RFP_2026-01_Information_Security_Services__FINAL.pdf

RFP 2026-01: Information Security Services (V.05.28.2025) Page 1

Request for Proposal

RFP 2026-01: Information Security Services

July 29, 2026

RFP 2026-01: Information Security Services (V.05.28.2025) Page 2

TABLE OF CONTENTS

1. INTRODUCTION

1.1 Overview

1.2 Key Action Dates

1.3 Contact

1.4 Contract Term

1.5 Contract Amount

1.6 Contract Amendment

1.8 RFP Questions

1.9 Submission of Proposals

1.10 Format of Proposals

1.11 Covered California’s Rights

1.12 Rejection of Proposals

1.13 Errors in Proposals

1.14 Protest

1.15 Debrief Process

1.16 Disposition of Proposals

1.17 Contract Execution and Performance

1.18 Subsequent Solicitation

1.19 Addition or Subtraction of Services

1.20 News Releases and Social Media

2. PROJECT TEAM

2.1 Project Team Minimum Qualifications

2.2 Project Team Desirable Qualifications

2.3 Reassignment of Personnel

3. SCOPE OF WORK

3.1 Background

3.2 Purpose

3.3 Scope of Work

3.4 Contract Completion Criteria

3.5 Project Assumptions and Constraints

3.6 Payment and Invoicing

4. REQUIRED PROPOSAL SUBMISSION CONTENT

4.1 Proprietary Information and Confidential Status of Responses

4.2 Administrative Requirements

4.3 Technical Requirements

5. EVALUATION AND SELECTION FOR CONTRACT AWARD

RFP 2026-01: Information Security Services (V.05.28.2025) Page 3

5.1 Phase One: Administrative Requirements

5.2 Phase Two: Technical Requirements

6. PREFERENCE AND INCENTIVE PROGRAMS

6.1 How the Preferences and Incentives Work

6.2 Small Business Preference

6.3 Disabled Veteran Business Enterprise Incentive

6.4 Programs for Non-Small Businesses with Subcontractors

6.5 Target Area Contract Preference Act

7. ATTACHMENTS

8. MODEL CONTRACT WITH EXHIBITS

RFP 2026-01: Information Security Services (V.05.28.2025) Page 4

1. INTRODUCTION

1.1 Overview

Potential Proposers are invited to review and respond to this Request for Proposal (RFP). By submitting a proposal, the Proposer organization agrees to the terms and conditions stated in this RFP.

Potential Proposers should carefully read this document and all attachments in their entirety, as they may contain binding provisions that affect the rights and obligations of Proposer organizations. Proposers must comply with the instructions contained in this document. Proposals for this RFP must be submitted to the Covered California contact designated in Section 1.3 below.

1.2 Key Action Dates

Proposers are advised of the key dates and times shown in the table below and are required to adhere to them. All times noted in this document are Pacific Time

(PT).

KEY ACTION DATES

Request for Proposal Release Date: July 29, 2026 RFP Questions Due Date and Time: August 05, 2026, by 12:00 PM PST Responses to Questions Posted By: August 10, 2026 Proposal Due Date and Time: August 31, 2026, by 12:00 PM PST Notice of Intent to Award: Week of September 16, 2026 Anticipated Contract Term: December 1, 2026, to November 30, 2031

1.3 Contact

For questions regarding this RFP, contact Covered California via email at HBEXSolicitation@covered.ca.gov with “RFP 2026-01” in the subject line. The Covered California contact for this solicitation is Joyce Anne Asper.

Please reference the RFP number in all communications. Phone calls will not be accepted.

1.4 Contract Term

The initial term of the contract shall be for five (5) years, from December 1, 2026 to November 30, 2031; however, the contract term is subject to change and may be amended. The resulting contract will be of no force or effect until signed by both parties. Performance shall not commence until a valid contract has been executed mailto:HBEXSolicitation@covered.ca.gov

RFP 2026-01: Information Security Services (V.05.28.2025) Page 5 between the successful Proposer and Covered California. Covered California will not pay for any services performed prior to the execution of a valid contract.

1.5 Contract Amount

Proposal submissions shall not exceed $12,500,000.00 in total proposed costs for the base term of the contract. Proposals that exceed this amount will not be considered for selection. It is expected that the approved funding for the contract will not exceed approximately $2,500,000.00 per year for the term of the contract, including any extensions of the term for a maximum of $17,500,000.00 if all option years are exercised.

Funding is subject to annual budget approval by the Covered California Board of Directors. If full funding does not become available, Covered California may terminate or amend the contract to reflect reduced funding and reduced deliverables.

1.6 Contract Amendment

Covered California may, at its sole discretion, extend the term of the contract for two (2) additional years. The total number of contract years shall not exceed seven

(7) years.

The parties may increase or decrease funding through an amendment, but cannot exceed the amount or rates set by Contractor’s proposal. Funding for options years may not be used in advance and may not exceed the funding amount set in the initial contract term unless authorized by the solicitation.

Any amendment will require Covered California’s approval in accordance with its policies and procedures. An amendment may require a formal resolution from the Covered California Board of Directors before Covered California can execute it.

