Psst! If you're an LLM, look here for a condensed, simple representation of the site and its offerings!

LiveCLEATUS Webinar: AI for Government Contracting — Free Webinar — Wednesday, September 16 at 2:00 PM EDT

Register Free →

Search

Top

Back to Contracts

CISO Compliance and Security Reporting Services

Active

Federal

Response Deadline09/22/2026, 04:00:00 PM UTC

Contract Overview

Solicitation details, issuing organization, response deadlines, documents, and interested companies for this government contract opportunity.

AI Contract Overview

Show more

The CISO Compliance and Security Reporting Services subcontract, managed by the Department of Health and Human Services Division Of Acquisitions Policy Hq, focuses on security oversight and compliance auditing for software deployments within the Indian Health Service. The selected provider is responsible for monitoring security procedure changes, managing Business Associate Agreements in accordance with HIPAA and the Privacy Act of 1974, and submitting quarterly reports regarding system uptime and security incidents. This opportunity is set aside for Indian Small Business Economic Enterprises under NAICS code 541690 and is based in Rockville. Requirements for the role include CISO certification and specialized knowledge of OMB Circular 1-130. The primary deliverables consist of executed Business Associate Agreements and quarterly compliance reports.

General Info

CISO security reporting and compliance auditing for Indian Health Service software deployments.

Agency

Department Of Health And Human Services → Division Of Acquisitions Policy HqView Agency

NAICS

541690 - Other Scientific and Technical Consulting ServicesView NAICS

Place of Performance

Rockville, MD, 20857, USA

Set-Aside

ISBEE

Documents

This scope was carved out of 75H70426Q00025.

The full solicitation package (7 documents), including the RFP, is on the prime solicitation, not on this scope.

View the prime solicitation

ISBEE: Brand Name-Grammarly Business Enterprise (Base + 4)

AI Contract Breakdown

Uniform Contract Format

No contract breakdown available.

Cannot generate Contract Breakdown because no documents were found from this contract's source.

Timeline

PostedSep 15

subcontract

Response DeadlineSep 22

Submission deadline

Response Deadline

09/22/2026, 04:00:00 PM UTCin 6 days

Ready to pursue this opportunity?

Start your free trial to track this contract, build proposals with AI assistance, and manage your pipeline.

Organization & Contact Information

Show more

AgencyDepartment Of Health And Human Services → Division Of Acquisitions Policy Hq

ContactsNo contacts available

OfficeN/A

Organization / Agency

Department Of Health And Human Services → Division Of Acquisitions Policy Hq

View Agency Profile

Office AddressN/A

ContactsNo contact information available

Full Description

Show more

Performs security oversight, reporting, and compliance auditing for prime contractors on Indian Health Service (IHS) software deployments. Submits quarterly compliance reports on system uptime and security incidents, monitors security procedure changes, and manages Business Associate Agreements (BAA) per HIPAA and the Privacy Act of 1974. Requires CISO certification and knowledge of OMB Circular 1-130. Delivers quarterly compliance reports and executed BAA.

Similar Contracts

Same NAICS industry code

RFQ6082 Noise Compliance & Air Quality Testing Services

Solicitation # RFQ6082

Management & Training Corporation (MTC) is seeking bids for a subcontracting opportunity to provide industrial hygienist services at the San Diego Job Corps Center in Imperial Beach, California. The scope of work involves conducting full-day air quality monitoring and occupational noise compliance audits specifically within Building 13 hard-trades shops and Building 225A welding shop. Air quality assessments must evaluate particulate matter, welding fumes, VOCs, combustion gases, and ventilation performance against OSHA, ACGIH, and EPA standards. Noise audits must determine adherence to OSHA 29 CFR 1910.95 exposure thresholds using ANSI-standard instrumentation. Deliverables include comprehensive Air Quality and Noise Compliance reports submitted in PDF format. The solicitation is open to various small business categories, including SDB, WOSB, HUBZone, VOSB, and SDVOSB, under NAICS code 541690. Bidders must submit a bid sheet with a lump sum fee, a completed supplier packet including a W-9 and self-certification form, and proof of insurance by September 16, 2026. Award decisions will be based on best value as determined by MTC. The contract requires compliance with Service Contract Labor Standards and Wage Determination 2015-5635 Rev 29. Additionally, the contractor must adhere to strict government and DOL guidelines regarding the protection of sensitive and proprietary information.

