6068-0 RFQ for SOC Audit-4.15.25.pdf

6068-0 SOC 2 Cyber Security Assessment Services

REQUEST FOR QUOTES (RFQ) No. 6068-0 Best Value Analysis Process for:

The ONE System – SOC 2 Cyber Security Assessment Services Open Market Bid S-10000-00013524

Issue Date: April 15, 2025 @ 4:00 PM PT

Authorized Purchaser: Oregon Health Authority (OHA) Issuing Office: Oregon Department of Human Services (ODHS) Office of

Contracts & Procurement (OC&P) on behalf of OHA

RFQ Contact Information (Authorized Representative): Rhonda M. Campbell Address: 500 Summer Street, NE Salem, OR 97301 Phone: 503-983-0472 E-mail: Rhonda.M.Campbell@odhsoha.oregon.gov

Offer Due Date and Time: May 3, 2025 @ 4:00 PM PT

Service Category: Cyber Security

7.2 Application Penetration Test

7.4 IT Security Risk Assessment

Under Master Price and Services Agreement (MPSA)

Information Technology Professional Consulting Services

Issued to:

CONSULTANT MPSA #

CBIZ 9415

CSG Government Solutions, Inc. 8470 Deloitte Consulting 8482 The North Highland Company, LLC 8477 mailto:Rhonda.M.Campbell@odhsoha.oregon.gov

Included below is a description of the work required for this project for your consideration.

The Oregon Health Authority intends to award one Work Order Contract (WOC) for the project described in this RFQ.

Definitions:

As used in this RFQ, these terms are defined as follows:

• "Agency” refers to the Authorized Purchaser, Oregon Health Authority, Agency Operations, also referred to herein as “OHA.”

• “Contractor” refers to the Offeror selected through this RFQ, or the selected Offeror.

• “Offer” or “Quote” refers to each response submitted by an Offeror in response to this RFQ.

• “Offeror” refers to each consultant who submits a Quote / Offer in response to this RFQ.

• "Project Tasks and Deliverables” or “Tasks and Deliverables” refers to the tasks and deliverables required from the successful Offeror described in Section 5 below.

• “Project Manager(s)” refers to the contractor staff assigned supporting the project in fulfillment of the contract.

• “Services” means the Tasks and Deliverables that the successful Offeror (as Contractor) will provide under the WOC awarded from this RFQ, within the category of Services defined in the Organizational Improvement Price Agreements.

• “Project Plan” means a written document that outlines, at minimum, the tasks, required resources, responsibilities, milestones and timelines to be undertaken to achieve the activities outlined in the WOC.

1. Introduction

Agency’s ONE System provides financial eligibility determination for select OHA and ODHS programs. The SOC audit is based on a Secretary of State recommendation and the acceptance of that recommendation. With this RFQ, Agency is seeking a consultant to complete the annual ONE System SOC 2 Type 2 examination to comply with the Oregon Secretary of State (SOS) audit finding recommendations.

2. Background Information

SOC 2 Type 2 is an examination developed by the American Institute of Certified Professional Accountants (AICPA) measuring the overall information security and handling of client data based on the five trust service principles (security, availability, processing integrity, confidentiality, and privacy).

In its Code of Professional Conduct (CPC), Section .400.23, the AICPA defines independence as:

“(a) Independence of mind is the state of mind that permits a member to perform an attest service without being affected by influences that compromise professional judgment, thereby allowing an individual to act with integrity and exercise objectivity and professional skepticism. ( b ) Independence in appearance is the avoidance of circumstances that would cause a reasonable and informed third party, who has knowledge of all relevant information, including safeguards applied, to reasonable conclude that the integrity, objectivity or professional skepticism of a firm or member of the attest engagement team is compromised.”

Consultant’s examinations must be directed by the processes, procedures, guidelines, and standards for SOC 2 Type 2 examinations established by AICPA. This includes compliance with all ethical standards of AICPA pertaining to performance of the Services by Consultant and any associated entities.

The examinations will be facilitated by the ONE System technical team. The ONE System technical team will coordinate access to staff, systems, and documentation as needed.

