6108-0 RFQ for Third Party Patch Management System Final2.pdf

RFQ 6108-0 Third-Party Application Management

REQUEST FOR QUOTES (RFQ) No. 6108-0 Open Market Bid S-44300-00014492

Best Value Analysis Process for:

Third Party Application Management

Issue Date: September 5, 2025 @ 4:00 PM PT

Authorized Purchaser: Oregon Health Authority (OHA) Issuing Office: Oregon Department of Human Services (ODHS) Office of

Contracts & Procurement (OC&P) on behalf of OHA

RFQ Contact Information (Authorized Representative): Rhonda M. Campbell Address: 500 Summer Street, NE Salem, OR 97301 Phone: 503-983-0472 E-mail: Rhonda.M.Campbell@odhsoha.oregon.gov

Offer Due Date and Time: October 3, 2025 @ 4:00 PM PT

Service Category: 3.1 Software Application Development

3.2 Software Application Architecture

5.6 Security Testing

Under Master Price and Services Agreement (MPSA)

Information Technology Professional Consulting Services mailto:Rhonda.M.Campbell@odhsoha.oregon.gov

Issued to:

CONSULTANT MPSA #

Atmosera, Inc. 8474 Deloitte Consulting 8482 Microsoft Corporation 8487 Resource Data, Inc. 8468 TEKsystems Global Services, LLC 8478 Windsor Solutions, Inc. 8466 CGI Technologies & Solutions, Inc. 8472

CBIZ 9415

The North Highland Company, LLC8 8477

Included below is a description of the work required for this project for your consideration.

The Oregon Health Authority intends to award one Contract for the project described in this RFQ.

Definitions:

As used in this RFQ, these terms are defined as follows:

• "Agency” refers to the Authorized Purchaser, Oregon Health Authority, Agency Operations, also referred to herein as “OHA.”

• “Contractor” refers to the Offeror selected through this RFQ, or the selected Offeror.

• “Offer” or “Quote” refers to each response submitted by an Offeror in response to this RFQ.

• “Offeror” refers to each consultant who submits a Quote / Offer in response to this RFQ.

• "Project Tasks and Deliverables” or “Tasks and Deliverables” refers to the tasks and deliverables required from the successful Offeror described in Section 5 below.

• “Project Manager(s)” refers to the contractor staff assigned supporting the project in fulfillment of the contract.

• “Services” means the Tasks and Deliverables that the successful Offeror (as Contractor) will provide under the contract awarded from this RFQ, within the category of Services defined in the Organizational Improvement Price Agreements.

1. Introduction

The need for this system stems from the increasing frequency of cyber threats targeting third-party software, which often serve as attack vectors due to inconsistent or delayed patching.

Ensuring timely and automated patching of applications such as Adobe, Google Chrome, Mozilla Firefox, and others is essential for maintaining a secure IT environment and protecting sensitive data.

2. Background Information

The purpose of this project is to procure, implement, and maintain a third-party patch management system to improve the security, compliance, and efficiency of patching non- Microsoft applications across the agency systems of Oregon Department of Human Services (ODHS) and Oregon Health Authority (OHA). The need for this system stems from the increasing frequency of cyber threats targeting third-party software, which often serve as attack vectors due to inconsistent or delayed patching. Ensuring timely and automated patching of applications such as Adobe, Google Chrome, Mozilla Firefox, and others is essential for maintaining a secure IT environment and protecting sensitive data.

Security compliance is a critical requirement for both ODHS and OHA due to state and federal regulations governing the protection of health and human services data, including HIPAA, IRS 1075, and other frameworks. A robust patch management solution supports these compliance efforts by demonstrating proactive and auditable security practices.

This third-party patching solution will supplement existing tools and processes, such as native Microsoft patching mechanisms, by addressing gaps in coverage for widely used non- Microsoft software. It ensures a more comprehensive and automated approach to endpoint protection, enhances visibility into patching status, and reduces the overall risk footprint across both agencies.