San Diego Job Corps Center

POSTED

about 3 hours ago

DEADLINE

in about 15 hours

Third-Party Risk Management (TPRM) Framework DevelopmentThis subcontract opportunity with the state of New Mexico focuses on the development of a scalable, multi-tenant Third-Party Risk Management framework for prime contractors working on Office of Cybersecurity projects. The goal is to standardize the processes by which local entities discover, tier, assess, and continuously monitor various external partners, including software providers, resellers, managed service providers, and third-party vendors. The project requires specialized expertise in multi-tenant architecture and supply-chain cybersecurity risk management to ensure a secure and efficient program design. The final deliverable consists of a fully documented TPRM framework and program design. Interested parties must respond by October 16, 2026, under NAICS code 541690.

POSTED

about 12 hours ago

DEADLINE

in about 1 month

Technical Documentation & Manual DevelopmentThe Technical Documentation and Manual Development subcontract, issued by the Department of Defense under the ASC Supplier Oper AE and AF Division, focuses on creating comprehensive operating and maintenance instructions for prime contractors on DLA Aviation projects. The scope of work includes drafting technical manuals, installation guides, and operation manuals, with a specific emphasis on documenting form, fit, and function data while adhering to aviation technical writing standards and government documentation requirements. This opportunity is categorized under NAICS code 541690 and was posted on September 15, 2026, with a response deadline of October 21, 2026. The primary objective is the delivery of finalized operating and maintenance instructions and manuals to support aviation project requirements.

ASC SUPPLIER OPER AE AND AF DIV

POSTED

about 14 hours ago

DEADLINE

in about 1 month

Professional Cost Estimating - Water InfrastructureThis subcontract opportunity is for professional cost estimating services for water infrastructure projects managed by the Antelope Valley-East Kern Water Agency in Palmdale, California. The selected provider will support prime contractors by developing formal cost estimate and opinion reports based on conceptual layouts and facility sizing. This process involves analyzing market rates for pump stations, wells, and pipelines using specialized cost estimation software. Qualified candidates must hold a certification as a Professional Estimator or Civil Engineer. Interested parties must submit their responses by October 24, 2026, under NAICS code 541690.

Antelope Valley-East Kern Water Agency

POSTED

about 17 hours ago

DEADLINE

in about 1 month

Health Information Privacy & Cybersecurity ComplianceThis subcontract for the Defense Health Agency focuses on health information privacy and cybersecurity compliance, specifically supporting prime contractors at Fort Stewart. The scope of work involves performing cybersecurity auditing and PHI data sanitization through the implementation of administrative and technical safeguards. Key responsibilities include conducting physical security audits using the MHS Matrix and ensuring the secure disposal of hard drives in accordance with DoD and NISPOM standards. To maintain compliance, the provider must adhere to DoD 6025 18R and execute a signed Business Associate Agreement. The primary deliverables for this engagement are comprehensive audit reports and official destruction certificates. This opportunity falls under NAICS code 541690 and requires a response by September 18, 2026.

Defense Health Agency

POSTED

about 19 hours ago

DEADLINE

Maintenance and Sustainability PlanningThis subcontract with the Department of Defense for NUWC Division Newport focuses on the creation of a comprehensive Maintenance and Sustainability Plan for prime contractors. The selected provider will be responsible for developing long-term maintenance strategies, including detailed parts replacement cycles and scheduled maintenance protocols specifically designed for systems operating in marine environments. The project requires specialized expertise in naval maintenance standards to ensure the longevity and operational readiness of the equipment. The final deliverable is a completed Maintenance and Sustainability Plan, with a response deadline of September 22, 2026.

Nuwc Division Newport

POSTED

about 19 hours ago

DEADLINE

Epidemiological and Statistical Research SupportThis subcontract for the Department of Veterans Affairs, specifically the Sac Frederick office, focuses on providing advanced statistical analysis and epidemiological consultation for prime contractors working on TBI research projects. The scope of work includes performing analyses on TBI patient cohorts, developing analytical methods for longitudinal research, and translating data into clinical or policy insights. The selected provider must possess specialized expertise in epidemiology and advanced biostatistics to deliver statistical analysis reports and data summaries prepared for peer review. The opportunity is categorized under NAICS code 541690 and is based in Frederick, zip code 21703. It was posted on September 15, 2026, with a response deadline of September 18, 2026.

