Cybersecurity & Risk Compliance Monitoring

The contract requires ongoing cybersecurity monitoring to ensure and maintain a RiskRecon rating of A or B, with continuous evaluation and mitigation of security postures to meet industry benchmarks. This includes regular vulnerability assessments to identify and remediate potential security gaps, support for a secure software development life cycle to embed security practices into all phases of application development, and preparation for the annual SOC 2 Type II audit to demonstrate compliance with trust service criteria related to security, availability, processing integrity, confidentiality, and privacy. The scope is focused on sustaining a robust, audit-ready security framework that aligns with regulatory and operational expectations. The contract is classified as a subcontract under NAICS code 541690, reflecting its alignment with other scientific and technical consulting services. It is issued by the Florida Agency for Health Care Administration with a response deadline of October 1, 2026, and was posted on June 23, 2026. While specific performance locations and point of contact details are not provided, the work is expected to support the agency’s broader mission of ensuring secure and compliant digital operations across its health care systems. There is no set-aside designation, and all eligible vendors may respond.