Information System Security Plan (ISSP) Development and Compliance Testing

The contract requires the development and ongoing maintenance of an Information System Security Plan (ISSP) that fully complies with VAAR 852.239-71 for a cloud-based laboratory document system. The contractor must ensure all security controls and procedures are documented, implemented, and continuously updated to meet federal requirements for protecting sensitive data within the VA’s information technology environment. In addition to plan development, the contractor is obligated to conduct regular compliance testing in accordance with VAAR 852.239-74 to validate that the system remains in alignment with established cybersecurity standards and to identify any necessary corrective actions. This subcontract is a Total Small Business Set-Aside under the SBA program, exclusively available to small businesses as defined by the NAICS code 541618, which covers other scientific and technical consulting services. Performance of the work is located in Spokane, Washington, with a response deadline of May 14, 2026, and the contract was posted on May 7, 2026. The contracting office is part of the Department of Veterans Affairs, specifically the 260-NETWORK Contract Office 20. The nature of the work demands a high level of technical expertise in cybersecurity governance, compliance auditing, and cloud-based system management to support the secure handling of laboratory-related documentation under federal regulations.