Cyber Security Engineering and Risk Management Framework Support Services

The contract seeks an 8(a) sole-source contractor to provide comprehensive Cybersecurity Engineering and Department of Defense Risk Management Framework (RMF) Support Services at Aberdeen Proving Ground, Maryland, under a Firm Fixed-Price contract with a five-year period of performance running from September 1, 2026, to August 31, 2031, including one base year and four option years. The contractor is responsible for supplying all personnel, equipment, materials, facilities, transportation, and non-personal services required to execute the work, excluding government-furnished property, and must align all activities with the Performance Work Statement and associated technical exhibits, including the Performance Requirements Summary, Deliverables Schedule, and Estimated Workload Data. Key performance metrics demand 100% completion of Anti-Terrorism Level 1 Training within 30 days of task order release, 100% monthly quality delivery, and financial report accuracy at or above 99%, with transition-in activities required to be at least 90% on time. All proposed personnel must hold an active Secret security clearance at the time of submission, with one surge role requiring Top Secret clearance; personnel must also attain and maintain DoD 8570.01-M baseline certifications within six months of award, complete cybersecurity awareness training, sign the Army IT User Agreement, and be registered in the Army Account Validation System. The contractor must submit a detailed Quality Control Program for government acceptance and adhere to a formal Telework Plan approved by the Contracting Officer’s Representative. Key personnel, including an IT Systems Solutions Architect-Sr. and a Contract Manager with a designated alternate, must be committed and available Monday through Friday, 8:00 a.m. to 4:30 p.m. The contractor is required to comply with NIST SP 800-53, DoDI 8510.01, AR 25-1, and AR 25-2, and the government retains unlimited rights to all deliverables, including source code, which may not be used or sold without written approval. Invoices must be submitted electronically using Wide Area Workflow (WAWF) per DFARS 252.232-7003, and the contractor assumes full responsibility for safeguarding government equipment, keys, combinations, and information systems. Proposals are due by May 29, 2026, and must be emailed to both designated points of contact with