CMS Third Party Annual Assessment

The State of Michigan Department of Technology, Management and Budget, on behalf of the Michigan Department of Health and Human Services, is procuring independent information systems security assessment services through Request for Proposal #190000000058. The procurement involves conducting annual security assessments of seven State of Michigan Medicaid-related information systems—including the Integrated Service Delivery Portal, Bridges Integrated Automated Eligibility Determination system, State of Michigan Medicaid HUB Solution, Modified Adjusted Gross Income (MAGI) Eligibility Determination system, MAGI Viewer system, CHAMPS, and the Health Services Data Warehouse—to ensure compliance with the Centers for Medicare and Medicaid Services (CMS) Minimal Acceptable Risk Standards for Exchanges (MARS-E) security framework. The contractor will evaluate between 1,042 and 1,382 controls annually across a three-year assessment cycle, with assessments performed on production environments and potential physical data center inspections at facilities in Michigan, Phoenix Arizona, Philadelphia Pennsylvania, and Englewood Colorado. Key deliverables include a project plan, weekly status reports, and comprehensive Security Assessment Reports due annually by May 31. The RFP was issued November 13, 2018, with a bidder question deadline of November 20, 2018, and a revised proposal submission deadline of December 10, 2018 at 12:00 p.m. Eastern Time. The contract term runs from March 1, 2019 through June 30, 2023, with renewal options for up to two additional one-year periods at the State's sole discretion. Required qualifications include an onsite project manager, onsite security assessment lead, and security assessment analysts with minimum five years of recent experience managing IT projects in government environments, current information systems security certifications, and Project Management Professional certification, with at least one analyst possessing enterprise service bus (ESB) experience. Proposals must score 80 or higher on technical evaluation criteria addressing Statement of Work sections, staffing qualifications, project plan, and company background and experience to be considered for pricing evaluation.

The RFP restricts all work to performance within the United States, with state data remaining within the continental United States, and contractors must attend required meetings within the United States. The documents do not identify any set-aside designations for disadvantaged enterprises, incumbent vendors, or specific technology integration requirements beyond compliance with the MARS-E framework and use of the CMS Security Assessment Report template. Pricing must be submitted with annual costs listed separately and a total contract price for all four years, with payment structured in three milestones: 15 percent upon project plan delivery, 30 percent upon security controls testing plan completion, and 55 percent upon completion and acceptance of Security Assessment Reports, with travel expenses billable separately at Michigan state travel policy rates. The contractor must provide comprehensive insurance coverage including Commercial General Liability ($1,000,000 each occurrence), Automobile Liability ($1,000,000 per occurrence), Workers' Compensation, Employers Liability ($500,000 each accident), Privacy and Security Liability ($1,000,000 each occurrence), Crime/Fidelity Insurance ($1,000,000 employee theft per loss), and Professional Liability ($3,000,000 each occurrence). Liquidated damages of $10,000 plus $250 per day will be assessed for late or improper completion of contract activities, and unauthorized removal of key personnel will result in credits of $25,000 per individual plus additional daily charges up to $50,000 maximum per individual. No specific award value or budget range is disclosed in the available documentation.