RFP 2025-19 Microsoft 365 and Related Cloud Services Development, Administration, and Support

Covered California is requesting proposals for Microsoft 365 Platform development, architectural, configuration, migration, integration, administration, security, and support services under RFP 2025-19, with proposals due July 27, 2026. Proposers claiming Small Disadvantaged Business (SDB) or Emerging Small Business (ESB) status must submit current California Department of General Services certification; disabled veteran business enterprise (DVBE) declarations are optional attachments.

The scope encompasses day-to-day support, configuration, enhancement, and ongoing optimization of Microsoft 365 services and related Microsoft cloud platforms including Azure, Entra ID, Exchange Online, SharePoint Online, Microsoft Teams, OneDrive, Power Platform, Microsoft Copilot, and Microsoft security and compliance offerings. Deliverables include current-state assessment, governance and architecture review, transition and support documentation, an initial prioritized work plan with roadmap, and knowledge transfer materials. The contractor must designate a primary contact with authority on all contract aspects and provide qualified senior personnel for advisory architecture services. Work may be performed on-site at 1601 Exposition Boulevard, Sacramento, California; remotely; or in a hybrid arrangement at Covered California's direction. All contractor personnel accessing confidential, personally identifying, or health information must complete criminal background checks per California Government Code Section 1043 and Title 10, California Code of Regulations, Section 6456, at the contractor's expense.

The contract term extends through June 30, 2029, with options to extend for up to two additional years at the same rates proposed, not to exceed five years total. The contractor must comply with state information security, privacy, accessibility, records management, and acceptable use policies. General liability insurance of $1 million per occurrence, automobile liability coverage of $1 million, and professional liability insurance of $1 million per claim with $1 million aggregate are required. Contractors handling personally identifiable information must implement safeguards aligned with the ARC-AMPE framework and NIST Special Publication 800-53 Revision 5, designate a privacy and security point of contact within 60 days, and provide annual privacy and security awareness training. Proposals must include administrative attachments (Proposal Cover Page, STD. 204, Contractor Certification Form, Statement of Economic Interests Certification, Bidder Declaration GSPD-05-105, Proposal Checklist, and Generative Artificial Intelligence Risk Assessment HBEX 707), insurance certificates, proof of active California Secretary of State status, Standard Agreement STD. 213, Scope of Work with Work Authorization, Budget Detail and Payment Provisions with Cost Worksheet, IT General Terms and Conditions with Resumes, and Privacy Addendum. Submit proposals through Covered California's Solicitations page at https://hbex.coveredca.com/solicitations/.