Cybersecurity Compliance and Monitoring Services

The contract seeks a subcontractor to provide ongoing cybersecurity compliance and monitoring services tied to federal and state regulatory frameworks including NIST 800-53, HIPAA, FERPA, PCI-DSS, and North Carolina data protection laws. The scope includes continuous auditing, operational oversight, and regular reporting to ensure institutional adherence to these standards, with a primary focus on safeguarding sensitive health and educational data within the North Carolina jurisdiction under the Department of Health and Human Services. The work is expected to maintain alignment with evolving regulatory requirements and support robust risk management practices across systems handling protected information. The solicitation was posted on July 9, 2026, with a response deadline of July 23, 2026, and falls under NAICS code 541612 for management, scientific, and technical consulting services. While the agency organizational details and specific point of contact are not provided, the place of performance is designated to North Carolina, indicating the services must be delivered in alignment with state-specific compliance obligations. This subcontract is part of a broader effort to institutionalize security governance and accountability across entities under the DHHS umbrella operating in North Carolina, requiring documented, verifiable compliance activities and proactive identification of control gaps or vulnerabilities.