1.7 RFP Questions

Prospective Proposers must submit any questions regarding this RFP by the due date and time specified in the Key Action Dates table in Section 1.2. Only questions sent to the email address provided in Section 1.3 will be accepted.

Prospective Proposers must provide enough specific information to enable Covered California to identify and respond to their questions. When submitting questions, please reference the RFP number in the subject line “RFP 2026-01”.

Responses to questions received during the RFP Questions time period will be posted on the website at http://hbex.coveredca.com/solicitations. Proposers who fail to report a known or suspected problem with this RFP or who fail to seek clarification or correction of this RFP do so at their own risk.

http://hbex.coveredca.com/solicitations/

RFP 2026-01: Information Security Services (V.05.28.2025) Page 6

In its sole discretion, Covered California may contact a prospective Proposer to seek clarification or additional information regarding any question received.

1.8 Submission of Proposals

1. Proposers’ Cost: Costs for developing proposals and attending Proposers’ Conferences are entirely and solely the responsibility of the Proposer and are not chargeable to Covered California.

2. Completion of Proposals: Proposers are required to be both responsive (fully compliant) and responsible (capable and qualified to perform work) relative to the solicitation requirements. Proposals must be complete in all respects and contain all required items as described in the requirements established within this RFP, its attachments, and any written responses to questions or amendments posted by Covered California on its website. A proposal may be rejected by Covered California, in its sole discretion, if the proposal is conditional, incomplete, or irregular in any way. A proposal must be rejected by Covered California if any defect or irregularity constitutes a material deviation from the RFP requirements as determined by Covered California, in its sole discretion.

3. False or Misleading Statements: Proposals which contain false or misleading statements, or which provide references that do not support an attribute or condition claimed by the Proposer may be rejected. If, in the sole opinion of Covered California, such information was intended to mislead Covered California in its evaluation of the proposal or was included as a result of gross negligence attributable to the Proposer, and the attribute, condition, or capability is a requirement of this RFP, it shall be grounds for rejection of the proposal.

4. Errors: If a Proposer discovers any ambiguity, conflict, discrepancy, omission, or other error in this RFP, the Proposer shall immediately notify Covered California of such error by emailing the contact in Section 1.3 and shall request a modification or clarification of the RFP. Modifications or clarifications will be given by written notice posted on the website at http://hbex.coveredca.com/solicitations without divulging the source of the request for modification or clarification. Covered California shall not be responsible for a Proposer’s failure to correct errors, nor for any Proposer’s failure to regularly and timely check the website for changes.

5. Importance of Meeting Deadlines: Proposers are responsible and assume all risks for the delivery and receipt by Covered California of all proposal submissions prior to the submission deadline. The stated deadlines for submitting a proposal and all required materials for receipt by Covered California will be strictly enforced. Submissions that are incomplete or received after the stated deadline may not be accepted.

RFP 2026-01: Information Security Services (V.05.28.2025) Page 7

6. Assessment of Proposals: All proposals will be assessed based on the evaluation criteria as set forth in this RFP and at Covered California’s sole discretion. The selection and contract award, if made, will be made to a single Proposer unless otherwise specified in this RFP. The Scope of Work (SOW) and the selected Proposer’s proposal, including proposed cost, will be incorporated by reference into the resulting contract.

1.9 Format of Proposals

Proposers must submit a proposal package that contains all required attachments, documents, narrative responses, and Model Contract exhibits. Proposals must be submitted electronically via email to HBEXSolicitation@covered.ca.gov with “RFP 2026-01” in the subject line. Hard copy proposals will not be accepted and will be deemed non-responsive.

1. Electronic Signatures

Proposers may sign required attachments and documents electronically or with ink, so long as the attachments and documents are submitted in PDF format.

Signatures must be provided by an authorized signatory who is authorized to contractually bind the Proposer organization.

2. Narrative Format

a. Narrative portions of proposals should be prepared to provide a straightforward, concise delineation of the Proposer’s capabilities to satisfy the requirements of this RFP. Emphasis should be on conformance with the RFP instructions, responsiveness to the RFP requirements, and completeness and clarity of content. Expensive bindings, colored displays, promotional materials, etc., are not necessary nor desired.

b. Proposers must follow the format requirements listed below for all narrative portions of the proposal submission. Failure to do so may result in an entire proposal or affected section not being read or evaluated, at Covered California’s sole discretion.

1) Use a Times New Roman, Arial, or Calibri font of at least 12-point size throughout unless a form is required by Covered California that contains a smaller font.

2) Use one (1)-inch margins at the top, bottom, and sides.

3) Sequentially number the pages in each section and clearly identify each section in the order requested. When a page limit is noted, pages exceeding the limit will not be reviewed or scored. It is not necessary to paginate the required forms.

RFP 2026-01: Information Security Services (V.05.28.2025) Page 8

4) Place the Proposer organization’s name in a header or footer on every page. If the Proposer's name is not already entered elsewhere on a completed certification or form, add it to a header, footer, or signature block.