2.1 Schedule

EVENT DATE TIME (PT)

Issue RFQ September 5, 4:00 PM PT

Due date for questions and requests for clarification (“Q&A”)

September 11, 4:00 PM PT

Answers to questions and requests for clarification (approx.) September 16, 2025

Quote due date and time October 3, 2025 4:00 PM PT

3. Scope of Services:

The vendor shall provide a comprehensive third-party patch management solution, including software licensing, implementation services, technical support, and documentation. The scope of work includes but is not limited to:

1. Assessment: Evaluate current patch management processes and infrastructure.

2. Implementation: Provide, configure, and integrate patch management software with existing tools (e.g., SCCM, Intune, or other endpoint management solutions).

3. Customization: Adapt the solution to support agency-specific applications, if necessary.

4. Automation: Enable automated patch discovery, deployment, and reporting functionalities.

5. Training: Conduct user and administrator training sessions, including the provision of detailed documentation and training materials.

6. Support: Deliver ongoing maintenance, technical support, and software updates during the contract period.

4. Logistics

4.1. Location

The OIS team is headquartered in Salem, OR 97302. If the work is required onsite this would be the location. The team is working virtually and would accept virtual work for this implementation.

Schedule. The final implementation is targeted for completion by April 1, 2026.

5. Deliverables/Requirements. The vendor shall provide the following:

1. Project Plan and Timeline

2. Software Licenses and Documentation

3. Configured and Tested Patch Management Solution

4. Integration with Current Systems

5. Training Materials and Conducted Training Sessions

6. Monthly Patch Compliance and Deployment Reports

7. Technical Support and Maintenance Plan

Notice of Intent to Award (estimate) TBD

Protest to Notice of intent to award due date 7 calendar days after notice of intent to award announcement

6. Key Requirements:

1. Supported Platforms and Applications: Yes, Required

2. Automation Capabilities: No, Required

3. Granular Control, Reporting, and Alerts: Required

4. Vulnerability Management Integration: No, Required

5. Security of Patch Delivery and Cloud Data Stored in the United States: Yes, Required

6. Compliance Support and Zero-Day Patch Availability: Preferred

7. Centralized Management Console and Ease of Deployment: Required

8. Scalability for Enterprise Operations: Yes, Required

9. Integration with Active Directory, SCCM, Intune, LDAP, and SIEM systems: Required

Requirement Description

All Criteria

Functionality and Features Supported Platforms and Applications Automation Granular Control Testing/Staging/Rollback Reporting and Alerts

Security Vulnerability Management Integration Compliance and Regulatory Support Cloud Data Stored in United States Security of Patch Delivery Vulnerability Criticality Ratings Zero-Day Patch Support

Ease of Use User Interface Ease of Deployment Centralized Management Console Policy Configuration

Scalability Support for Enterprise-Scale Operations Cloud, On-Premises and Hybrid Support

Multitenancy

Compatibility and Integration Integration with Existing Tools Active Directory/SCCM/Intune/LDAP Integration SIEM Integration

Compliance and Regulatory Support Compliance Reporting Audit Trails Government Use

Support and SLAs Technical Support Service Level Agreements (SLA) Customer Support Channels Knowledge Base and Training

Cost and Licensing Model Pricing Model Licensing Flexibility Trial or Proof of Concept Capability

Vendor Reputation and Reliability/Performance Track Record Customer Reviews Long-Term Viability

Patch Deployment Flexibility Scheduling and Timing Geographical Support Maintenance Windows Staged Deployments "Rings"

7. Questions and Requests for Clarification:

All questions and requests for clarification regarding this RFQ must be submitted in writing via e-mail, to the Authorized Representative and must be received no later than the Due Date and Time listed on Page 4, in Section 2.1 (Schedule).

When appropriate, as determined by Authorized Purchaser in its sole discretion, revisions, substitutions or clarifications of the RFQ will be sent electronically.

