Application Control and Endpoint Security Software Solution

Inland Empire Health Plan (IEHP), a California-based local public entity operating in San Bernardino and Riverside counties, issued Request for Proposal #25-06890 on February 26, 2026, seeking qualified vendors to provide an Application Control and Endpoint Security Software Solution with enterprise-wide application allowlisting capabilities to prevent unauthorized software installation and execution while reducing malware and ransomware risk. The solution must support Windows 10+, Windows Server 2012+, macOS, Linux, iOS, and Android devices across IEHP's IT asset inventory of approximately 5,000 Windows endpoints, 700 Windows servers, 130 Linux machines, 50 macOS machines, 1,700 iPhones, and 250 Android devices, with integration requirements for 7,000 Active Directory accounts and existing systems including Microsoft Intune, Defender for Endpoint, Entra ID, and Purview. Key deliverables include monthly summary reports detailing application control activities, policy enforcement metrics, compliance posture, and incident summaries, with all solutions and data residing exclusively within the continental United States and full compliance with HIPAA, NIST 800-171/800-53, CMS, and DHCS security requirements. Evaluation will allocate 65 points to scope and company qualifications, 30 points to pricing, 5 points for local preference, and up to 10 additional points for demonstration scores if conducted. Bidders must submit questions by March 10, 2026 at 2:00 p.m. PT, with proposals due March 26, 2026 at 2:00 p.m. PT through the Bonfire e-procurement platform; potential vendor demonstrations are scheduled for April-May 2026, and the initial contract term is one year with IEHP reserving the right to award to multiple bidders.

A local business preference of 5 points is available to qualified vendors maintaining fixed, staffed offices in Riverside or San Bernardino Counties with a minimum of six months of continuous operation in those locations. Bidders must submit fifteen required compliance documents on a pass/fail basis, including Principal Certification, Certification of Non-Debarment, Non-Collusion Declaration, Workers' Compensation Certificate, insurance certification, business licenses, DUNS number, Secretary of State registration, and three contract references from comparable projects awarded within the past three years; vendors must also complete comprehensive security assessments, data sharing assessments, and vendor security checklists demonstrating HITRUST/ISO 27001/FedRAMP/StateRAMP certifications, SOC 2 Type II audit results, and penetration testing completed within 365 days. All proposed solutions must integrate with IEHP's existing Microsoft and security infrastructure; no incumbent vendor or current contractor information is specified in the procurement documents. Cyber liability insurance requirements are tiered at ten million dollars minimum coverage for organizations serving over one million members, reflecting IEHP's service of approximately 1.4 million Medi-Cal and health plan members across both counties. The RFP does not specify an exact budget or award value; however, firm pricing must remain valid for 120 days after the closing date with F.O.B. Destination terms and cash payment within less than 20 days, with California Sales Tax excluded as a separate line item. All contractors must comply with California Executive Order N-6-22 regarding economic sanctions against Russia and undergo debarment verification before contract award.