Authorized Purchaser will provide input on priorities and methods, but Consultant remains responsible for decisions on how to use that input.

2.1 Schedule

3. Scope of Services:

ODHS’ ONE System provides financial eligibility determination for select OHA and ODHS programs. The ONE System SOC 2 Type 2 examinations that Consultant will complete under this WOC are conducted in response to an Oregon Secretary of State audit finding. The recommendation from SOS was for yearly SOC 2 Type 2 audits.

SOC 2 Type 2 is an examination developed by the American Institute of CPAs (AICPA) measuring the overall information security and handling of client data based on the five trust service principles (security, availability, processing integrity, confidentiality, and privacy).

AICPA defines independence as: Independence of mind is the state of mind that permits a member to perform an attest service without being affected by influences that compromise professional judgment, thereby allowing an individual to act with integrity and exercise objectivity and professional skepticism. Independence in appearance is the avoidance of circumstances that would cause a reasonable and informed third party, who has knowledge of all relevant information, including safeguards applied, to reasonable conclude that the integrity, objectivity or professional skepticism of a firm or member of the attest engagement team is compromised.

Consultant’s examinations must be directed by the processes, procedures, guidelines, and standards for SOC 2 Type 2 examinations established by AICPA. This includes compliance with all ethical standards of AICPA pertaining to performance of the Services by Consultant and any associated entities. Authorized Purchaser acknowledges AICPA standards require the issuance and (as applicable) execution of an engagement letter.

EVENT DATE TIME (PT)

Issue RFQ April 15, 2025 4:00 PM PT

Due date for questions and requests for clarification (“Q&A”) April 22,2025 4:00 PM PT

Answers to questions and requests for clarification (approx.)

TBD - Approximately 2-3 days after due date

Quote due date and time May 3, 2025 4:00 PM PT

Notice of Intent to Award (approx.) TBD

Protest to Notice of intent to award due date 7 calendar days after notice of intent to award announcement

The examinations will be facilitated by the ONE System technical team. The ONE System technical team will coordinate access to staff, systems, and documentation as needed.

Authorized Purchaser will provide input on priorities and methods, but Consultant remains responsible for decisions on how to use that input.

4. Questions and Requests for Clarification:

All questions and requests for clarification regarding this RFQ must be submitted in writing via e-mail, to the Authorized Representative and must be received no later than the Due Date and Time listed on Page 4, in Section 2.1 (Schedule).

When appropriate, as determined by Authorized Purchaser in its sole discretion, revisions, substitutions or clarifications of the RFQ will be sent electronically.

5. Quotation Submittal:

Quotes must be submitted via email to Rhonda.M.Campbell@odhsoha.oregon.gov in searchable Adobe PDF file format, and the total combined size of PDF email attachments should not exceed 10 Megabytes. All Quotes must be received no later than the Quote Due Date and time listed on Page 1. Late Quotes will not be accepted.

Authorized Purchaser may reject all Quotes or to cancel this RFQ if in its sole determination, it is in the best interest of Authorized Purchaser.

6. Submittal Requirements:

a. Quotes must include a proposed Statement of Work, using the sample form attached as Exhibit 3 to this RFQ and must include a description of Offeror’s methodologies for providing the Services.

b. Quotes must include a description of Consultant’s Key Persons, and their experience, including resumes and three references for the prospective Key Person.

c. Quotes must include a description of past projects Offeror has completed that are similar in scope to what is being requested in this RFQ.

d. Quotes must include a description of project management services rendered on projects similar in scope, size, and/or complexity to what is being requested in this RFQ. “Similar in scope, size, and/or complexity” means $1M+ technology projects to implement software and/or hardware.

e. If applicable, quotes must include a description of project management services rendered while working with iQMS vendors on large technology projects. If no such services have been rendered, include that information in the response.

f. Quotes must include submission of the Pricing Sheet (Exhibit No. 1). The Pricing Sheet must be signed by an authorized representative of the Offeror.

i. Pricing to include at least one each of a Monthly Status Report, Knowledge Transfer Deliverable, and Assessment and Training Deliverable.

