Experian RIDP Presolicitation Notice.pdf

Requirement No.: 260228J Experian Remote Identity Proofing (RIDP) Services

Sole Source Synopsis

FAR Subpart 5.2 – Synopses of Proposed Contract Actions Requirement No.: 260228J

Pursuant to the requirements of FAR Subpart 5.2, the U.S. Department of Health and Human Services (HHS), Centers for Medicare & Medicaid Services (CMS) hereby gives notice of its intent to award a sole-source contract for the program titled “Experian Remote Identity Proofing (RIDP) Services.” This requirement is identified on the CMS Fiscal Year Forecast Opportunities listing under Requirement #260228J; a solicitation number will be assigned when the formal solicitation is released.

CMS intends to award a sole-source contract to:

Experian Information Solutions, Inc.

475 Anton Blvd.

Costa Mesa, CA 92626

This acquisition will be conducted using non-competitive procedures under the authority of 41 U.S.C. 253(c)(1) and FAR 6.302-1 – Only One Responsible Source, as Experian is the only source capable of providing the proprietary, customized Remote Identity Proofing (RIDP) services currently integrated into CMS systems and required for continuity of operations.

The contractor shall work with CMS to ensure the RIDP services provided are flexible and robust enough to meet both CMS’ current National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-2 and future RIDP requirements, including but not limited to digital e-authentication and NIST SP 800-63 suite (including but not limited to NIST 800-63-3 and 800- 63A) or its successor.

The contractor shall provide CMS with periodic analysis and recommendations regarding trends and improvements in the RIDP marketplace, industry best practices, and government mandates (whether in place now, proposed, or under discussion publicly).

The contractor shall ensure the services provided are efficient and effective at meeting the varied and evolving CMS RIDP requirements while providing the best possible user experience.

The key functionality being procured includes:

• Provide/maintain Identity Assurance Level 2 (IAL2) remote Identity Proofing based on CMS’ Technical Resource Architecture (TRA) or its successor, control IA-12. The TRA is found here.

• Provide/maintain Level of Assurance 3 (LOA3) remote Identity Proofing based upon CMS’ Technical Resource Architecture (TRA) or its successor.

• Provide/maintain Identity Assurance Level 2 (IAL2) remote Identity Proofing based on the CMS’ Technical Resource Architecture (TRA) or its successor.

https://tra.cloud.cms.gov/Network_Services/NS_0180_Access_Control_Identification_Authentication.htm?Highlight=authentication

• Provide/maintain Experian process (customization added for CMS) to link the CMS online proofing and call center proofing Knowledge Based Authentication (KBA) sub-codes via Experian’s Fraud Archive Reporting System (FARS) so that the outcome is updated based on the call center results (when a user fails online proofing).

• Experian process (customization added for CMS) to link the Experian online proofing and Experian call center proofing Risk Based Alternative (RBA) results via Experian’s GetRecord process so that the outcome is updated based on the call center results (when a user fails online proofing).

• Provide a Social Security Number (SSN) Verification Service, as customized for CMS, to verify whether the SSN provided by a person, as part of the Manual Identity Proofing (MIDP) process, is associated with that person.

• Provide a Proactive Monitoring/“Heartbeat” transaction service, as customized for CMS, for the purpose of determining whether the Experian RIDP Services are available.

• Provide a Login Risk Assessment service, as customized for CMS, to evaluate the risk associated with the device used upon User Login.

• Provide a Continuous Assessment (CA) service, as customized for CMS, which takes as input static data from the IDM Hub database and responds with the same responses provided by the RBA; the purpose being for CMS to detect if the risk profile associated with system users who have already been identity proofed has changed since they were granted system access.

• Actively retain transaction audit logs and provide auditing capabilities.

• Testing services for CMS applications integrated (or integrating) with the Experian RIDP

Services.

• Present to CMS all data set types used in its identity proofing services. CMS shall have the option to restrict usage of any controversial public data sets for identity proofing services if deemed necessary.

• Tracking and reporting usage data at the individual application level.

• Maintain Spanish Call Center interpretation services, as customized for CMS, supporting the Experian phone-based identity proofing of consumers purchasing health insurance through an Affordable Care Act exchange (federal or state) who failed online RIDP.

• Maintain Limited English Proficiency (LEP) interpretation services, as customized for CMS (supporting approximately 202 languages), supporting the Experian phone-based identity proofing of consumers purchasing health insurance through an Affordable Care Act exchange (federal or state) who failed online RIDP.

• Provide Experian Professional Services (PS) support to CMS applications integrated with, or in the process of integrating with, the Experian RIDP services.

• Support CMS and other teams during audits, including but not limited to Security Impact Analysis (SIA) and Cybersecurity and Risk Assessment Program (CSRAP) reviews.

• Provide reporting, and analysis, of RIDP transactions and services.

CMS anticipates awarding a sole-source contract with:

• One (1) one-year base period, and

• Four (4) one-year option periods.

Product Service Code (PSC): R615 – Support–Administrative: Background Investigation

This notice is not a Request for Proposal (RFP). CMS anticipates releasing a formal RFP in December 2025, with an anticipated award date of February 2026. All responsible sources may submit a capability statement, proposal, or quotation, which will be considered by the agency.

Deadline for submissions:

1:00 PM Eastern Time on Wednesday, December 17, 2025

Statements of interest and capability must be submitted via email. Telephone and fax submissions will not be accepted. The Government is under no obligation to award a contract as a result of this notice.

Primary Point of Contact Jeremy Garvin Contracting Officer Jeremy.Garvin@cms.hhs.gov 7500 Security Blvd.

Baltimore, Maryland 21244

Secondary Point of Contact Benjamin Peter Contract Specialist Benjamin.Peter@cms.hhs.gov 7500 Security Blvd.

Baltimore, MD 21244 mailto:Jeremy.Garvin@cms.hhs.gov mailto:Benjamin.Peter@cms.hhs.gov