EGB FY26 CBMS REQ 12773568, DQ 2026000520 SOC Audit

The State of Colorado's Office of Information Technology (OIT), in partnership with the Colorado Department of Health Care Policy and Finance, is requesting proposals for SOC 1 Type II audit services for the Colorado Benefits Management System (CBMS) and related applications under Documented Quote 2026000520, with proposals due August 19, 2026 at 1:30 p.m. via BidNet Direct.

The scope encompasses developing an audit plan with project timeline and testing milestones, conducting a readiness assessment to evaluate control documentation and identify gaps, performing a SOC 1 Type II audit in accordance with AICPA Statement on Standards for Attestation Engagements (SSAE 18), delivering draft and finalized audit reports incorporating Department feedback, and providing post-engagement maintenance to address discovered errors or irregularities. All work shall be performed remotely with no travel or per diem costs. Mandatory staffing includes a Project Lead and IT Security/Controls Subject Matter Expert; vendors may optionally propose a Quality Assurance Lead and Senior SOC 1/SSAE 18 Auditor, with flexibility to add specialized staff. Respondents must demonstrate compliance with Colorado accessibility requirements (24-85-101, C.R.S.) and must not propose video surveillance or telecommunications equipment from Huawei, ZTE, Hytera, Hikvision, or Dahua.

The cost proposal workbook requires vendors to submit firm fixed prices for all required deliverables, with pricing remaining firm during the initial contract term and including all associated fees, labor, overhead, and incidental expenses. The anticipated contract term is a single fiscal year with a maximum total duration not to exceed five years; the State reserves discretion to decline renewal or extension options for any reason.

The award will be made to the responsible vendor whose acceptable quote is determined most advantageous to the State, considering price and other factors including organizational experience and quality. Within ten business days of award notification, the selected vendor must be registered with the Colorado Secretary of State and must provide proof of good standing and insurance documentation prior to contract execution. Written inquiries were due August 11, 2026; the State responded to inquiries on August 13, 2026.