Questions and Answers-B-34073~1.docx

DHS IFB SOC 1 Type 2 Audit B-34073 Questions and Answers

1. Was there a Pre-Submission conference performed?

A. No

2. Will proposals from offerors outside of Illinois be accepted? If so, at what point does the offeror need to register with the State?

A. Yes. Offeror must be registered in BidBuy and Illinois Board of Elections prior to submission of bid. Must be registered to do business in Illinois and have Illinois Dept. of Human Rights Registration number prior to award. More information can be found in IFB and Forms A.

3. It is noted in sections A.9 and A.10 of the Solicitation “Bids must be submitted via BidBuy only”. Do vendors need to be registered to BidBuy to be able to upload documents?

A. Yes.

4. What is the bid review and grading process? Will all bids that meet technical requirements be reviewed despite of price A. All bids that meet technical requirements will deemed responsive. All responsive Bids will be awarded on lowest quote.

5. What is the driving force behind DHS seeking to obtain an SOC 1 Type 2 examination report?

A. The Department of Human Services has received a repeated annual audit finding for several years because a SOC 1 type 2 audit has not been performed on the IES and is required to be done

6. Can you identify the user entities who will receive the SOC 1 Type 2 report?

A. The Department of Human Services staff, The Department of Healthcare and Family Services staff and our external auditors.

7. Can you provide some background regarding the Integrated Eligibility System (IES)?

A. The Centers for Medicare & Medicaid Services (CMS) is responsible for implementing many provisions of the health insurance reform law, the Patient Protection and Affordable Care Act of 2010. These initiatives benefit millions of Americans by allowing them to readily obtain affordable healthcare services.

The Integrated Eligibility System (IES) and Application for Benefits Eligibility (ABE) customer self-service web portal transformed the way we work with Medicaid, SNAP and TANF customers. IES is used to process all new applications for Medicaid, SNAP and TANF. In addition, the Application for Benefits Eligibility (ABE) customer web portal, provides a process whereby new customers can apply for benefits and upload proof documentation. The Provider and Partner Portals were launched in 2013. External partners trained to assist in completing applications for the new ACA adult population are able to tally their assistance, and All Kids Assistance (AKA) Providers and Medical Presumptive Eligibility (MPE). Providers can submit and track applications for their customers.

The medical programs involved include Medicaid, Title XIX of the Social Security Administration (SSA), Children's Health Insurance Program (CHIP), Title XXI of the SSA, and various state specific programs, some of which are extensions of federally funded programs, while others operate fully at the expense of the state.

The IES stores customer Personally Identifiable Information (PII) and Protected Health Information (PHI).

After taking over IES physical infrastructure in 2018, the State began a complete refresh of the hosting platform and components, known as the IES Technical Refresh. The Tech Refresh upgrades are critical to keeping IES operational and running efficiently in order to serve the over four million Illinoisans who receive medical, SNAP, and cash assistance benefits from the State. Operational refreshes of hardware and software are necessary every 3-5 years to keep systems such as IES stable, secure, and supported. The Tech Refresh initiative also provides a critical opportunity to properly size the infrastructure necessary, as the initial infrastructure was not sufficient to allow for system growth.

8. Per section 1.3 Milestones and Deliverables of the solicitation it states that an initial detailed assessment will need to be completed within 120 days of the start of the agreement. When do you expect the agreement to start?

A. The agreement will start when the contract has been fully executed by both parties. The timeline can vary.

9. Per section 1.3 Milestones and Deliverables of the solicitation it states that an initial SOC 1 Type 2 examination will need to be completed within 120 days after the completion of the initial detail review. If control weakness and/or gaps are identified through the assessment process will DHS be willing to postpone the start and completion of the initial SOC examination to allow for mitigation?

A. DHS can’t guarantee an extension to allow for mitigation.

10. What is the intended period of scope for the SOC examination? (e.g., 12 months, calendar year 2023).

A. 12-month periods from 7/1 thru 6/30 each fiscal year

11. Has DHS identified the desired Control Objectives related to the IES to be covered by the assessment and SOC examination?

A. No, we have all staff identified for the selected vendor to work with upon start of the contract

12. Are there any subservice organizations engaged in the delivery of IES services which are material in nature to the IES system?

A. Yes

13. If subservice organizations are engaged, can you identify the entities and provide the level of services provided?

A. Deloitte is the application developer; NTT Data performs project management for the IES technical refresh project; Kyndryl “formerly IBM consultants” and also work on the IES the technical refresh project and the infrastructure build out

14. If subservice organizations are engaged, is the intention to include their controls in the scope of the initial assessment and in the performance of the SOC 1 Type 2 examination? Or is the intent to “Carve-Out” any or all subservice organizations from the scope?

A. No, it is not our intention to include subservice organizations in the engagement.

15. Is DHS open to performing the work 100% remote, Hybrid, or 100% onsite?

A. A majority of external audit staff are working remotely, but DHS will allow auditors to be scheduled onsite with prior approval.

16. If onsite, at which location(s) will be the work take place?

A. This will vary.

17. Per section 2.1 Format of Pricing of the solicitation it is requested that vendors provide the hourly labor rates for the various staffing positions, however, is the estimated number of hours by position also to be included along with the extended cost for each position?

A. The BidBuy line item requests that vendors enter their quoted hourly labor rate only.

18. Can vendors simply provide pricing in a summary format for each deliverable? For example, $ XXX for initial assessment and $ XXX for the SOC examination for the initial and subsequent years?

A. Vendors must enter pricing in the BidBuy line items tab. Providing pricing in any other way than required on the BB tab may result in the vendor being deemed non-responsive.

19. Per section 2.3 of the solicitation, it is stated that “Expenses are not allowed”, however, if travel costs are to be incurred how should vendors include this cost in the bid?

A. Travel expenses would have to be included in the quoted hourly rate.

20. Does DHS have a budget range for the initial assessment and for the SOC examination? If so, what is the budget range?

A. This information is irrelevant to providing a responsive bid.