Acceptable Risk Controls for ARC-AMPE 3rd Party Attestation

The contract pertains to providing third-party attestation and web application testing services focused on establishing acceptable risk controls for programs under the Affordable Care Act (ACA), Medicaid, and associated partner entities. Issued by the Idaho Department of Health and Welfare, the solicitation aims to secure a vendor capable of assessing and enhancing the security posture of relevant web applications, ensuring compliance with key regulatory frameworks such as HIPAA, IRS Pub. 1075, and NIST standards. The scope includes conducting vulnerability assessments, penetration testing, and mapping security controls to regulatory requirements to mitigate risks associated with sensitive health and financial data. The contract is expected to span three years starting from April 1, 2026, with potential extensions up to five years, reflecting the long-term importance of maintaining robust security and compliance measures within these health programs. The procurement process began with a posting date of September 23, 2025, and the proposal submission deadline is October 31, 2025. The project emphasizes rigorous security testing, regulatory adherence, and risk management, with key milestones including a pre-proposal conference scheduled for September 30, 2025. The contract size ranges from $500,000 to $2,000,000, aligning with the scope and critical nature of the services required.