EGB FY26 CBMS REQ 12773568, DQ 2026000520 SOC Audit

The State of Colorado Office of Information Technology, in partnership with the Colorado Department of Health Care Policy and Finance, is requesting a documented quote for System and Organization Controls (SOC) 1 Type II audit services on the Colorado Benefits Management System (CBMS) and Program Eligibility & Application Kit (PEAK), with responses due August 19, 2026 at 1:30 p.m. via BidNet Direct.

The scope requires a full SOC 1 Type II audit in accordance with AICPA Statement on Standards for Attestation Engagements (SSAE 18), including development of an audit plan with project timeline, testing processes, milestones, and deliverables; a readiness assessment evaluating control documentation and identifying gaps; and a final audit report with audit findings, risk assessments, and recommendations. All work shall be performed remotely with no in-person field work required. CBMS is the statewide database processing food, cash, and medical assistance applications.

Respondents must demonstrate SOC 1 Type II audit experience from the past five years and provide detailed qualifications for a Project Lead and IT Security/Controls Subject Matter Expert, with optional Quality Assurance Lead and Senior SOC 1/SSAE 18 Auditor roles. Proposed pricing must be firm fixed-price for all deliverables and all-inclusive of labor, travel, overhead, equipment maintenance, and incidental expenses. The cost proposal workbook requires vendors to submit hourly billing rates and estimated hours for each personnel role.

The anticipated contract term is one fiscal year with a maximum total duration not to exceed five years; the State retains sole discretion to decline exercising option or extension terms. The awarded vendor must register with the Colorado Secretary of State within ten business days of award notification and provide proof of good standing and required insurance certification prior to contract execution. The contractor will be considered a subrecipient subject to Office of Management and Budget Uniform Guidance under 2 CFR Part 200. Written inquiries are due August 11, 2026 at 1:30 p.m., with state responses by August 13, 2026 at 1:30 p.m.