RFP 2026-01 Information Security Services

Covered California is requesting proposals for comprehensive information security services under RFP 2026-01, with proposals due August 31, 2026 at 12:00 PM Pacific Time. Questions are due August 5, 2026 at 12:00 PM Pacific Time, with responses posted by August 10. The contractor must maintain independent organizational reporting structures separate from operational staff as required by the Centers for Medicare & Medicaid Services (CMS) — a regulatory constraint that filters organizational structure capability.

The scope includes risk management, compliance, security policies and procedures, security engineering and architecture, security incident response, third-party risk management, technical security advisory services and implementation, threat detection and log monitoring, and data protection delivered through a team of at least three full-time security professionals with a designated manager and capacity to support special projects and surge efforts. Project team members must satisfy background clearance requirements and demonstrate substantial experience across governance, risk and compliance, security engineering and architecture, incident response, third-party risk management, technical security, and data protection.

The maximum proposal amount is $12.5 million for the base contract term (December 1, 2026 to November 30, 2031), with expected annual funding of approximately $2.5 million. The contract term is five years with Covered California retaining discretionary right to extend for two additional option years, reaching a maximum of $17.5 million over seven total years if all options are exercised. Funding is subject to annual budget approval by the Covered California Board of Directors.

A 5% scoring preference applies to certified small businesses. A 5% scoring incentive applies to disabled veteran business enterprises. Optional subcontractor participation incentives are available. Administrative requirements include proof of liability insurance ($1 million minimum), workers' compensation insurance, professional liability insurance, California Secretary of State active status confirmation for incorporated entities, and certifications regarding economic interests, tax delinquency status, and Russian sanctions compliance. Notice of Intent to Award is expected the week of September 16, 2026.