Third-Party Application Management

The Oregon Department of Human Services (ODHS) and Oregon Health Authority (OHA) are seeking a third-party patch management system through Request for Quotes (RFQ) No. 6108-0 to improve security, compliance, and efficiency of patching non-Microsoft applications across agency systems. The procurement aims to address cyber threats targeting third-party software by implementing a comprehensive patch management solution. Deliverables include project planning, software licensing, implementation, customization, automation setup, training, monthly compliance reporting, and final implementation reporting. The evaluation will utilize a best value analysis process, with a total maximum score of 100 points distributed across approach/methodology (30 points), contracting firm qualifications (25 points), key personnel qualifications (35 points), and price proposal (10 points). The RFQ was issued on September 5, 2025, with quotes due on October 3, 2025, at 4:00 PM PT, and a targeted final implementation date of April 1, 2026. Bidders must provide a proposed Statement of Work, key personnel descriptions, project references, and a comprehensive pricing sheet.

The solicitation is open to multiple consultants under the Master Price and Services Agreement (MPSA) for Information Technology Professional Consulting Services, with potential vendors including Atmosera, Inc., Deloitte Consulting, and Microsoft Corporation. The solution must integrate with existing systems, including Active Directory, SCCM, Intune, and the current SIEM owned by DAS-EIS (utilizing Q-RADAR and Microsoft Sentinel). Key technical requirements include supporting patch deployment across different organizational locations and time zones, providing automation capabilities, ensuring patch delivery security within the United States, supporting compliance and zero-day patch availability, offering a centralized management console, and maintaining enterprise-level scalability. While specific budget ranges are not explicitly stated, the comprehensive nature of the project suggests a significant investment in cybersecurity infrastructure. The RFQ emphasizes mandatory and preferred system integrations, with travel expenses included in the overall compensation and payments to be made upon acceptance of each deliverable according to the agreed schedule.