Information Security and Compliance Auditing

The contract calls for annual third-party security audits to validate adherence to recognized cybersecurity standards, including SOC 2 Type II, ISO 27001:2022, or HITRUST, ensuring rigorous evaluation of controls surrounding security, availability, processing integrity, confidentiality, and privacy. In addition to audit requirements, the contractor must establish and maintain a robust incident response plan capable of detecting, containing, mitigating, and recovering from security events in alignment with government security frameworks, demonstrating readiness to safeguard sensitive data and systems under state oversight. The work is classified as a subcontract under NAICS code 541990, with performance expected to occur in Los Angeles, California, and the response deadline is set for August 26, 2026, following a posting date of June 26, 2026. The contracting entity is the California Department of Treasurer and Tax Collector, indicating a focus on protecting state financial and fiscal data through structured compliance and continuous monitoring practices.