Cybersecurity Vulnerability Remediation

The contract seeks a subcontractor to identify, assess, and remediate 20 specific cybersecurity vulnerabilities within Amtrak’s critical infrastructure systems, ensuring alignment with the NIST Cybersecurity Framework version 1.1 and the performance goals established by CISA. The work requires a structured approach to vulnerability management, including thorough risk evaluation, prioritization based on impact and exploitability, and timely implementation of corrective measures to strengthen system resilience against cyber threats. All remediation activities must be documented and executed in a manner that supports continuous compliance with federal cybersecurity standards and enhances the overall security posture of Amtrak’s operational technology environments. The solicitation was posted on June 24, 2026, with responses due by July 24, 2026, and is classified as a subcontract under NAICS code 541512 for computer systems design services. The contracting agency is FEMA, operating under the Department of Homeland Security, though no specific point of contact or place of performance details are provided. The work is expected to be delivered remotely or on-site as needed to support Amtrak’s infrastructure, and no set-aside preferences are indicated. Contractors must demonstrate proven experience in critical infrastructure cybersecurity, familiarity with NIST CSF v1.1, and the ability to deliver measurable results within the specified timeframe.