8. Quotation Submittal:

Quotes must be submitted via email to Rhonda.M.Campbell@odhsoha.oregon.gov in searchable Adobe PDF file format, and the total combined size of PDF email attachments should not exceed 10 Megabytes. All Quotes must be received no later than the Quote Due Date and time listed on Page 1. Late Quotes will not be accepted.

Authorized Purchaser may reject all Quotes or to cancel this RFQ if in its sole determination, it is in the best interest of Authorized Purchaser.

9. Submittal Requirements:

a. Quotes must include a proposed Statement of Work, using the sample form attached as Exhibit 3 to this RFQ and must include a description of Offeror’s methodologies for providing the Services.

b. Quotes must include a description of Consultant’s Key Persons, and their experience, including resumes and three references for the prospective Key Person.

c. Quotes must include a description of past projects Offeror has completed that are similar in scope to what is being requested in this RFQ.

d. Quotes must include a description of project management services rendered on projects similar in scope, size, and/or complexity to what is being requested in this RFQ. “Similar in scope, size, and/or complexity” means $1M+ technology projects to implement software and/or hardware.

e. Quotes must include submission of the Pricing Sheet (Exhibit No. 1). The Pricing Sheet must be signed by an authorized representative of the Offeror.

i. Pricing to include: Project Plan and Timeline, Assessment Report, Software Licenses and Documentation, Configured and Tested Patch Management Solution, Customizations as required, Automation setup, Training Materials and Conducted Training Sessions, Monthly Patch Compliance and Deployment Reports for 1 year, Technical Support and Maintenance Plan, Security and Compliance Documentation, Acceptance Criteria, Final Implementation Report.

ii. Pricing must reflect fixed price deliverables, with sufficient detail to determine Consultant’s ability to comply with the supplemental invoicing information included with the Pricing Sheet.

iii. If you prefer a T&M model, please provide a clear breakdown of expected hours, labor categories, and corresponding hourly rates and reflects the total cost for one year of service for evaluation purposes. Ensure that this information is transparent and conforms to the terms outlined in the RFQ and MPSAs.

iv. This flexibility aims to ensure that all potential offerors can present the most suitable and effective pricing structure for their proposed solution.

f. Quotes must include 3 references using the Reference Check Form (Exhibit No. 2). Forms must be completed by the reference, returned to the Offeror and submitted with the Quote. References should be from customers for whom Offeror has performed similar projects within the past five (5) years.

10. Expected Level of Detail for Pricing/Invoicing:

Location in Response: Potential offerors should provide detailed pricing and invoicing information in their proposals, specifically in the section labeled “Pricing and Invoicing Detail.”

Deliverable Breakdown: The response must include a comprehensive breakdown of the

Level of Effort (LOE) and the hourly rates for all tasks and deliverables. This includes an itemized list showing the estimated hours and corresponding rates for each deliverable to provide full transparency on pricing.

Exhibit 1:. This page outlines the required information to be provided, which includes a detailed breakdown of costs in line with the RFQ terms and the MPSA.

Conformity to Terms: Ensure all provided pricing and invoicing details conform to the terms used in this RFQ and the MPSAs. This alignment is crucial to ensure consistency and adherence to established standards.

11. Evaluation and Award:

Quote/Offer submissions will be reviewed to determine if all Submittal Requirements have been met. Those meeting the Submittal Requirements will be evaluated to determine the “Best Value” for the State. “Best Value” is based solely on the evaluator’s determination of what best meets the needs of Authorized Purchaser, taking into account price as well as the following considerations:

Evaluation Criteria Maximum Points

1. Approach, Methodology 30

2. Qualifications and Experience of Contracting Firm 25

3. Qualifications and Experience of Key Persons 35

4. Price Proposal 10

Total Maximum Score 100

The Offeror with the most advantageous quote will be awarded a contract. Authorized Purchaser may negotiate contract terms and conditions with the successful Offeror.

