eCM-HEALTH, INC.
SOC2+ (Type I) Examination Services eCM-Track Web Application
Download PDF: eCM-Health SOC2+ (Type I) Examination Services eCM-Track Web Application RFP 2026-0005
| Document | Request for Proposal – SOC2+ Type I Audit |
| Application | eCM-Track |
| Version | 1.0 |
| Status | Release |
| RFP Number | 2026-005 |
| Procurement Contact | Mike Landeck, Mike@ecm-health.com |
| Organization | eCM-Health, Inc. |
Document Control
Table of Contents
3. Audit Readiness and Evidence Repository. 5
6. Respondent Qualifications and Profile. 6
Request for Proposal (RFP): SOC2+ (Type I) Examination
1. Statement of Purpose
eCM-Health, Inc is an early-stage healthcare technology startup preparing for a January 2027 commercial go-live. We are seeking proposals from qualified CPA firms (or firms utilizing a legally affiliated CPA entity) to perform an independent SOC 2+ Type I examination. The engagement will evaluate the design suitability of our controls against a consolidated framework including all five (5) AICPA Trust Services Criteria, HIPAA, and NIST SP800-171 Rev 3. A formal, licensed CPA-signed AICPA attestation report is among the required deliverables. Detailed requirements are outlined in Section III Scope of Work.
- Operating Context: eCM-Health is a lean organization currently utilizing a small team of part-time Subject Matter Experts (SMEs). We do not use a dedicated GRC automation tool, nor do we have full-time internal IT support. To offset this, we have fully prepared our compliance artifacts ahead of the audit window.
- Pre-Production Status: The system is entirely in pre-production. No active Protected Health Information (PHI) or live client data is currently processed or stored in the environment.
- Audit-Readiness: eCM-Health is a lean organization utilizing a small team of part-time Subject Matter Experts (SMEs), currently operating without a dedicated IT department or a GRC automation platform. Our team will prepare the compliance artifacts prior to the start of the audit.
2. Technical Boundary
The audit boundary is highly focused and consolidated. eCM-Track is a custom-developed web application currently operating in a pre-production environment 100% cloud-hosted within Amazon Web Services (AWS). The application is built using the Laravel PHP framework, with Livewire providing the primary user interface framework and Laravel Fortify providing authentication and account security functionality. The application is deployed through Laravel Vapor making it completely serverless. The application enforces role-based access controls across multiple user types and business functions and is being developed with a security-first approach prior to production release.
The eCM-Track application has not been released, is not publicly available, and contains no production, protected, or customer data.
Forward-looking notes:
- eCM-Track is expected to handle sensitive regulated (protected health information (PHI)) following release. Findings should frame business impact with that future state in mind.
- eCM-Track is expected to undergo a comprehensive penetration test prior to the SOC2+ Type I audit.
3. Audit Readiness and Evidence Repository
To ensure an efficient and rapid assessment, eCM-Health will provide a pre-populated evidence library on Day 1 of the engagement, containing:
- Completed NIST SP800-171Rev3 System Security and Privacy Plan (SSPP)
- Part A – system boundary, asset inventory, and data flows
- Part B – control implementation specifications
- Approved security and privacy policy manual
- As soon as it’s available, a thorough independent Penetration Test Report covering access and configuration controls
4. Scope of Services
The selected firm will perform a combined evaluation to achieve a point-in-time SOC 2+ Type I Report mapped to the five (5) AICPA Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy), the HIPAA Security and Privacy Rules, and NIST SP 800-171 Rev3.
The assessment must account for a cloud-native, entirely serverless deployment boundary. The specific scope of work includes:
- Create a Tailored Unified Control Matrix aligned with the eCM-Health environment. (Spreadsheet Format):
Deliverable 1: On Day 1, provide a Master Crosswalk.- This crosswalk will serve as the tailoring baseline and must clearly map out the five (5) SOC 2 Trust Services Criteria, HIPAA Security & Privacy Rules and NIST SP 800-171r3 controls and evidence requirements.
Deliverable 2: The Tailored Unified Control Matrix
- Must be completed and approved prior to commencing fieldwork
- Retains the integrity of the Master Crosswalk, with responsibilities and artifacts tailored to the tailored to the serverless cloud environment
- System Description: Review and ingest our completed SSPP, adapting it into an AICPA-compliant Section III System Description
Deliverable 3: The System Description (SOC 2+Section III)
- Must be completed and approved prior to commencing fieldwork
- Conduct the Assessment
Deliverable 4: Final SOC2+ Type I Report
- Must be completed and approved prior to commencing fieldwork
- Expectation that deficiencies/needed adjustments will be communicated as they are identified to facilitate remediation prior to report drafting/issuance.
5. Time Constraints
The suggested timeline below reflects our 1 January 2027 go-live date.
| eCM-Health 2026 SOC2+ Type 1 Audit | |
| Activity | Date |
| RFP Posted | 15 September 2026 |
| Proposal Responses Due | 30 September 2026 |
| Firm Selection & Notification | 04 October 2026 |
| Procurement Complete | 16 October 2026 |
| Audit Commencement / Kickoff | 19 October 2026 |
| Fieldwork Completion | 20 November 2026 |
| Final Report Issuance | 21 December 2026 |
6. Respondent Qualifications and Profile
Proposals must include the following sections, in this order:
- Solution (under 6 pages) demonstrating expertise in:
- AWS Cloud Serverless Environments (AWS, Laravel Vapor, GitHub)
- Unified framework mapping involving NIST SP 800-173 Rev 3 and HIPAA
- Approach and schedule
- Named audit team personnel, relevant experience & certifications
- Cost Proposal and Fee Structure – Provide a fixed-fee quote that:
- Considers start-up expertise, audit readiness, and timeline
- Accommodates a serverless environment
- Maximizes evidence reuse across SOC 2, HIPAA, NIST 800-171 Rev 3
- Includes all stated deliverables
- Accreditation
- Confirmation that the firm or its designated attestation affiliate is a legally licensed and accredited CPA firm capable of issuing an official SOC 2 Type I opinion.
