Information Systems Cyber Security and Privacy Services - Bridge

The contract for Information Systems Cyber Security and Privacy Services – Bridge is a sole-source, firm-fixed-price task order under the HHSN316201200126W IDIQ vehicle, issued by HRSA Headquarters in Rockville, Maryland, to maintain uninterrupted cybersecurity support for over 60 mission-critical IT systems, including High Value Assets vital to healthcare programs serving vulnerable populations. With a total value of $4,766,232, the contract includes a three-month base period and a unilateral option to extend for up to six months under FAR 52.217-8, with performance scheduled to conclude no later than October 31, 2026 if the extension is exercised. The award was justified under FAR 16.505(b)(2)(i)(B) due to the unique and highly specialized expertise required, specifically the incumbent contractor’s deep familiarity with HRSA’s complex, customized environment—including Palo Alto firewalls and legacy system configurations—that cannot be replicated without significant risk of operational disruption, data breaches, or compliance failures. Core services encompass Incident Response, SIEM and Cloud Monitoring, Zero Trust Architecture implementation, NIST Special Publication Revision 5 control compliance, Continuous Monitoring, Vulnerability Management, and direct support from Information System Security Officers and cybersecurity analysts, all requiring extensive access to sensitive systems and probable high-level security clearances. Performance is centered at HRSA’s Rockville, MD facility, with no physical delivery or FOB terms applicable, as the work is entirely service-based. The contract was issued as a bridge to sustain operations during a protest and recompetition window, with no competitive process conducted, and while specific contract administration details, payment offices, COR/COTR contacts, or invoice methods are not provided, the Government retains full authority for inspection and acceptance based on adherence to NIST Rev. 5, Zero Trust principles, and other federal cybersecurity standards. No offeror representations, socioeconomic certifications, or UEI/CAGE details were included, as the action was initiated entirely by the agency as a non-competitive bridge procurement to mitigate unacceptable risks to healthcare delivery and data integrity.