ii. Pricing must reflect fixed price deliverables, with sufficient detail to determine Consultant’s ability to comply with the supplemental invoicing information included with the Pricing Sheet. The WOC resulting from this RFQ will reflect terms consistent with that supplemental invoicing information.

iii. If you prefer a T&M model, please provide a clear breakdown of expected hours, labor categories, and corresponding hourly rates. Ensure that this information is transparent and conforms to the terms outlined in the RFQ and MPSAs.

iv. This flexibility aims to ensure that all potential offerors can present the most suitable and effective pricing structure for their proposed solution.

g. Quotes must include 3 references using the Reference Check Form (Exhibit No. 2). Forms must be completed by the reference, returned to the Offeror and submitted with the Quote. References should be from customers for whom Offeror has performed similar projects within the past five (5) years.

7. Expected Level of Detail for Pricing/Invoicing:

Location in Response: Potential offerors should provide detailed pricing and invoicing information in their proposals, specifically in the section labeled “Pricing and Invoicing Detail.”

Deliverable Breakdown: The response must include a comprehensive breakdown of the

Level of Effort (LOE) and the hourly rates for all tasks and deliverables. This includes an itemized list showing the estimated hours and corresponding rates for each deliverable to provide full transparency on pricing.

Exhibit 1:. This page outlines the required information to be provided, which includes a detailed breakdown of costs in line with the RFQ terms and the MPSA.

Conformity to Terms: Ensure all provided pricing and invoicing details conform to the terms used in this RFQ and the MPSAs. This alignment is crucial to ensure consistency and adherence to established standards.

8. Evaluation and Award:

Quote/Offer submissions will be reviewed to determine if all Submittal Requirements have been met. Those meeting the Submittal Requirements will be evaluated to determine the “Best Value” for the State. “Best Value” is based solely on the evaluator’s determination of what best meets the needs of Authorized Purchaser, taking into account price as well as the following considerations:

Evaluation Criteria Maximum Points

1. Approach, Methodology, Availability 30

2. Qualifications and Experience of Contracting Firm 25

3. Qualifications and Experience of Key Persons 35

4. Price Proposal 10

Total Maximum Score 100

The Offeror with the most advantageous quote will be awarded a WOC in a form substantially similar to the Work Order Contract attached as Attachment C to the MPSA. Authorized Purchaser may negotiate WOC terms and conditions with the successful Offeror.

9. Notice of Award:

Agency, through the Authorized Representative noted on page 1 of this RFQ, will issue a notice of intent to award a Work Order Contract to all Offerors that submitted Offers in response to this RFQ.

10. Protest of Award:

Pursuant to ORS 279B.410, an aggrieved Offeror may protest the award of the Work Order Contract. Offeror must submit its written protest to the Authorized Representative within seven calendar days of the issuance of the notice of intent to award. The protest must state that Offeror is adversely affected because Offeror would be eligible for the award in the event the protest is upheld, because:

a. All higher ranked Offers are nonresponsive.

b. Agency has failed to conduct the evaluation of Offers in accordance with the criteria or processes described in the solicitation materials;

c. Agency has abused its discretion in rejecting the protestor’s Offer as nonresponsive; or

d. Agency’s evaluation of Offers or its subsequent determination of award is otherwise in violation of this chapter or ORS chapter 279A.

The RFQ Contact listed on Page 1 will respond to all protests in a timely manner.

Exhibit 1

Price Proposal for RFQ 6068

Task/Deliverable Description Estimated Number of Hours

Estimated Price

1.1 1.2 2.1 2.2 Offeror’s Total Estimated price to complete all deliverables listed

Signed by:__________________________________

Name/Title:_________________________________

Date:_______________________________________

EXHIBIT NO. 2

Reference Check Form

Proposer Name: __________________________________________

Reference Entity: __________________________________________

Reference Contact Name: __________________________________________

Contact Telephone Number: __________________________________________

Please respond to the following questions.

Score: 1-5 for each response.

