Cybersecurity and Compliance Implementation

The contract requires the implementation and ongoing maintenance of comprehensive cybersecurity controls aligned with NIST Risk Management Framework, CIS Controls Version 8, FISMA, and PCI DSS standards across the Metropolitan Atlanta Rapid Transit Authority’s IT infrastructure. The contractor must deploy a Security Information and Event Management system to enable real-time monitoring, threat detection, and incident response capabilities tailored to the transit environment. In addition to technical deployment, the contractor is responsible for conducting regular self-audits to ensure continuous compliance with regulatory requirements and to identify gaps in security posture that may expose critical transit systems to cyber threats. All work must be performed to support the integrity, confidentiality, and availability of systems handling sensitive operational and passenger data. This subcontract is issued by the Georgia office of the Metropolitan Atlanta Rapid Transit Authority with a solicitation response deadline of June 17, 2026, and falls under NAICS code 541513 for computer systems design services. While no set-aside designation or specific point of contact is provided, performance is expected to support the agency’s IT environment in Georgia without specified geographic constraints beyond the agency’s operational scope. The contract emphasizes proactive security posture management through automated tools and structured audit cycles, ensuring that cybersecurity practices remain effective and compliant with federal and industry mandates applicable to public transportation systems.