JPMC Internal Audit Software

The Illinois Department of Innovation and Technology in cooperation with the Chief Procurement Office for General Services is soliciting a Joint Purchase Master Contract for Commercial-Off-The-Shelf internal audit software and related services, with offers due August 27, 2026. A pre-submission conference is scheduled for July 21, 2026 at 11:00 AM CST, and offeror questions are due two weeks after publication. No small business set-aside is designated.

The scope is a Software-as-a-Service internal audit system hosted in a cloud environment within the contiguous United States, supporting approximately 150 users across state agencies and qualified not-for-profit organizations. The solution must enable preparation, finalization, and archiving of audit working papers; facilitate real-time collaboration; provide role-based access control; integrate with the State's Single Sign-On platform (Okta); and support compliance with the Institute of Internal Auditors' Global Internal Audit Standards. All proposed solutions must be established COTS products in active production for at least three years with only minor configuration permitted. The system must support migration of approximately 250 gigabytes of existing audit data (replacing the current TeamMate AM environment) and scale to 600 gigabytes over five years.

Security and compliance requirements are extensive: SOC 2 Type 2 certification (or SSAE-18 SOC 1 Type 2 for financial information) required within seven days of award; FIPS 140-compliant AES-256 encryption at rest and in transit; NIST SP 800-53 Revision 5 low security baseline minimum; disaster recovery and data backup capabilities; 24-hour breach notification to State CISO; critical and high vulnerabilities (CVSS 7.0+) remediated within 24 hours; compliance with Illinois Information Technology Accessibility Act (WCAG 2.1 Level AA); and prohibition on AI use without express written authorization and clear disclosure. Physical data centers must comply with Illinois Identity Protection Act, Illinois Personal Information Protection Act, FERPA, FBI CJIS Security Policy, and applicable CMS standards.

The contract term is five years with options to renew for additional one-year increments, not to exceed ten years total. Pricing must remain firm for the first two years; one annual upward adjustment based on Consumer Price Index is permitted thereafter. Evaluation allocates 1,000 points for technical requirements and Commitment to Diversity combined, 240 points for pricing, and 200 points for demonstrations (1,440 points maximum). Vendors must score a minimum of 700 points to advance to demonstration and price evaluation phases. Demonstrations occur four weeks after bid opening, with anticipated notice of award at six weeks post-opening and contract commencement at ten weeks after posting.

Commitment to Diversity evaluation (20% of technical score) requires submission of a C2D Answer Form with supporting documentation covering BEP goal compliance, Women/Minorities/Disability-owned business subcontracting, DEI spending, DEI time investment, DEI policies, and diversity staffing metrics. All vendors must submit either an IPG Active Registered Vendor Disclosure (if active in Illinois Procurement Gateway) or a Vendor Disclosure form (formerly Forms A); failure to do so renders the bid non-responsive. Information Technology Offer to the State form and Standard Illinois Certifications are mandatory. All subcontracts with annual values exceeding $100,000 require identification and compliance certification.