12. Notice of Award:

Agency, through the Authorized Representative noted on page 1 of this RFQ, will issue a notice of intent to award a contract to all Offerors that submitted Offers in response to this RFQ.

13. Protest of Award:

Offeror must submit its written protest to the Authorized Representative within seven calendar days of the issuance of the notice of intent to award. The protest must state that Offeror is adversely affected because Offeror would be eligible for the award in the event the protest is upheld, because:

a. All higher ranked Offers are nonresponsive.

b. Agency has failed to conduct the evaluation of Offers in accordance with the criteria or processes described in the solicitation materials;

c. Agency has abused its discretion in rejecting the protestor’s Offer as nonresponsive; or

d. Agency’s evaluation of Offers or its subsequent determination of award is otherwise in violation of this chapter or ORS chapter 279A.

The RFQ Contact listed on Page 1 will respond to all protests in a timely manner.

Exhibit 1

Price Proposal for RFQ 6108

Task/Deliverable Description Estimated Number of Hours

Estimated Price

Project Plan and Timeline

• Detailed project plan outlining phases, milestones, and timelines.

• Gantt chart or similar project management tool.

Assessment Report • Evaluation of current patch management processes and infrastructure.

• Identification of gaps and areas for improvement.

Software Licenses and Documentation

• Licenses for the patch management software.

• Comprehensive user and technical documentation.

Configured and Tested Patch Management Solution

• Installation and configuration of the patch management software.

• Integration with existing tools (e.g., SCCM, Intune).

• Testing to ensure functionality and compatibility.

Customization • Adaptation of the solution to support agency-specific applications, if necessary.

Automation Setup • Configuration of automated patch discovery, deployment, and reporting functionalities.

Training Materials and Conducted Training Sessions

• Development of training materials for users and administrators.

• Conducting training sessions to ensure proper usage and management of the system.

Monthly Patch Compliance and Deployment Reports Please provide cost per report and total cost for 1 year. The cost of 1 year of reports will be used to compute Proposer’s total price for evaluation purposes).

• Regular reports detailing patch compliance status and deployment activities.

Technical Support and Maintenance Plan

• Ongoing technical support and maintenance services.

• Plan for regular updates and patches to the patch management system itself.

Security and Compliance Documentation

• Documentation demonstrating compliance with relevant security standards and regulations (e.g., HIPAA, IRS

1075).

• Evidence of proactive and auditable security practices.

Acceptance Criteria • Defined criteria for the acceptance of each deliverable to ensure they meet the required standards and expectations.

Final Implementation Report

• Summary of the implementation process.

• Final assessment of the system's performance and compliance.

Offeror’s Total Estimated price to complete all deliverables listed

Signed by:__________________________________

Name/Title:_________________________________

Date:_______________________________________

EXHIBIT NO. 2

Reference Check Form

Proposer Name: __________________________________________

Reference Entity: __________________________________________

Reference Contact Name: __________________________________________

Contact Telephone Number: __________________________________________

Please respond to the following questions.

Score: 1-5 for each response.

1. Detailed description of Qualifying Engagement.

Score:

Comments:

2. Proposer’s role and functional area of Qualifying Engagement.

Score:

Comments:

3. Description of technical environment and complexity.

Score:

Comments:

4. Description comparing Qualifying Engagement to RFP Scope of Work.

Score:

Comments:

5. If given the opportunity, how likely would you use Proposer’s services again?

Score:

Comments:

Exhibit 3 Sample

Statement of Work

PART I. INTRODUCTION

The need for this system stems from the increasing frequency of cyber threats targeting third-party software, which often serve as attack vectors due to inconsistent or delayed patching.

Ensuring timely and automated patching of applications such as Adobe, Google Chrome, Mozilla Firefox, and others is essential for maintaining a secure IT environment and protecting sensitive data.