1. Detailed description of Qualifying Engagement.

Score:

Comments:

2. Proposer’s role and functional area of Qualifying Engagement.

Score:

Comments:

3. Description of technical environment and complexity.

Comments:

4. Description comparing Qualifying Engagement to RFP Scope of Work.

Score:

Comments:

5. If given the opportunity, how likely would you use Proposer’s services again?

Comments:

Exhibit 3

WOC Sample Statement of Work

PART I. BACKGROUND

The ONE System provides financial eligibility determination for select OHA and ODHS programs. To ensure the System XYZ, annual SOC 2 Type 2 audits must be performed.

The examinations performed by the selected Consultant will be facilitated by the ONE System technical team. The ONE System technical team will coordinate access to staff, systems, and documentation as needed. Authorized Purchaser will provide input on priorities and methods, but Consultant remains responsible for decisions on how to use that input.

A. Acceptance Process for Deliverables:

Consultant is responsible for completing the Tasks and Deliverables described in this SOW.

Deliverable due dates in the WOC refer to the deadline for submittal of Deliverables to Authorized Purchaser’s designated contact. Deliverables must be in MS Word, MS Excel, PDF, or other easily readable file format.

If Authorized Purchaser reasonably determines the submitted Deliverable does not meet its Acceptance Criteria, Authorized Purchaser will notify Consultant in writing of Authorized Purchaser’s rejection of the Deliverable and describe in reasonable detail in such notice Authorized Purchaser’s basis for rejection. Upon receipt of notice of non-acceptance, Consultant shall, within 10 Calendar Days, modify or improve the Deliverable at Consultant’s sole expense to ensure that the Acceptance Criteria are met, and notify Authorized Purchaser in writing that it has completed such modifications or improvements and re-tender the Deliverable to Authorized Purchaser. Authorized Purchaser will thereafter review the modified or improved Services within 10 Business Days of receipt. Failure of the Deliverable to meet its Acceptance Criteria after the second review will constitute a default by Consultant. Upon such default, Authorized Purchaser may notify Consultant of such default and instruct Consultant to modify or improve the Deliverable as set forth in this SOW.

Authorized Purchaser will only pay for Deliverables that have been Accepted by Authorized Purchaser.

PART II. TASKS AND DELIVERABLES

All Services must be performed in the United States or US territories. Agency Confidential

Information will not be accessed from, transmitted, or stored outside of the United States or its territories. The WOC resulting from this RFQ will include terms specific to accessing State of Oregon networks, information systems, and data.

Consultant shall provide all tools necessary to conduct its assessment and examination activities.

A. Consultant Tasks and Deliverables:

Task No. 1: Project Management

Consultant shall provide project management oversight and expertise. Project Management includes:

1.1 Coordinating and attending a project kick-off meeting between Consultant and Authorized Purchaser stakeholders, which must include at a minimum:

a. Confirmation that all Consultant staff have completed a background check within the six months prior to the Effective Date of this WOC or planning for Consultant staff to have completed a background check prior to accessing Agency facilities, systems, and information.

b. Explanation of Consultant’s project elements and testing methods.

c. Process for review and finalization of the Project Plan.

d. Review and confirmation of personnel assignments (for both Consultant and Authorized Purchaser) for each Task.

e. Coordination and discussion of appropriate communication protocols for project Tasks.

f. Clarification of any testing restrictions, exclusions or concerns, to avoid adverse impacts to Authorized Purchaser personnel or systems, and to best ensure meeting of all WOC goals.

g. Agreement regarding a method to exchange sensitive or confidential documents, e.g. secure site/portal.

1.2 Defining roles and responsibilities of Consultant.

1.3 Developing and maintaining project plans and schedules.

1.4 Participation in weekly status update conference calls or meetings

1.5 Planning and controlling project activities for which Consultant is responsible.

1.6 Ensuring compliance and completion of assigned project tasks.

1.7 Conducting project closure activities.

Consultant shall oversee the planning and scheduling of Services, manage resources, and ensure quality of all services performed under this WOC. Unless otherwise authorized by Authorized Purchaser, project management and status reporting meetings may be conducted via conference call or web conferencing. Consultant shall work with Authorized Purchaser’s project manager and coordinate identification of issues, facilitation of status meetings, and scheduling activities.

