DQ CBMS Annual Security and Privacy Assessment

The Governor's Office of Information Technology (OIT) in Colorado is seeking an independent assessor to conduct a comprehensive Year 1 security and privacy assessment of the Colorado Benefits Management System (CBMS) in accordance with Centers for Medicare and Medicaid Services (CMS) MARS-E 2.2 requirements. The procurement, identified as Documented Quote (DQ) 2025000482, covers Denver County and Denver City jurisdictions and requires the selected vendor to produce specific deliverables including a Security and Privacy Assessment Plan (SAP), Security Assessment Report (SAR), Assessor Workbook (SAW), and Annual Attestation Memorandum. Key project objectives include assessing CBMS system compliance with MARS-E standards, evaluating infrastructure security posture, and analyzing data security and privacy controls across multiple Salesforce.com and Amazon Web Services platforms. The solicitation mandates electronic quote submissions via Bidnet, with proposals due on May 2, 2025, at 4:00 PM MST, and final deliverables required by July 29, 2025. Evaluation criteria will prioritize vendor qualifications and cost, with the state reserving the right to reject quotes and negotiate terms to secure the most advantageous proposal.

The procurement does not explicitly specify set-aside designations or restrictions on responding organizations. The project will be awarded as a 12-month purchase order, with vendors required to provide detailed references, comprehensive company information, staff role descriptions, and a management summary outlining project methodologies. While no incumbent vendor is mentioned, the existing technology infrastructure includes Salesforce.com platforms and Amazon Web Services used for applicant and professional user interfaces. The solicitation requires vendors to demonstrate expertise in security assessments, compliance reporting, and penetration testing within healthcare technology systems. Although a specific budget range is not disclosed, the comprehensive nature of the assessment and the involvement of multiple technology platforms suggests a substantial contract value. Vendors must comply with extensive state and federal security regulations, including Colorado Office of Information Security policies, and adhere to administrative and technical safeguards outlined in the attached Sample IT Contract Provisions Exhibit.