3. Model Contract with Exhibits

All proposals must be based on and conform to the Model Contract provided with this solicitation. Proposers should review the Model Contract in its entirety prior to submitting a proposal. Proposers must submit as part of their proposals any changes or exceptions to the Model Contract that they wish to negotiate.

However, extensive or significant changes or exceptions to the Model Contract may make the proposal non-responsive to the RFP if Covered California, in its sole discretion, determines that the proposed changes or exceptions materially change the contractual relationship between the parties. Proposer-suggested changes or exceptions to the Model Contract exhibits must be documented via tracked changes to the documents using Microsoft® Word®. All Model Contract changes or exceptions must be included in the proposal package at the time of submission. No additional changes or exceptions may be presented during contract negotiations. Covered California reserves the right to reject all changes and exceptions in the proposal package.

1.10 Covered California’s Rights

1. Verification of Proposer Information

By submitting a proposal, the Proposer authorizes Covered California to do the following:

a. Verify any and all claims made by the Proposer, including, but not limited to, verification of prior experience and possession of all other required qualifications; and

b. Check any and all references identified by the Proposer, or any other resource known or identified by Covered California, to confirm the Proposer’s business integrity and history of providing effective, efficient, competent, and timely goods and/or services.

2. Covered California may, in its sole discretion, modify the RFP prior to the proposal submission deadline by the issuance of an addendum on the website listed at http://hbex.coveredca.com/solicitations.

3. Covered California reserves the right to reject any proposal that does not satisfy the requirements set forth in this RFP. Before submitting a response to this RFP, prospective Proposers should review and correct all errors and confirm compliance with all RFP requirements.

RFP 2026-01: Information Security Services (V.05.28.2025) Page 9

1.11 Rejection of Proposals

1. Deviations may cause a proposal to be deemed non-responsive and to not be considered for award. Covered California may reject any or all proposals and/or may waive any immaterial deviation or defect in a proposal. Covered California's waiver of any immaterial deviation or defect shall in no way modify the RFP documents or requirements and shall not excuse the Proposer from full compliance with the RFP specifications if awarded the contract.

2. Proposals that are not received by the date and time specified in Section 1.2 Key Action Dates will be maintained separately from proposals that have been timely received. Proposals received after the due date may only be considered upon written approval of Covered California’s Executive Director or his/her designee specifying the reason(s) for acceptance and consideration of the untimely proposal.

3. Issuance of this RFP in no way constitutes a commitment by Covered California to award a contract. Covered California reserves the right to do the following:

a. Reject any or all proposals received in response to this RFP, or portions of proposals;

b. Amend or cancel this RFP at any time, after which Covered California may reissue the RFP at a later date; and

c. Consider a Proposer’s past contract performance with Covered California in its selection of a Proposer pursuant to this RFP.

4. Non-Responsive Proposals

A proposal may be deemed non-responsive and subsequently rejected if any of the following occur:

a. The proposal is received after the exact time and date set forth in Section

1.2 Key Action Dates for receipt of each submission;

b. The Proposer fails to meet one (1) or more of the minimum qualifications specified in Section 2, Project Team;

c. The Proposer fails to submit or fails to complete and sign any required attachments as instructed in this RFP;

d. The proposal contains false, inaccurate, or misleading statements or references;

RFP 2026-01: Information Security Services (V.05.28.2025) Page 10

e. The Proposer is unwilling or unable to fully comply with Covered California’s proposed contract provisions; or

f. The Proposer supplies conditional cost information, incomplete cost information, or cost information containing unsigned/uninitiated alterations or irregularities.

5. Business in Good Standing

Proposer acknowledges that when agreements are to be performed in the State of California by corporations or vendors, Covered California will verify, prior to awarding any State contract, the following information in order to ensure that all obligations due to the State are fulfilled:

6. Corporation in Good Standing

As required by California law, Proposer organizations must be in good standing and qualified to do business in California at the time of submitting a proposal and, if selected by Covered California, during the entire term of the contract. If the Proposer organization is incorporated, the Proposer’s status with the California Secretary of State (SOS) must be Active; a status of Cancelled or Suspended will cause the Proposer to be deemed non-responsive. This requirement does not apply to sole proprietors and general partnerships.

Unless otherwise specified, the Proposer shall not submit copies of its organization’s bylaws or Articles of Incorporation.

“Doing business” is defined in California Revenue and Taxation Code section 23101 as actively engaging in any transaction for the purpose of financial or pecuniary gain or profit. Although there are some statutory exceptions to taxation, rarely will a corporate contractor performing within the State not be subject to the franchise tax.

Both domestic and foreign (those incorporated outside of California) corporations must be in good standing in order to be qualified to do business in California.