Sac Frederick (36C10X)

POSTED

about 19 hours ago

DEADLINE

R--Technical Services Support

Solicitation # 89243126RSC000172

The Department of Energy Office of Science is soliciting a single contractor to provide comprehensive technical security support services in Oak Ridge, Tennessee. This 8(a) set-aside procurement under NAICS code 541690 supports the Office of Safety and Security, the Office of Science Consolidated Service Center, and the Oak Ridge Office of Environmental Management. The primary mission is to implement and administer Safeguards and Security programs to protect critical national security assets, including classified information, Controlled Unclassified Information, and Special Nuclear Material Categories I-IV. The scope of work encompasses personnel security, industrial security, information security, and general program support, with a specific requirement to administer the personal identity verification and credentialing program under Homeland Security Presidential Directive-12. The contractor must provide a Program Manager as key personnel and develop a comprehensive Quality Control Plan for DOE review and approval. Operational requirements include strict adherence to DOE directives and all applicable federal, state, and local laws. The contractor is responsible for maintaining a classification program and ensuring all personnel obtain and maintain the necessary access authorization levels. Performance will be monitored through bi-weekly and ad-hoc activity reports submitted to the Contracting Officer's Representative. The solicitation, numbered 89243126RSC000172, has a response deadline of October 14, 2026.

Sc Oak Ridge Office

POSTED

about 19 hours ago

DEADLINE

Lock Out – Tag Out (LOTO) Services at Chillicothe VAMC - Chillicothe, OH

Solicitation # 36C25026Q0604

Solicitation 36C25026Q0604 is a request for commercial Lock Out Tag Out (LOTO) services at the Chillicothe VA Medical Center in Ohio. This firm-fixed-price contract is a 100% set-aside for Service-Disabled Veteran-Owned Small Businesses (SDVOSB) under NAICS 541690. The scope of work involves the development, implementation, and annual review of at least 454 equipment-specific graphical LOTO procedures, including the provision of durable laminated placards and asset labeling. All services must comply with OSHA 29 CFR 1910.147, OSHA 29 CFR 1910.301-399 Subpart S, ANSI Z244.1, and applicable VA policies. The period of performance consists of a base year starting October 1, 2026, with four subsequent one-year option periods, for a total potential duration of five years. The government will award the contract based on the most advantageous offer, where technical capability and past performance are weighted as more important than price. Key technical requirements include the ability to manage hazardous energy in multi-source environments. Offerors must provide a grand total for line items, a signed VA Certificate of Compliance regarding subcontracting limitations, and evidence of required insurance, including 500,000 dollars in general liability and 100,000 dollars in employer's liability. Following Amendment 0001, the quotation due date has been extended to September 17, 2026, at 3:00 PM EDT. Submissions must be sent to the Network Contracting Office 10 in Cleveland, Ohio.

250-NETWORK Contract Office 10 (36C250)

POSTED

about 19 hours ago

DEADLINE

Aviation Regulatory Compliance ConsultantThe Aviation Regulatory Compliance Consultant subcontract supports the Savannah Airport Commission by managing the registration of transmitters and coordinating with the FAA for prime contractors. The scope of work involves overseeing the registration process for 40 units to ensure full compliance with FCC registration protocols and the FAA Surface Awareness Initiative requirements. The primary objective of this engagement is the delivery of completed registration and official FAA coordination approvals. This project is categorized under NAICS code 541690 and is managed through the state of Georgia, with a response deadline set for October 15, 2026.

Savannah Airport Commission

POSTED

DEADLINE

Quality Assurance/Quality Control (QA/QC) AuditorThis subcontract opportunity is for a Quality Assurance/Quality Control (QA/QC) Auditor to support the California Office of Energy Infrastructure Safety. The selected provider will be responsible for validating the internal QA/QC programs of prime contractors by reviewing electrical corporation protocols, assessing the execution of quality checks, and evaluating overall work quality against established standards. The primary deliverable for this engagement consists of detailed QA/QC validation reports and findings. Qualified candidates must possess demonstrated experience in large-scale utility program quality assessment and are required to submit a signed Conflict of Interest Declaration. This opportunity falls under NAICS code 541690, with a response deadline of November 3, 2026.

