Information Security and Data Protection Compliance

The contract requires strict adherence to U.S. Department of Health and Human Services security policies, mandating the use of FIPS 140-validated encryption for data protection, NIST SP 800-88 standards for secure media sanitization, and Personal Identity Verification (PIV) compliance for identity authentication. Participants must also demonstrate readiness for FedRAMP Authorizations to Operate, ensuring cloud systems meet federal cloud security requirements. Comprehensive audit support and thorough documentation are essential to verify ongoing compliance across all security controls and operational processes. This subcontract, classified under NAICS code 541690, is issued by the Office of Acquisition and Grants Management within the Department of Health and Human Services, with performance expected to occur in the 21244 zip code area. The solicitation was posted on July 29, 2026, and responses are due by August 12, 2026. Although specific point of contact information is not provided, potential offerors must be prepared to meet all federal cybersecurity standards with full transparency and documentation to satisfy federal audit and compliance obligations.