7. State Tax Delinquency

a. Covered California will verify with the California Franchise Tax Board (FTB) and California Department of Tax and Fee Administration (CDTFA) that the Proposer is not on a prohibited list due to tax delinquencies. The proposal will be considered non-responsive if the Proposer is on any of these lists.

b. The list established by FTB can be found at: https://www.ftb.ca.gov/about-ftb/newsroom/top-500-past-due-balances/corporate-income-tax-list.html.

https://www.ftb.ca.gov/about-ftb/newsroom/top-500-past-due-balances/corporate-income-tax-list.html https://www.ftb.ca.gov/about-ftb/newsroom/top-500-past-due-balances/corporate-income-tax-list.html

RFP 2026-01: Information Security Services (V.05.28.2025) Page 11

c. The list established by CDTFA can be found at:

https://www.cdtfa.ca.gov/taxes-and-fees/top500.htm.

8. Executive Order N-6-22 – Russia Sanctions

On March 4, 2022, Governor Gavin Newsom issued Executive Order N-6-22 (the EO) regarding Economic Sanctions against Russia and Russian entities and individuals. “Economic Sanctions” refers to sanctions imposed by the U.S.

government in response to Russia’s actions in Ukraine, as well as any sanctions imposed under state law. By submitting a bid or proposal, Contractor represents that it is not a target of Economic Sanctions. Should Covered California determine Contractor is a target of Economic Sanctions or is conducting prohibited transactions with sanctioned individuals or entities, that shall be grounds for rejection of the Contractor’s bid/proposal any time prior to contract execution, or, if determined after contract execution, shall be grounds for termination by Covered California.

1.12 Errors in Proposals

1. An error in a proposal may cause the rejection of that proposal; however, Covered California may, in its sole discretion, retain the proposal and make certain corrections. In determining if a correction will be made, Covered California will consider the conformance of the proposal to the format and content required by this RFP and any unusual complexity of the format and content required by this RFP.

a. If the Proposer's intent, as determined by Covered California, is clearly established based on its review of the complete proposal submission, Covered California may, in its sole discretion, correct an error based on that established intent.

b. Covered California may, in its sole discretion, correct obvious clerical errors.

c. A Proposer may modify a proposal after submission by withdrawing its original proposal and resubmitting a new one (1) as long as it is received prior to the proposal submission deadline. Modifications offered by a Proposer in any other manner, oral or written, will not be considered.

d. A Proposer may withdraw its proposal by submitting a written withdrawal request to Covered California, signed by the Proposer or an authorized agent. Proposals may not be withdrawn subsequent to the proposal submission deadline without cause.

e. No oral understanding or contract shall be binding on either party.

https://www.cdtfa.ca.gov/taxes-and-fees/top500.htm

RFP 2026-01: Information Security Services (V.05.28.2025) Page 12

2. Covered California reserves the right to contact any Proposer at any stage of the solicitation process to collect additional clarifying information, if deemed necessary and appropriate by Covered California.

1.13 Protest

Any protest properly submitted within five (5) business days of the posting of the Notice of Intent to Award will be considered. All protests will be reviewed and decided by the Executive Director or his/her designee. The following protest procedures shall be followed:

1. General

An unsuccessful Proposer may protest the intended award to another Proposer by following the terms and conditions outlined below. The protester challenging Covered California’s intended award bears the burden of proof.

2. Grounds

Protester must cite the specific grounds for the protest and provide all facts and citations of law sufficient to support the protest and enable the Executive Director or his/her designee to make an informed, proper decision. Covered California will determine, in its sole discretion, if the protester has demonstrated sufficient grounds to allow the protest to be heard. Abuse of the protest process by unsuccessful Proposers for the purpose of securing confidential information about other Proposers will be rejected by Covered California. The sole grounds for a protest are:

a. Protester reasonably believes that Covered California has acted in an arbitrary and capricious manner; and/or

b. Protester reasonably believes that Covered California committed an error in the proposal process as stated in the solicitation that is sufficiently material to justify invalidation of the intended award.

There shall be no basis for protest if Covered California rejects all proposals.

3. Requirements for Protest

Protests must be submitted in writing, signed by an individual who is authorized to contractually bind the Proposer, and include all grounds and supporting facts and evidence upon which the protest is based, as well as all citations of law, rule, regulation or procedure upon which the protester relies. Protests must be delivered to Covered California at the address indicated below by certified or registered mail or in person, in which case the protester should obtain a delivery receipt. Protests must be received by Covered California no later than

RFP 2026-01: Information Security Services (V.05.28.2025) Page 13 the close of business five (5) business days after the Notice of Intent to Award has been posted.

Protests must be emailed to the email address shown in Section 1.3 above.

The Executive Director’s or his/her designee’s decision shall be final.

4. Terms of Protest

Scoring documents, evaluation and selection documents, other Proposers’ submissions, or any other record created during the review of proposals submitted in response to this RFP are not public records and are exempt from disclosure as public records pursuant to Government Code section 100508(a).

A protester who has demonstrated a legitimate ground for protest as described above may be provided limited access to certain relevant, non-public information regarding the RFP and Covered California’s consideration of submissions in response to the RFP upon the protester’s execution of a Non- Disclosure Agreement provided by Covered California and the approval of Covered California’s General Counsel or his/her designee. Trade secret, proprietary, and confidential information will be redacted from any documents disclosed to protester as part of the protest process.

