CMS Third Party Annual Assessment

The State of Michigan Department of Technology, Management and Budget, in collaboration with the Michigan Department of Health and Human Services (MDHHS), is seeking an independent contractor to perform a comprehensive CMS Third Party Annual Assessment for multiple Medicaid information systems. The primary objective is to assess the state's information systems for compliance with the Centers for Medicare and Medicaid Services (CMS) Minimal Acceptable Risk Standards for Exchanges (MARS-E) security framework. The assessment will cover seven specific systems, including the Integrated Service Delivery Portal, Bridges Integrated Automated Eligibility Determination system, State of Michigan Medicaid HUB Solution, MAGI Eligibility Determination system, MAGI Viewer system, CHAMPS, and MDHHS Health Services Data Warehouse. Contractors must produce a detailed Security Assessment Report (SAR) by May 31st of each assessment year, with payment structured across milestones: 15% for the Project Plan, 30% for Security Controls testing plan, and 55% for Security Assessment Reports. Technical proposals will be evaluated on four key criteria: Statement of Work (40%), Staffing (25%), Project Plan (25%), and Company Background/Experience (30%), with only proposals scoring 80 or more technical points qualifying for pricing evaluation. The Request for Proposal was issued on November 13, 2018, with proposals due on December 10, 2018, at 12:00 p.m. Eastern, and an anticipated contract start date of March 1, 2019, running through June 30, 2023, with potential two one-year renewal options.

While the solicitation does not explicitly mention set-aside designations for disadvantaged enterprises, it does outline specific requirements for potential bidders. The contract requires all work to be performed within the continental United States, with in-person meeting attendance mandatory. The assessment will involve evaluating datacenters operated by CGI in Phoenix, AZ (primary) and Philadelphia, PA (backup), as well as a Maximus datacenter in Colorado. Contractors must submit proposals electronically through the SIGMA system, with no email submissions permitted. The contract includes financial provisions such as liquidated damages of $10,000 plus $250 per day for late or improper completion of Contract Activities, and allows for separate billing of travel expenses according to State of Michigan Travel Policy rates. While specific budget ranges are not detailed, vendors must provide both annual and total contract pricing for the four-year period. Pricing complexity is further emphasized by the requirement to structure assessments in 3-year cycles, with 2019 being the third year of one cycle and 2020 beginning a new cycle.