- Financial Stability
- A statement confirming the firm’s financial health, capability to staff this multi-framework project, and long-term continuity.
- Certificate of Insurance (COI) detailing Professional Liability / Errors and Omissions (E&O) coverage limits.
7. Evaluation Criteria
Responsive proposals will be evaluated on the following weighted criteria:
| Criterion | Weight | Basis |
| Multi-Framework Integration | 20% | Demonstrated experience delivering unified “SOC 2+” audits that natively cross-map SOC 2 criteria with HIPAA and NIST 800-171 Rev 3. |
| Serverless CLOUD Architecture IQ | 30% | Proven capability auditing serverless cloud architectures (AWS, Laravel Vapor, GitHub). |
| Personnel Qualifications | 25% | Qualifications, certifications, experience, and expertise of personnel assigned to the engagement. |
| Price and Overall Value | 25% | Cost relative to scope, methodology, personnel qualifications, and deliverables. |
eCM-Health intends to award this engagement on a best-value basis and will not necessarily select the lowest-cost proposal.
8. Submission Instructions
Proposal and accompanying artifacts may be zipped or emailed separately to mike (at) ecm-health.com by 6:00pm Pacific Time on 9/30/26. Any applications received with a later email timestamp will be considered nonresponsive.
9. Contracting Authority
Mike Landeck of Michael Landeck Consulting, LLC is engaged by eCM-Health to manage this procurement and serves as the single point of contact for all solicitation activities. He does not hold signature authority and cannot bind eCM-Health to any agreement, term, or commitment. No statement, correspondence, or representation made during this procurement constitutes a binding obligation of eCM-Health.
Any resulting contract will be executed by an authorized eCM-Health signatory. The identity of that signatory will be provided to the selected audit firm at the award stage. Firms should not treat correspondence from the RFP contact as contractual acceptance and should direct any questions to Mike Landeck for routing to eCM-Health as needed.
10. General Terms
- This RFP does not obligate eCM-Health to award a contract, enter into negotiations, or reimburse any costs incurred in the preparation or submission of a proposal.
- The RFP Contact does not possess signature authority and may not bind eCM-Health to any agreement, commitment, representation, or contractual obligation. Only an authorized eCM-Health representative may execute or amend a contract arising from this solicitation.
- eCM-Health reserves the right to accept or reject any or all proposals, waive minor informalities, request clarification or additional information, conduct interviews, and negotiate with one or more respondents.
- The selected firm shall execute a mutual non-disclosure agreement prior to receiving access to systems, documentation, source code, credentials, or other non-public information.
- Deliverables produced under the engagement shall become the property of eCM-Health upon payment in full.
- Respondents shall disclose any actual or potential conflicts of interest that could reasonably be expected to affect their objectivity, independence, or ability to perform the engagement.
- The selected audit firm shall not replace key personnel identified in its proposal without the prior written approval of eCM-Health. Any replacement personnel shall possess qualifications and experience substantially equivalent to, or greater than, those originally proposed.
- The selected audit firm shall maintain all insurance coverage represented in its proposal throughout the duration of the engagement and shall provide updated certificates of insurance upon request.
- eCM-Health reserves the right to terminate negotiations with any respondent and to proceed with contract discussions with another respondent if negotiations do not result in mutually acceptable terms.
End of Request for Proposal
AMENDMENT 1.0
To Request for Proposal (RFP) #2026-005
SOC2+ (Type I) Examination Services eCM-Track Web Application
| Q&A | Question | Response | RFP Reference(s) |
| 1 | How did eCM-Health decide to include all 5 trust service criteria? Generally, we see clients choose just Security, or Security/Availability/Confidentiality when it’s their first SOC audit. | The application will process PII and PHI. All 5 TSCs are required to achieve direct, clean control mapping to the mandatory HIPAA Privacy and Security Rules and NIST SP 800-171 Rev 3 frameworks. | Section 1. Statement of Purpose Section 2. Technical Boundary |
| 2 | The RFP only mentions a SOC 2 Type 1, generally clients want a SOC 2 Type 2 as well as that’s really what their customers want. Is there a reason the Type 2 report isn’t included in the RFP? Or would you like me to include that in the proposal? | Live client data will not exist in the environment prior to the January 1, 2027 go-live. The Type I audit validates control design for the pre-launch milestone. | Section 4. Scope of Services |
| 3 | Is it just the eCM-Track application used to store or interact with customer data? | The audit scope is limited to the single application, database, and supporting infrastructure. | Section 2. Technical Boundary |
Questions Submitted 9/29/2026:
| Question | Response | |
| 1 | Could you clarify whether you already have a control matrix you’d like us to review and map, or whether you’d like the build-out of that matrix to be an early scoping activity? | Section 4.A calls for two deliverables: A Master Crosswalk -Tailored Unified Control Matrix |
| 2 | Two questions here: (a) is your team drafting Section 3, with our role being review and feedback? and (b) the schedule shows Section 3 complete before fieldwork begins — since the description typically references details confirmed during walkthroughs and testing, would you be open to a draft-before-fieldwork, finalize-after-fieldwork approach? | Section 4.B describes the scope of work to be performed by the audit firm. |
| 3 | Could you confirm whether the intent was a draft report at that milestone, or whether the dates in the schedule may have been transposed? | Section 4.C Conduct the Assessment Identifies Deliverable 4. -Disregard the first bullet as it’s a copy / paste error from Deliverable 3. Section 5 Time Constraints correctly identifies the final report due date. |