CALNET Managed Cybersecurity Services IFB

The California Department of Technology, Office of Statewide Technology Procurement, is requesting bids for CALNET Managed Cybersecurity Services across four service categories under IFB C5-CMCS-G1-26, with final bids due September 14, 2026 and written questions due by July 27, 2026 at 5:00 p.m. Pacific Time. The State intends to award multiple bidders per category. Small business preference (5%) and non-small business subcontractor preference (5% for firms subcontracting at least 25% with certified small businesses) are available; DVBE participation requirement has been waived but a DVBE incentive remains for bidders achieving minimum 3% DVBE participation.

The four service categories are: Category 530 (Managed Multi-Factor Authentication), Category 531 (Managed Incident Response Retainer), Category 532 (Managed Anti-Phishing Security), and Category 533 (Managed Endpoint Detection & Response). Category 533 covers 24x7x365 monitoring and detection on traditional endpoints (desktops, laptops, servers, virtual machines) and non-traditional endpoints (IoT and operational technology assets) across on-premises, remote, and cloud environments, with per-endpoint, per-month subscription pricing in tiered endpoint bands (1–50, 51–100, 101–250, 251–500, 501–1,000). Category 531 delivers incident response activation with qualified NIST-NICE Workforce Framework personnel, geographic on-site response options (Northern, Central, Bay Area, Southern California), and hourly consulting for forensics and threat hunting. Category 532 provides phishing awareness training, analysis, coordinated response, and real-time user reporting on a per-mailbox, per-month basis (1–50, 51–100, 101–250, 251–500 mailboxes). Category 530 covers policy-based, passwordless, and phishing-resistant MFA on a per-user, per-month basis (1–50, 51–100, 101–250, 251–500 users). All categories require bidders to commit to one of three service-level tiers (Basic, Standard, Premier) with defined availability (99%–99.99%), threat mitigation timeframes (30 minutes to 2 hours), and provisioning deadlines. Contractors must submit a detailed SLA Management Plan within 90 days of award and proactively credit or refund customers for missed SLA objectives.

Contract term is approximately three years effective upon signature, with two optional one-year extensions through June 30, 2029. Pricing in Cost Workbooks and SOW Catalog A establishes maximum rates; contractors may lower but not increase prices beyond approved CALNET rates. All state Executive Branch non-exempt entities must use CALNET contracts for mandated services; exempt state entities and California local jurisdictions may use them optionally. Bidders must demonstrate financial stability with a Line of Credit Letter or Letter of Bondability of minimum $500,000 per category, hold an OSTP-approved Electronic Vendor Application of Qualifications (eVAQ) prior to final submission, and submit Intent to Bid and Confidentiality Statement by August 31, 2026 at 5:00 p.m. Evaluation begins September 15, 2026, with negotiations and award notifications anticipated in November 2026. Bid validity extends 180 calendar days from scheduled award date.