1.14 Debrief Process

1. Once the contract has been awarded, any bidder can request a debrief of their bid by emailing the BSB contract analyst at HBEXSolicitation@covered.ca.gov.

Debriefs will be coordinated with bidders upon request up to 10 business days after the Notice of Intent to Award is released. If a request is received after this date, it will be declined.

2. The Contract Analyst will work with the Evaluation Team to determine which sections of the Evaluation and Selection Report (ESR) will be shared with the requested bidder.

3. A debrief will be presented via written letter, email, phone, or video call (i.e., Microsoft Teams, Zoom, etc.) at the discretion of the Contracts Unit.

4. Per Government Code Section 100508, the debrief will not include the deliberative processes, discussions, communications, any other portion of the negotiations, records that reveal claims data, encounter data, cost detail, information about payment methods, contracted rates paid by qualified health plans to providers, or enrollee coinsurance or other cost sharing that can be used to determine contracted rates paid by plans to providers.

RFP 2026-01: Information Security Services (V.05.28.2025) Page 14

1.15 Disposition of Proposals

Upon proposal opening, all documents submitted in response to this RFP become the property of the State of California.

1.16 Contract Execution and Performance

Performance shall begin no later than the date set forth in this RFP by Covered California and after the contract is fully executed, unless a later date is mutually agreed upon by Covered California and the Contractor. Notwithstanding any other provision, should the Contractor fail to commence work on the agreed date and time, Covered California reserves the right to terminate the contract upon five (5) business days written notice to the Contractor. In such an event, the Contractor shall be liable to Covered California for the difference between the Contractor’s cost proposal and, if greater, the actual cost of performing the work by a replacement contractor.

All performance under the contract shall be completed before the termination date of the contract, unless an earlier date is specified in the contract.

1.17 Subsequent Solicitation

If at any time during the negotiation of a contract with the successful Proposer, Covered California determines it is not able to reach an agreement with the successful Proposer, Covered California may, in its sole discretion, terminate the negotiations and engage the next highest-scored Proposer without performing a subsequent solicitation.

1.18 Addition or Subtraction of Services

Notwithstanding that proposals have been submitted, at Covered California’s sole discretion, the SOW may be modified prior to contract award to add or remove services through an addendum. If the date and time for submission of proposals has passed as of the time the addendum is posted and proposals have been received, Covered California, in its sole discretion, may restrict responses to the modified SOW so that only entities that submitted timely proposals in response to the initial RFP may respond to the addendum.

1.19 News Releases and Social Media

By submitting a proposal, Proposers and the selected Contractor agree that they will not issue news releases nor make statements to the news media or through social media channels pertaining to this RFP, their proposals, the contract, or work resulting therefrom, without first obtaining prior approval from Covered California.

RFP 2026-01: Information Security Services (V.05.28.2025) Page 15

2. PROJECT TEAM

Covered California seeks a team with experience and knowledge of the process outlined in this RFP and the Model Contract Exhibit A – Scope of Work. Proposers must demonstrate that the project team members who will be assigned to the project possess the experience, education, knowledge, and skills required to perform the work described in this RFP.

2.1 Project Team Minimum Qualifications

The required minimum qualifications for Proposers include the following:

1. Eligible Contractors must not have provided information technology services for CalHEERS or Covered California within the following timeframe: July 1, 2024 to present day.

2. The Contractor must provide a team of three full-time security professionals, including one (1) designated manager responsible for overall oversight, coordination, quality control, and contractor staffing matters. The Contractor must also be able to provide additional qualified staff, as needed, to support special projects, surge efforts, or implementation of new security capabilities.

3. The Contractor's team must have sufficient skill, capacity, and coverage to function as an extension of Covered California’s Information Security Office (ISO), including maintaining coverage during Covered California core business hours and providing on-call support for security incident response, when required.

4. All Contractor's personnel must be able to satisfy Covered California background clearance requirements before accessing confidential information, personally identifiable information, protected health information, federal tax information, financial information, or related systems and devices.

5. The Contractor's team must demonstrate substantial experience across the following security service areas: governance, risk, and compliance; security engineering and architecture; security incident response; third-party risk management; technical security; incident detection and monitoring; and data protection and insider threat.

6. The team must be able to develop, update, and maintain security policies, procedures, standards, and related documentation; support administration and use of a governance, risk, and compliance platform; and provide risk advisory services that support compliance with Centers for Medicare & Medicaid Services (CMS) Acceptable Risk Controls for ACA, Medicaid, and Partner Entities (ARC-AMPE), IRS Publication 1075, and other applicable laws, regulations, standards, and internal policies.

RFP 2026-01: Information Security Services (V.05.28.2025) Page 16

7. The team must demonstrate hands-on capability to design, review, and maintain secure architecture, security patterns, and technical controls for both on-premises and cloud environments, and to provide security design guidance that reduces risk and aligns with applicable requirements.

8. The team must demonstrate experience supporting incident response activities, including incident management support, development and maintenance of incident response plans and playbooks, investigations, evidence handling, communications, reporting, post-incident reviews, and escalation reporting to executive leadership.

