CALNET Managed Cybersecurity Services (IFB Pre-Solicitation)

The California Department of Technology, Office of Statewide Technology Procurement, is issuing a pre-solicitation notice for Invitation for Bid (IFB) C5-CMCS-G1-26 for CALNET Managed Cybersecurity Services, which encompasses four distinct service categories: Category 530 (Managed Multi-Factor Authentication Service), Category 531 (Managed Incident Response Retainer Service), Category 532 (Managed Anti-Phishing Security Service), and Category 533 (Managed Endpoint Detection and Response Service). This is a pre-solicitation phase seeking industry feedback on draft solicitation documents, with all feedback to be submitted by February 23, 2026 at 5:00 PM Pacific Time. The services must be provided statewide with 24/7/365 availability and support for California state entities. The MFA service requires centrally managed platforms with adaptive, risk-based, and phishing-resistant authentication methods including FIDO2/WebAuthn support across five user tier categories (1-50 users through 1,001+ users), with service level commitments ranging from 99% to 99.99% availability depending on the selected tier. The Managed Incident Response Retainer service demands qualified incident responders capable of rapid mobilization for cybersecurity incident response, forensics, and threat intelligence, with personnel including Senior Incident Responders (minimum 5 years experience), Incident Commanders (7+ years), Digital Forensic Analysts (3+ years), Malware Analysts/Reverse Engineers (3+ years), and Threat Intelligence Analysts (3+ years), with response time SLAs ranging from 30 minutes to 4 hours depending on service tier. The Managed Anti-Phishing Security service must include phishing awareness and simulation training, automated threat detection and analysis, and real-time user reporting with detection accuracy rates of 95-99% and SLA availability of 99-99.99%. The Managed Endpoint Detection and Response service requires 24/7/365 monitoring and detection of threats across traditional endpoints (desktops, laptops, servers, virtual machines), remote and cloud-based devices, and non-traditional endpoints including IoT and operational technology assets, with three performance tiers offering varying resource commitments and response times ranging from 30 minutes to 2 hours. All services require detailed Service Level Agreement Management Plans submitted within 90 days of contract award, with monthly service credits ranging from 25% to 50% of total monthly recurring charges for SLA failures, capped at 100% of monthly charges. The contract term is approximately three years effective upon signature, with two optional one-year extension periods and a contract end date of June 30, 2029.

The pre-solicitation documents do not specify set-aside designations, restrictions on vendor type, or disadvantaged enterprise requirements. No incumbent vendors or current contractors are identified in the available documentation. The solicitation requires vendors to ensure compliance with California's Statewide Information Management Manual (SIMM) security standards, alignment with NIST-NICE Workforce Framework standards, and integration with existing state infrastructure and security monitoring systems. Specific budget ranges and award values are not disclosed in the pre-solicitation materials, as pricing structures will be populated in the formal IFB documents with service costs structured as non-recurring charges plus monthly recurring charges based on user counts or endpoint quantities depending on the service category. Interested parties should direct all feedback submissions to Saagar Patel, Procurement Officer, or Tien Le, Secondary Procurement Officer, with the IFB number C5-CMCS-G1-26, vendor name, and contact information. Participation in this pre-solicitation feedback period is optional and does not affect vendor eligibility for the subsequent formal IFB bidding process. The State may conduct confidential discussions with vendors via Microsoft Teams but makes no commitment to incorporate vendor feedback into the final IFB documents.