator accounts being used on machines?

3.0.5 Does it have the ability to log all admin activity that users carry out as administrator?

3.0.6 Does it have the ability to request applications to be run as admin through an end-user request prompt in the Windows UAC?

3.0.7 Does it have the ability to allow users to self-elevate if required?

3.0.8 Does it have the ability to elevate machines to run as administrator for scheduled or time-based elevation periods so all applications can be run as admin as required?

4.0 Device Control:

4.0.1 Does it have the ability to control external storage devices such as USB, UNC, SATA, SAS, DVD, SCSI, NVMe, PCIe, SDXC, User Profile Disk, and Apple Fabric (macOS)?

4.0.2 Does it have the ability to set conditional access that is time-based for external storage devices?

4.0.3 Does it have the ability to set conditional access that is read-only or read-and-write for external storage devices?

4.0.4 Does it have the ability to set conditional access based on programs to execute on external storage devices?

4.0.5 Does it have the ability to set conditional access based on file types to be allowed from external storage devices?

4.0.6 Does it have the ability to centrally log all activity on external drives plugged into endpoints in a unified audit to monitor?

4.0.7 Does it have the ability to centrally log all read, write, move, and delete actions of files with custom reporting and searching available within the platform?

4.0.8 Does it have the ability to limit application access to files, blocking unauthorized access by default to prevent encryption and exfiltration by means of ransomware attacks?

4.0.9 Does it have the ability to assign policies to users, groups, machines, and entire organizations?

5.0 Hardening Controls:

5.0.1 Does it have the ability to alert on unsafe configurations within the platform, for example, if path-only rules are set in the application control segment?

5.0.2 Does it have the ability to scan configurations on endpoints benchmarked to global frameworks like ISO27001, NIST, CIS, and others?

5.0.3 Does it have the ability to alert on critical, high-risk, and moderate-risk control failures on compliance benchmarks with suggested resolutions?

5.0.4 Does it have the ability to suggest closure of critical, high, and moderate-risk devices identified through suggested policies or other methods?

5.0.5 Does it have the ability to showcase the exact count and hostnames of machines that fail the compliance control scan?

5.0.6 Does it have the ability to deploy hardening configurations like disabling UPnP, disabling Office macros, or other hardening configurations instantly on machines from a pre-built policy list?

6.0 Endpoint Detection and Network Controls:

6.0.1 Does it have the ability to alert to Indicators of Compromise (IOCs) and custom thresholds that have been manually built based on different parameters?

6.0.2 Does it have the ability to scan configurations on endpoints benchmarked to global frameworks like ISO27001, NIST, CIS, and others?

6.0.3 Does it have the ability to respond to alerts and analyze chains of events by looking at executions, network activity, and other actions on the alerted device?

6.0.4 Does it have the ability to lock down or isolate devices from the network manually or automatically based on specific events?

6.0.5 Does it have the ability to control inbound and outbound network traffic on hosts, specifying what ports and groups are authorized to communicate with each other?

6.0.6 Does it have the ability to configure object-based rules in network controls, only allowing certain product groups to communicate with ports on servers or other grouped devices?

7.0 Cybersecurity Approval Capability:

7.0.1 Does it have the ability to provide 24/7/365 access to the product cybersecurity SOC through live chat or phone with a sub-30-second response target?

7.0.2 Does it have the ability for the cybersecurity team to handle and process end-user approval requests (e.g., new applications, files, or updates) on behalf of the customer following pre-approved policies?

7.0.3 Does it have the ability to automatically approve safe and validated application updates and software changes based on internal catalog and intelligence?

7.0.4 Does it have the ability to provide multi-level approval workflows and escalation routing for sensitive environments or exceptions?

7.0.5 Does it have the ability to maintain audit trails of all approvals, denials, and administrative actions within the product portal?

7.0.6 Does it have the ability to review, test, and validate user requests in a sandboxed environment prior to approval to ensure no security risk?

7.0.7 Does it have the ability to offer co-managed direct support between the product and managed service providers, enabling customers’ IT teams to directly contact cybersecurity?

7.0.8 Does it have the ability to provide weekly onboarding and review sessions during learning and implementation phases until full customer handover?

7.0.9 Does it have the ability to provide quarterly reviews and optimization sessions to assess configurations and improve policy alignment?

7.0.10 Does it have the ability to escalate non-standard requests or policy deviations for customer approval, ensuring full compliance and accountability?

8.0 MDR Capability:

8.0.1 Does it have the ability to provide 24/7/365 managed detection and response services delivered by the product’s cybersecurity SOC team?

8.0.2 Does it have the ability for MDR analysts to monitor, investigate, and respond to alerts triggered by indicators of compromise (IOCs) mapped to the MITRE ATT&CK framework?

8.0.3 Does it have the ability to leverage product telemetry data from all modules (Application Control, Ringfencing™, Storage, Network) for advanced correlation?

8.0.4 Does it have the ability to automatically isolate or lock down compromised or high-risk devices based on predefined or dynamic IOC detection?

8.0.5 Does it have the ability to alert administrators to unusual or malicious behavior across endpoints, networks, and cloud environments (e.g., Microsoft 365)?

8.0.6 Does it have the ability for the MDR team to review alerts,…