9. The team must demonstrate experience performing third-party security due diligence, risk assessments, contract and control reviews, continuous monitoring, and risk reporting sufficient to support vendor compliance with applicable legal, regulatory, and policy requirements.

10. The team must demonstrate technical security expertise across network security, endpoint security, vulnerability management, identity and access management, cloud security, application security, log aggregation, log analysis, threat detection, response tuning, and operational reporting.

11. The team must demonstrate experience supporting data protection and insider threat activities, including confidential data discovery and cataloging, data classification, and implementation of controls such as data loss prevention, encryption, and access controls.

12. The Contractor must provide a qualified independent assessor team, under a separate reporting structure from operations support staff, with demonstrated experience conducting independent security and privacy assessments using ARC-AMPE or National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5 for complex cloud-based systems that process confidential data, and preparing required CMS assessment documentation, including the Security Assessment Workbook.

13. The Contractor must demonstrate the ability to perform independent, risk-based penetration testing and workstation forensic services, including planning, controlled exploitation, reporting, remediation support, retesting, and evidence preparation for legal, human resources, privacy, or investigative matters.

14. The Contractor must demonstrate the ability to provide written reports, formally respond to Covered California review findings, maintain staff continuity, obtain advance approval for substitutions, and perform work using Covered California devices and applications, except where penetration testing or forensics requires otherwise.

RFP 2026-01: Information Security Services (V.05.28.2025) Page 17

2.2 Technical Minimum Qualifications

1. The Contractor must demonstrate technical capability to design, review, implement, and maintain secure architectures, security patterns, and technical controls for both on-premises and cloud environments.

2. The Contractor must demonstrate hands-on expertise in network security, endpoint security, vulnerability management, identity and access management, cloud security, and application security.

3. The Contractor must demonstrate experience supporting security monitoring and detection capabilities, including log aggregation, log analysis, threat detection, response tuning, operational reporting, and assessment or configuration of monitoring tools and processes.

4. The Contractor must demonstrate capability to support Covered California’s incident response program through development and maintenance of incident response plans and playbooks, support for investigations and evidence handling, communications and reporting coordination, and post-incident review activities.

5. The Contractor must demonstrate technical capability to support data protection and insider threat functions, including confidential data discovery and cataloging, data classification, and implementation of data loss prevention, encryption, and access controls.

6. The Contractor must demonstrate experience conducting independent security and privacy assessments for complex cloud-based systems that process confidential data using ARC-AMPE or NIST SP 800-53 Revision 5, including control evaluation, identification of weaknesses and vulnerabilities, and development of risk-based remediation recommendations.

7. The Contractor must demonstrate the ability to prepare and deliver required CMS assessment documentation in the current approved format, including the Security Assessment Workbook, in support of annual compliance and authorization activities.

8. The Contractor must demonstrate experience performing independent, risk-based penetration testing, including planning, rules of engagement, controlled exploitation, reporting, remediation support, and retesting.

9. The Contractor must demonstrate capability to provide workstation digital forensics services sufficient to preserve and prepare evidence for legal, privacy, human resources, or investigative proceedings.

RFP 2026-01: Information Security Services (V.05.28.2025) Page 18

10. The Contractor must demonstrate ability to use Covered California devices and applications for contract performance, except where penetration testing or forensics activities require otherwise.

2.3 Project Team Desirable Qualifications

Covered California seeks Proposers with the following desirable qualifications:

1. Preference will be given to teams with prior experience supporting highly regulated public sector, healthcare, or health exchange environments subject to CMS, ARC-AMPE, NIST 800-53, IRS Publication 1075, and comparable privacy and security requirements.

2. Preference will be given to teams that can demonstrate successful delivery of integrated security services across both strategic and operational domains, including governance, risk, and compliance; architecture; engineering;

monitoring; incident response; data protection; and vendor risk management within a single coordinated team model.

3. Preference will be given to teams with advanced experience in modern cloud and hybrid environments, especially where they have implemented or improved security patterns, monitoring tools, automated controls, threat detection tuning, identity and access controls, and data protection capabilities.

4. Preference will be given to teams with demonstrated ability to provide surge resources or specialized subject matter experts quickly for independent assessments, penetration testing, digital forensics, corrective action support, or implementation of new security capabilities.

5. Preference will be given to teams with strong program management and quality assurance practices, including clear reporting, executive communication, timely deliverable revisions, and disciplined response to review findings and corrective actions.

6. Preference will be given to teams that can demonstrate a strong record of personnel continuity, low turnover on comparable engagements, and effective knowledge transfer that minimizes disruption when staffing changes become necessary.

2.4 Technical Desirable Qualifications

1. Preference will be given to Contractors with demonstrated experience implementing or improving security controls in complex hybrid or cloud-first environments that handle confidential, regulated, or high-risk data.

RFP 2026-01: Information Security Services (V.05.28.2025) Page 19

2. Preference will be given to Contractors with experience maturing or administering enterprise governance, risk, and compliance platforms in support of governance, risk, compliance, and audit activities.

