Building Control System Cybersecurity Compliance Assessment

The contract entails a comprehensive evaluation and reporting of cybersecurity risks linked to the integration of non-standard controllers into Facility Related Control Systems, ensuring full alignment with NAVFACINST 11000.2 and Department of Defense cyber security standards. The assessment will identify vulnerabilities, analyze potential threats, and provide actionable recommendations to mitigate risks associated with unauthorized or non-compliant control system components, with the goal of maintaining the integrity, availability, and confidentiality of critical infrastructure systems. All findings must be documented in a formal report that adheres to DoD-mandated protocols for cybersecurity risk disclosure and remediation planning. The solicitation is issued as a subcontract under NAICS code 541690, with a response deadline of May 11, 2026, and performance centered in Naples. The work is being conducted under the authority of NAVFACSYSCOM Europe, Africa, Central, a Department of Defense organization responsible for facility systems across multiple regions. The project requires deep expertise in industrial control systems, cybersecurity frameworks specific to defense infrastructure, and experience with regulatory compliance under naval and DoD directives. Proposers must demonstrate proven capability in assessing and remediating cyber risks in building automation and control environments, with a clear methodology for documentation, risk prioritization, and coordination with facility operators to ensure continuity of operations during and after the assessment.