PART II. BACKGROUND

The purpose of this project is to procure, implement, and maintain a third-party patch management system to improve the security, compliance, and efficiency of patching non- Microsoft applications across the agency systems of Oregon Department of Human Services (ODHS) and Oregon Health Authority (OHA). Security compliance is a critical requirement for both ODHS and OHA due to state and federal regulations governing the protection of health and human services data, including HIPAA, IRS 1075, and other frameworks. A robust patch management solution supports these compliance efforts by demonstrating proactive and auditable security practices. This third-party patching solution will supplement existing tools and processes, such as native Microsoft patching mechanisms, by addressing gaps in coverage for widely used non-Microsoft software. It ensures a more comprehensive and automated approach to endpoint protection, enhances visibility into patching status, and reduces the overall risk footprint across both agencies.

PART III. TASKS AND DELIVERABLES

Task 1: Project Planning and Initiation

• Deliverable 1.1: Project Plan and Timeline

• Detailed project plan outlining phases, milestones, and timelines.

• Gantt chart or similar project management tool.

• Acceptance Criteria: Approval by the project manager and key stakeholders.

Task 2: Assessment and Evaluation

• Deliverable 2.1: Assessment Report

• Evaluation of current patch management processes and infrastructure.

• Identification of gaps and areas for improvement.

• Acceptance Criteria: Comprehensive report reviewed and accepted by the project team.

Task 3: Software Provisioning

• Deliverable 3.1: Software Licenses and Documentation

• Licenses for the patch management software.

• Comprehensive user and technical documentation.

• Acceptance Criteria: Licenses and documentation delivered and verified.

Task 4: Implementation and Configuration

• Deliverable 4.1: Configured and Tested Patch Management Solution

• Installation, configuration, and testing of the patch management software.

• Integration with existing tools (e.g., SCCM, Intune).

• Acceptance Criteria: Successful installation and configuration, passing all functional tests.

Task 5: Customization

• Deliverable 5.1: Customization Report

• Adaptation of the solution to support agency-specific applications, if necessary.

• Acceptance Criteria: Customization completed and validated by the project team.

Task 6: Automation Setup

• Deliverable 6.1: Automation Configuration

• Configuration of automated patch discovery, deployment, and reporting functionalities.

• Acceptance Criteria: Automation setup verified and operational.

Task 7: Training and Knowledge Transfer

• Deliverable 7.1: Training Materials and Conducted Training Sessions

• Development of training materials for users and administrators.

• Conducting training sessions to ensure proper usage and management of the system.

• Acceptance Criteria: Training sessions completed and feedback collected.

Task 8: Reporting

• Deliverable 8.1: Monthly Patch Compliance and Deployment Reports

• Regular reports detailing patch compliance status and deployment activities.

• Acceptance Criteria: Monthly reports delivered and reviewed.

Task 9: Support and Maintenance

• Deliverable 9.1: Technical Support and Maintenance Plan

• Ongoing technical support and maintenance services.

• Plan for regular updates and patches to the patch management system itself.

• Acceptance Criteria: Support and maintenance plan in place and operational.

Task 10: Security and Compliance

• Deliverable 10.1: Security and Compliance Documentation

• Documentation demonstrating compliance with relevant security standards and regulations (e.g., HIPAA, IRS 1075).

• Acceptance Criteria: Documentation reviewed and accepted by compliance officers.

Task 11: Final Implementation

• Deliverable 11.1: Final Implementation Report

• Summary of the implementation process.

• Final assessment of the system's performance and compliance.

• Acceptance Criteria: Final report approved by the project manager and key stakeholders.

PART IV. PAYMENT AND DELIVERABLE SCHEDULE

• Payments will be made upon acceptance of each deliverable as per the agreed schedule.

• Detailed breakdown of costs and payment terms will be included in the contract.

PART V. SPECIAL CONSIDERATIONS

• Consultant Key Persons: List of key personnel involved in the project.

• Change Orders: Procedures for requesting additional services or changes to the SOW.

PART VI. TRAVEL AND OTHER EXPENSES

• Travel expenses are not a separate item in this WOC. All compensation is included in the NTE Amount for each Deliverable.