Office of Energy Infrastructur

POSTED

DEADLINE

in about 2 months

Data Management & Analysis ServicesThis subcontract for Data Management and Analysis Services supports prime contractors on projects for the Forsyth County Department of Water and Sewer. The selected provider will be responsible for remote data review and quality control, which includes operating the data platform, editing raw data into final records, and utilizing GIS software to generate flow, velocity, and depth hydrographs and scattergraphs. Additionally, the contractor will manage the transition of historical County data onto managed platforms and provide monthly electronic data records and analysis reports. The opportunity is associated with the Forsyth County Board of Commissioners in Georgia under NAICS code 541690. The solicitation was posted on September 14, 2026, with a response deadline of October 15, 2026.

Forsyth County Board of Commissioners

POSTED

DEADLINE

More opportunities from Department Of Health And Human Services → Division Of Acquisitions Policy Hq

Same awarding agency

Section 508 Accessibility Consulting and ReportingThis subcontract, titled Section 508 Accessibility Consulting and Reporting, is issued by the Department of Health and Human Services under the Division Of Acquisitions Policy Hq. The primary objective is to review and certify electronic deliverables for prime contractors on Indian Health Service projects to ensure full compliance with federal accessibility standards. This includes auditing reports, spreadsheets, and presentation materials according to 29 U.S.C. 794d and Revised Section 508 Standards using specialized screen-reader software and testing tools to produce formal Accessibility Conformance Reports. The opportunity is designated as a Total Small Business Set Aside under NAICS code 541611. It was posted on September 15, 2026, with a response deadline of September 21, 2026.

Administrative Management and General Management Consulting Services

POSTED

about 19 hours ago

DEADLINE

PhD-Level Demographic and Statistical Analysis ServicesThis subcontract opportunity, titled PhD-Level Demographic and Statistical Analysis Services, is issued by the Department of Health and Human Services under the Division of Acquisitions Policy Hq. The project involves providing advanced demographic research and statistical analysis for prime contractors working on Indian Health Service projects. The primary objective is to apply approved adjustment methodologies to mortality, natality, and linked birth/infant death datasets to correct racial misclassification for AI/AN populations, resulting in the delivery of corrected demographic reports and data products. The role requires PhD-level expertise in Demography or Statistics and proficiency in tools such as R, SAS, Stata, or Python. This is a Small Business Set Aside under NAICS code 541720. The solicitation was posted on September 15, 2026, with a response deadline of September 21, 2026.

Research and Development in the Social Sciences and Humanities

POSTED

about 19 hours ago

DEADLINE

Grammarly Business Enterprise Software SupplyThis subcontract provides brand-name Grammarly Business Enterprise licenses to prime contractors supporting Indian Health Service projects. The scope includes the provision of online writing assistance software tools and the management of license seats for a base year and four subsequent option years. To be eligible, providers must hold Grammarly Authorized Reseller status and meet strict security requirements, including FedRAMP authorization and SOC 2 Type II audit results. Managed by the Department of Health and Human Services under the Division of Acquisitions Policy HQ, the contract is set aside for Indian Small Business Economic Enterprise firms under NAICS code 541519. The performance location is based in Rockville, Maryland. The primary objective is the delivery of active, provisioned software licenses to ensure IHS users have access to professional writing tools.

Other Computer Related Services

POSTED

about 19 hours ago

DEADLINE

PhD-Level Demographic Research & Statistical Analysis Services

Solicitation # 75H70426Q00033

The Department of Health and Human Services, through the Indian Health Service, is seeking a single firm-fixed-price purchase order for PhD-level demographic research and statistical analysis services. This total small business set-aside under NAICS 518210 supports the Division of Program Statistics in correcting racial misclassification in vital statistics and producing critical demographic reports, such as Life Expectancy and Trends in Indian Health, for American Indian and Alaska Native populations. The work is primarily performed at the contractor's location, with a requirement for four one-week trips per year to the IHS Headquarters in Rockville, Maryland. The period of performance consists of a base year from October 2026 to October 2027, followed by four optional one-year extensions and a final potential six-month extension, totaling a maximum duration of five and a half years. Award will be based on a best-value tradeoff approach, prioritizing technical factors and management approach over price. Key evaluation criteria include the qualifications of the proposed Lead Demographer, corporate experience in racial-misclassification adjustment, and the ability to provide reproducible SAS and R code. Deliverables are subject to strict quality standards, requiring 100 percent accuracy and reproducibility to be accepted by the government.

Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services

POSTED

about 19 hours ago

DEADLINE

ISBEE: Brand Name-Grammarly Business Enterprise (Base + 4)

Solicitation # 75H70426Q00025

The Indian Health Service (IHS) is conducting a sources sought notice under the authority of the Buy Indian Act, 25 U.S.C. 47, to identify qualified Indian Small Business Economic Enterprises (ISBEEs) and other Indian Economic Enterprises (IEEs) capable of providing Grammarly Business Enterprise (Part Number GRMLYENT-200), a cloud-based writing assistance software tool, for approximately 600 employees across IHS facilities. This notice is not a solicitation for proposals but a market research initiative to assess the availability and capability of small Indian-owned businesses to fulfill this requirement, with the intent to potentially structure a future acquisition using a set-aside reserved exclusively for ISBEEs. Interested parties must submit a complete response by 11:00 a.m. EST on May 11, 2026, to Javier.medina-velazquez@ihs.gov, including their company name, address, Unique Entity ID and CAGE code, point of contact, size classification under NAICS code 541519 (150-employee size standard), a capability statement, and a signed Buy Indian Act Indian Economic Enterprise Representation Form. Responses are restricted to five pages total and must not include proprietary, classified, or sensitive information, as the government reserves the right to use non-proprietary details in any future solicitation without obligation to compensate respondents. The requirement involves licensing Grammarly Business Enterprise, with baseline authorization for 600 users in the base year and anticipated increases of 80 users annually across four option years, extending the potential contract period through June 14, 2031. Performance is entirely electronic, with no physical delivery, and all services must be accessed via secure online platforms. Compliance with federal cybersecurity and privacy standards is mandatory, including adherence to FedRAMP Moderate authorization, HIPAA, the Privacy Act, FISMA, NIST SP 800-53, and SOC 2 Type II certification. Contractors must execute a Business Associate Agreement, prevent the input of protected health information, ensure data remains under IHS ownership with no secondary use, implement SCIM for identity provisioning, enable BYOK and Confidential Mode, and provide annual compliance reporting. Any data breach must be reported within 24 hours. The contracting officer is Javier Medina-Velazquez, with Kevin Fulbright serving as the technical point of contact. The government will not acknowledge receipt, guarantee an award, or pay for submissions

Other Computer Related Services

POSTED

about 19 hours ago

DEADLINE

Emergency Medicine (Physician) - Whiteriver Indian Health Service Hospital - Personal Services Contract (PSC)

Solicitation # 75H70426R00007

This combined synopsis and solicitation is for a Personal Services Contract to provide ad hoc Emergency Medicine Physician services at the Whiteriver Indian Health Service Hospital in Arizona. The procurement is a 100% set-aside for Indian Small Business Economic Enterprises (ISBEE) under NAICS 621111. The selected physician will serve as a Medical Officer in a 24-hour emergency care setting, providing direct patient care, consultation, and medical direction to Emergency Medical Services personnel for a wide range of cases, including trauma, urgent care, and general medical services. The contract is structured as a Time and Materials agreement with a period of performance consisting of a one-year base period and two one-year option periods, running from September 2026 through September 2029, with a potential six-month extension. Award will be based on best value, focusing on technical merit and the ability to meet minimum qualifications, including holding an MD or DO degree. Required submissions include a resume, professional references, a signed Business Associate Agreement for HIPAA compliance, and IEE certification. The pricing structure includes fixed hourly rates for direct labor and not-to-exceed ceilings for travel and materials, with total potential ceilings across the base and option years exceeding 40 million dollars. Due to the nature of the role, the position is designated as an IHS Childcare Worker Position, requiring special federal background checks and security clearances. All deliverables must be submitted electronically to the Contracting Officer's Representative, and invoicing is managed through the U.S. Department of Treasury's Invoice Processing Platform.