3. Preference will be given to Contractors with demonstrated success improving monitoring and detection operations through better log management, alert tuning, threat detection use cases, and actionable operational reporting.

4. Preference will be given to Contractors with experience implementing or advising on automation, policy, and control improvements across identity, endpoint, network, cloud, and application security domains.

5. Preference will be given to Contractors with strong technical experience supporting corrective action planning and remediation following assessments, penetration tests, incidents, or forensic investigations.

6. Preference will be given to Contractors with demonstrated experience aligning technical security recommendations and implementations to applicable laws, regulations, standards, and internal security requirements.

2.5 Reassignment of Personnel

1. The Contractor shall not reassign nor substitute personnel assigned to the contract during the contract term without prior written approval of Covered California. If a Contractor employee is unable to perform duties due to illness, resignation, or other factors beyond the Contractor’s control, the Contractor shall make every reasonable effort to provide suitable substitute personnel.

2. Substitute personnel shall not automatically receive the hourly rate of the individual or position being replaced. Covered California and the Contractor shall negotiate the hourly rate of any substitute personnel to the contract. The hourly rate negotiated shall be dependent, in part, on the experience and individual skills of the proposed substitute personnel; however, the negotiated rate shall not exceed the hourly rate stated in the contract.

3. Covered California reserves the right to require a Contractor employee to be removed from performing any work on the contract and on written notice to the Contactor, the Contractor shall assign an acceptable substitute employee.

3. SCOPE OF WORK

3.1 Background

1. Soon after the passage of national health care reform through the Patient Protection and Affordable Care Act of 2010 (ACA), California became the first state to enact legislation to establish a qualified health benefit exchange. The

RFP 2026-01: Information Security Services (V.05.28.2025) Page 20

California state law is referred to as the California Patient Protection and Affordable Care Act (CA-ACA).

2. The goals and objectives of Covered California are to:

a. Reduce the number of uninsured Californians by creating an organized, transparent marketplace for Californians to purchase affordable, quality health care coverage to claim available federal tax credits and cost-sharing subsidies, and to meet the personal responsibility requirements imposed under the federal act (ACA);

b. Strengthen the health care delivery system;

c. Serve as an active purchaser, including creating competitive processes to select participating carriers and other contractors;

d. Require that health care service plans and health insurers issue coverage in the individual and small employer markets and compete on the basis of price, quality, and service (and not on risk selection); and

e. Meet federal and state law requirements, guidance and regulations.

3. Covered California is an independent public entity within California State Government. It is governed by a five (5)-member board appointed by the Governor and Legislature.

4. Covered California works in close partnership with:

a. The Department of Health Care Services, which oversees and administers California’s Medicaid Program (Medi-Cal) and other specifically-focused health programs;

b. The two (2) agencies that regulate health insurance in California, the Department of Managed Health Care and the Department of Insurance;

and

c. A broad range of stakeholders whose constituencies may be impacted by health care reform.

5. For additional information on Covered California, please refer to the consumer website at www.CoveredCA.com and the business website at hbex.CoveredCA.com.

3.2 Purpose

The purpose of this contract is to engage a contractor to contribute to Covered California’s Information Security strategic initiatives and corresponding projects.

http://www.coveredca.com/ https://hbex.coveredca.com/

RFP 2026-01: Information Security Services (V.05.28.2025) Page 21

Covered California’s Health Benefit Exchange services require access to the Federal Data Services Hub, which is granted through an Authority to Connect (ATC) issued by the Centers for Medicare & Medicaid Services (CMS). An ATC aligns with maintaining a comprehensive information security program compliant with both ACA, Medicaid, and Partner Entities (ARC-AMPE) and the IRS Publication 1075, which are based on NIST SP800-53 rev 5. The contract includes supporting the information security program through full-time and project-based services, including risk management; compliance; security policies, procedures, and standards; security engineering and architecture; security incident response;

third-party risk management; technical security advisory services and implementation; threat detection and log monitoring; and data protection.

An additional purpose of this contract is to engage a contractor to serve as the Covered California independent assessor as required by ARC-AMPE and the Gov Code 11549.3 for penetration testing and privacy and security compliance assessments for California Healthcare Eligibility, Enrollment, and Retention System (CalHEERS) and the Covered California environments. As required by CMS, the selected contractor must maintain separate organizational reporting structures from the operational staff.

3.3 Scope of Work

See Model Contract Exhibit A – Scope of Work for a detailed description of the services and work to be performed by the successful Proposer.

3.4 Contract Completion Criteria

The contract resulting from this RFP will be considered complete when Covered California has approved and accepted all assigned contract deliverables.

3.5 Project Assumptions and Constraints

1. The Contractor’s work hours shall be consistent with Covered California’s key staff on-site, whose normal business hours are 8:00 AM to 5:00 PM, Monday through Friday, except for State holidays.

2. Overtime rates will not be reimbursed under the contract.

3. The reimbursement of travel expenses has been approved as outlined in Model Contract Exhibit E – Travel Reimbursement.