Task 1 Deliverable:

Deliverable 1.1: Project Plan Consultant shall develop and deliver a Project Plan describing Consultant’s approach to successfully delivering the Work. At a minimum, the Project Plan must include: (i) a description of the assessment methodology, (ii) a summary of the scope of the ONE System to be evaluated, and (iii) a description of the methods used to evaluate each control. The Project Plan must generally adhere to Project Management guidelines, and must be delivered in MS Word, MS Excel, PDF, or other easily readable file format.

Deliverable 1.1 Acceptance Criteria:

The Deliverable contains everything described under Deliverable 1.1: Project Plan.

Task No. 2: SOC 2 Type 2 Report

Consultant shall conduct independent SOC 2 Type 2 examinations for each year starting in calendar year 2025 for the entirety of the term of this WOC, in accordance with requirements established by AICPA for such engagements. A SOC 2 Type 2 engagement is an examination of the internal controls of a service organization over a period of time. The objectives of the Type 2 examination are to determine whether adequate internal controls have been designed to meet the requirements of the user organization, and to determine whether the controls are operating effectively. Upon completion of an examination, Consultant shall then develop and deliver a SOC 2 Type 2 Report.

SSAE No. 18, Attestation Standards:

1. Clarification and Recodification, which includes AT-C section 105, Concepts Common to All Attestation Engagements, and AT-C section 205, Examination Engagements; and

2. AICPA Guide, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy. TSP section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (AICPA, 2017 Trust Services Criteria).

Task 2 Deliverables:

Deliverable 2.1: SOC 2 Type 2 Report

The SOC 2 Type 2 Report must include at a minimum:

1. A summary of the scope evaluated, an executive summary of the overall results, and a summary table listing each control and sub-control with Consultant’s examination, include an observation summary for each assessment;

2. Description of service organization’s system, to include:

• Relevant information about the service organization and the processes which support the in-scope control activities;

• Organizations that the service organization utilizes in their operations, also known as subservice organizations;

3. Written assertion by service organization management regarding the description of the service organization’s system and the suitability of the design and the operating effectiveness of the controls to provide reasonable assurance that the service organization’s service commitments and system requirements were achieved based on the applicable trust services criteria; and

4. Service examiner’s report that contains an opinion on about whether the description is presented in accordance with the description criteria and the controls stated in the description were suitably designed and operating effectively to provide reasonable assurance that the service organization’s service commitments and system requirements were achieved based on the applicable trust services criteria.

The SOC 2 Type 2 Report must be delivered in MS Word, MS Excel, PDF, or other easily readable file format.

Deliverable 2.1 Acceptance Criteria:

The Deliverable contains everything described under Deliverable 2.1: SOC 2 Type 2 Report.

B. Payment and Deliverable Schedule

No. Deliverable Due Date Quantity NTE

1.1 Project Plan WOC Effective Date plus

10 Business Days

2.1 SOC 2 Type 2 Report Date based upon Accepted

Project Plan

Total NTE

Authorized Purchaser will pay Consultant for Accepted Deliverables in accordance with the not-to-exceed (NTE) amounts detailed in the Payment and Deliverable Schedule table above.

PART III. SPECIAL CONSIDERATIONS

A. Consultant Key Persons:

Role Key Person(s) Engagement Manager Project Manager - SOC 2 Readiness assessment Project Manager - SOC 2 Type 2 examination Lead Auditor - SOC 2 Type 2 examination

B. Change Orders: Pursuant to the provisions of Section 9 of the MPSA, Authorized Purchaser may request additional Services from Consultant as it directly relates to the Scope of Services described in this SOW. This SOW may be amended for circumstances including:

1. Adjustments to the SOW maximum not-to-exceed compensation;

2. Additional Services, Tasks and Deliverables, including those that become apparent as the project progresses or for additional Services as defined in Part II of this SOW;

3. SOW time extensions.

PART IV. TRAVEL AND OTHER EXPENSES

Travel expenses are not a separate item in this WOC. All compensation is included in the NTE Amount for each Deliverable.