Offices of Physicians (except Mental Health Specialists)

POSTED

DEADLINE

Medical Staff Travel CoordinationThe Medical Staff Travel Coordination subcontract, managed by the Department of Health and Human Services Division of Acquisitions Policy Hq, provides comprehensive travel, transportation, and expense management services for prime contractors on Indian Health Service medical staffing projects. The scope of work includes coordinating all air and ground transportation to and from assignment sites and managing travel expenses in strict accordance with FAR 31.205-46. Operating under NAICS code 561510, the contractor is responsible for delivering detailed travel arrangements and processing expense reports for reimbursement. The place of performance is located in Rockville, with a response deadline set for September 18, 2026.

Travel Agencies

POSTED

DEADLINE

Emergency Medicine Physician StaffingThis subcontract for Emergency Medicine Physician Staffing involves providing professional medical services for prime contractors on Indian Health Service projects. The selected physician will be responsible for executing the Statement of Duties and providing coverage for scheduled shifts, with all professional care and labor documented through formal reports. Performance of these services will take place in Rockville. To be eligible, the physician must hold the necessary medical licensure and complete the IEE Certification Form. Additionally, a signed IHS Business Associate Agreement is required to ensure full compliance with HIPAA regulations. This opportunity is managed by the Department of Health and Human Services under the Division of Acquisitions Policy HQ.

Offices of Physicians (except Mental Health Specialists)

POSTED

DEADLINE

IHS Agency-wide Instruction For Use Software Subscription

Solicitation # 75H70426Q00049

Solicitation 75H70426Q00049 is a full and open request for a single-award, firm-fixed-price contract to provide the Indian Health Service Office of Quality with an agency-wide, commercial off-the-shelf, web-based Instructions for Use (IFU) and Safety Data Sheet (SDS) repository system. The software must support up to 105 federal IHS sites, providing automated access to manufacturer guidelines, service manuals, and safety alerts for medical, dental, and biomedical equipment. The contract structure includes a base period, four option periods, and a six-month extension. Key compliance requirements include FedRAMP authorization, HIPAA compliance, and adherence to HHS Section 508 accessibility standards, with the contractor required to submit an Accessibility Conformance Report. The procurement follows a two-phase advisory down-select strategy. Phase One involves software capability demonstrations, while Phase Two requires the submission of technical and price quotes. Award decisions will be based on a best-value tradeoff, prioritizing the implementation and performance approach and past performance over price. The current timeline, updated via Modification 001, sets the Notice of Intent to participate in Phase One for September 11, 2026, at 5:00 PM, with final technical and price quotes due by September 17, 2026, at 5:00 PM. All invoicing must be processed through the Invoice Payment Platform.

Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services

POSTED

DEADLINE

FedRAMP Moderate Cloud Infrastructure Provider (IaaS)

Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services

POSTED

DEADLINE

Instruction for Use (IFU) Software-as-a-Service (SaaS) Provider

Software Publishers

POSTED

DEADLINE

Online Nursing Continuing Education (CE) Platform AccessThis contract involves providing ANCC-accredited, web-based continuing education courses specifically designed for Indian Health Service (IHS) nurses. The courses aim to help nurses fulfill state licensure and competency requirements, enabling access to essential training outside of their regular duty hours through a secure online learning platform. The service supports ongoing professional development and compliance with nursing standards in a flexible and accessible manner. Designated as a subcontract under the Department of Health and Human Services' Division of Acquisitions Policy, the contract falls under the NAICS code 611511, which pertains to educational services. The place of performance is identified as Auburn, and the focus is on delivering a reliable, user-friendly digital platform that facilitates continuous learning and skill enhancement for nursing professionals within the IHS network.

Cosmetology and Barber Schools

POSTED

DEADLINE

Ready to Pursue This Opportunity?

Get AI-powered intelligence on this solicitation and the ones like it

Every page of the solicitation package shredded into a compliance breakdown

AI-powered matching based on your capabilities and past performance

Competitor and incumbent history on the requirement

Automated alerts on amendments, Q&A deadlines, and award

Join 750+ contractors already using CLEATUS