Information System Security Plan (ISSP) Development

The contract entails the development and annual validation of an Information System Security Plan (ISSP) aligned with VA Directive 6500 and NIST standards, ensuring robust security practices are documented and maintained without requiring direct access to any IT systems. This effort focuses on creating a comprehensive, compliant framework that outlines security controls, risk management strategies, and operational procedures to safeguard sensitive information under the Department of Veterans Affairs’ purview. The work is intended to support ongoing compliance and audit readiness through structured documentation and routine reviews, even in the absence of hands-on system interaction. This is a total small business set-aside subcontract under NAICS code 541611, reflecting a commitment to awarding opportunities to small businesses. The solicitation was posted on July 16, 2026, with a response deadline of July 24, 2026, and the place of performance is designated as San Antonio, Texas, with a ZIP code of 78229. The contracting office is the 257-NETWORK Contract Office 17 (36C257) within the Department of Veterans Affairs, emphasizing the mission-critical nature of the ISSP to VA’s broader information security posture. The absence of direct IT access underscores the need for strong communication, policy interpretation skills, and thorough methodology to accurately reflect security requirements through documentation alone.