4. Any modifications to tasks within Exhibit A – Scope of Work of the contract shall be defined, documented, and mutually agreed upon by the Contractor and Covered California’s representative prior to starting work on the modified task(s). Covered California’s representative may refine or clarify the services deemed necessary to meet the needs of this project in accordance with Covered California’s priorities.

RFP 2026-01: Information Security Services (V.05.28.2025) Page 22

5. Covered California and the Contractor shall be mutually obligated to keep open and regular channels of communication in order to ensure the successful performance of the contract. Both parties shall be responsible for communicating potential problems or issues to Covered California’s Representative and the Contractor’s project team manager, respectively, within forty-eight (48) hours of becoming aware of the problem or issue.

3.6 Payment and Invoicing

If the collection of fees assessed from QHPs are collectively not sufficient to provide the funds for this program, Covered California shall have the option to either cancel this contract with no liability occurring to Covered California or offer a contract amendment to the Contractor to reflect the reduced amount.

The Contractor may invoice Covered California only after the successful completion and acceptance of the contract deliverables. The Contractor may not invoice Covered California for any costs exceeding the maximum amount identified to complete a deliverable.

4. REQUIRED PROPOSAL SUBMISSION CONTENT

Proposal submissions must include content for the following categories, which are described in detail in the sections below.

1. Administrative Requirements

a. Required attachments

b. Required documents

c. Updated Model Contract with Exhibits

2. Technical Requirements

a. Understanding and Approach

b. Corporate Qualifications Summary

c. Project Team Qualifications

i. Resumes

d. Past Projects Completed

e. Project Assumptions

f. Cost Proposal

RFP 2026-01: Information Security Services (V.05.28.2025) Page 23

4.1 Proprietary Information and Confidential Status of Responses

Any documentation submitted which has been marked “Proprietary” or “Trade Secrets” may be rejected. All proposals and evaluation documents are confidential and will not be available for public inspection pursuant to Government Code Section 100508(a)(1).

4.2 Administrative Requirements

To be deemed responsive, Proposers must comply with the Administrative Requirements in this section.

4.2.1 Required Attachments

1. Proposals must include the following required attachments as set forth below. Any attachment that requires a signature must be signed by a representative authorized to contractually bind the Proposer organization. Photocopies of wet signatures and electronic signatures are acceptable.

a. The Proposal Cover Page form (Attachment 1) completed and signed;

b. The Payee Data Record (STD. 204) form (Attachment 2) completed and signed;

c. The Contractor Certification Form (Attachment 3) completed and signed;

d. The Statement of Economic Interests Certification form (Attachment

4) completed and signed;

e. The Bidder Declaration (GSPD-05-105) form (Attachment 5) completed and signed;

f. The Proposal Checklist (Attachment 6) completed; and

g. The Generative Artificial Intelligence Risk Assessment (HBEX 707) (Attachment 7) completed.

2. Attachment 4 is a Proposer certification form whereby the Proposer acknowledges and agrees that, upon contract execution, the Proposer’s representative and applicable staff, if identified as code filers, agree to provide a completed Statement of Economic Interests (Form 700). For more information, see the Covered California Conflict of Interest Code at http://hbex.coveredca.com/resources and the Fair Political Practices Commission website at http://www.fppc.ca.gov/Form700.html.

http://hbex.coveredca.com/resources http://www.fppc.ca.gov/Form700.html

RFP 2026-01: Information Security Services (V.05.28.2025) Page 24

3. If the Proposer wishes to claim the DVBE incentive and/or the SB preference (see Section 6, Preference and Incentive Programs), the following optional attachments must also be included, as applicable:

a. The Disabled Veteran Business Enterprise Declarations (STD. 843) form (Attachment 8) completed and signed;

4.2.2 Required Documents

1. Proposals must include the following required insurance documents:

a. A Certificate of Liability Insurance equal to or greater than $1,000,000.00;

b. Proof of Workers’ Compensation Liability Insurance;

c. Proof of Automobile Liability Insurance, including non-owned auto liability, of $1,000,000.00 per occurrence for persons used by the Contractor for services provided pursuant to this contract; and

d. Proof of Professional Liability Insurance.

2. If the Proposer cannot include a Certificate of Liability Insurance and/or a Certificate of Automobile Liability Insurance and/or Proof of Professional Liability Insurance with its proposal, it must provide a written explanation detailing why it cannot comply with the requirement(s). Covered California may, in its sole discretion, accept a proposal without these Certificates if the Proposer provides a valid justification for the absence of one (1) or more of them and confirms that it will submit the appropriate Certificate(s) prior to contract execution, if it is selected as the Contractor. Covered California cannot execute a contract with the selected Contractor without these required Certificates and will award the contract to the next highest-scored Proposer if the Contractor fails to produce the Certificate(s) prior to contact execution.

3. If the Proposer organization is incorporated, proof of Active status with the California SOS must be provided in one (1) of the following forms:

a. A copy of the Proposer’s current Certificate of Status issued by the SOS; or

b. A copy of the Proposer’s Entity Detail page from the SOS’s Business Search website…