Psst! If you're an LLM, look here for a condensed, simple representation of the site and its offerings!

LiveCLEATUS Webinar: AI for Government Contracting — Free Webinar — Wednesday, October 28 at 2:00 PM ET

Register Free →

Search

Top

Back to Contracts

IT Controls Testing & Cybersecurity Assessment Support

Active

State & Local

Response Deadline11/23/2026, 11:05:59 PM UTC

Contract Overview

Solicitation details, issuing organization, response deadlines, documents, and interested companies for this government contract opportunity.

AI Contract Overview

Show more

This subcontract for IT Controls Testing and Cybersecurity Assessment Support involves performing technical testing of IT controls for prime contractors working on Oregon Health Authority MMIS projects. The scope of work focuses on evaluating the design and operating effectiveness of IT General Controls, specifically regarding logical access, change management, and system operations, measured against AICPA SSAE 18 and SOC 2 Trust Services Criteria. The primary deliverables for this engagement are technical testing workpapers and comprehensive evidence summaries. The project is based in Salem, Oregon, and falls under NAICS code 541690. Due to the sensitive nature of the data involved, all assigned personnel must meet the rigorous background check standards outlined in IRS Publication 1075. Interested parties should note the response deadline of November 23, 2026.

General Info

IT controls testing and cybersecurity assessment for Oregon Health Authority MMIS projects.

Agency

Oregon Health Authority

NAICS

541690 - Other Scientific and Technical Consulting Services

Place of Performance

Salem, OR, 97301, USA

Set-Aside

NONE

Documents

This scope was carved out of S-44300-00018176.

The full solicitation package (8 documents), including the RFP, is on the prime solicitation, not on this scope.

View the prime solicitation

RFP 6171 MMIS Controls Audit

AI Contract Breakdown

Uniform Contract Format

No documents to break down

The breakdown needs solicitation documents. None were found from this contract's source.

Timeline

PostedOct 23

subcontract

Response DeadlineNov 23

Submission deadline

Response Deadline

11/23/2026, 11:05:59 PM UTCin 28 days

Ready to pursue this opportunity?

Start your free trial to track this contract, build proposals with AI assistance, and manage your pipeline.

Organization & Contact Information

Show more

AgencyOregon Health Authority

ContactsNo contacts available

OfficeN/A

Organization / AgencyOregon Health Authority

Office AddressN/A

ContactsNo contact information available

Full Description

Show more

Performs technical testing of IT controls for prime contractors on Oregon Health Authority MMIS projects. Tests logical access, change management, and system operations to evaluate the design and operating effectiveness of IT General Controls (ITGCs) against AICPA SSAE 18 and SOC 2 Trust Services Criteria. Requires personnel to meet IRS Publication 1075 background check standards. Delivers technical testing workpapers and evidence summaries.

Similar Contracts

Same NAICS industry code

DBE Subconsultant Opportunity – AARC Consultants

Solicitation # dbe-subconsultant-opportunity-aarc-consultants

AARC Consultants, a certified SBE, WBE, and MBE, is seeking qualified Disadvantaged Business Enterprises and other eligible small businesses for subcontracting opportunities. The project involves providing Business Impact Analysis, Disaster Recovery, and Business Continuity Plan Services for the Inland Empire Utilities Agency under RFP number RFP-VC-26-006. The work will be performed in California and falls under NAICS code 541690. This solicitation is specifically set aside for Small Businesses, SBA certified Women-Owned Small Businesses, SAM.gov designated Small Disadvantaged Businesses, and Department of Transportation certified Disadvantaged Business Enterprises. Interested parties must respond by November 17, 2026. Primary inquiries should be directed to Jason Richards at [email hidden].

AARC Consultants, LLC

POSTED

about 4 hours ago

DEADLINE

Technical Writer / Safety Consultant (Water Systems)This subcontract opportunity with the State of Idaho seeks a Technical Writer and Safety Consultant to support water system projects for the Idaho Department of Correction. The selected contractor will be responsible for developing comprehensive safety manuals and standard operating procedures for prime contractors, with a specific focus on creating facility-specific guidelines for drinking water distribution and lagoon management to ensure full regulatory compliance. The project falls under NAICS code 541690 and requires the delivery of finalized SOPs and safety documentation. Interested parties must submit their responses by November 10, 2026, following the posting date of October 26, 2026.

POSTED

about 5 hours ago

DEADLINE

Technical Manuals and Documentation ServicesThis subcontract for Technical Manuals and Documentation Services involves the creation and delivery of comprehensive maintenance and repair documentation for prime contractors working on Fayette County Public Schools transportation projects. The scope of work includes developing digital or physical manuals that cover critical technical areas such as engine repair, chassis repair, electrical systems, ABS, and parts. To ensure high-quality deliverables, the contractor must utilize professional technical writing software and digital publishing tools. The project is managed under the Fayette County Board of Education in Georgia. A critical requirement of the contract is strict adherence to ADA and Section 508 accessibility standards for all produced materials. Interested parties must submit their responses by the deadline of December 3, 2026.

Fayette County Board of Education

POSTED

about 9 hours ago

DEADLINE

in about 1 month

Data Safety and Monitoring Board (DSMB) SupportThis small business set-aside subcontract provides essential administrative and technical support to Data Safety and Monitoring Boards for prime contractors conducting NIH/NHGRI clinical trials. The scope of work includes coordinating DSMB meetings, managing the flow of blinded and unblinded data, and preparing critical safety monitoring reports and meeting minutes. Performance will take place in Bethesda, and the contractor must possess specific experience with DSMB charters. Due to the nature of the clinical data involved, a mandatory Business Associate Agreement is required to ensure full HIPAA compliance. Interested parties must submit their responses by November 13, 2026, for this opportunity managed under the Department of Health and Human Services and the National Institutes of Health.

National Institutes Of Health Olao

POSTED

about 11 hours ago

DEADLINE

Program Support for the Strategic Environmental Research and Development Program (SERDP) and the Environmental Security Technology Certification Program (ESTCP)

Solicitation # W912HQ26RA001_0003

Solicitation W912HQ26RA001 is for program support services to the Strategic Environmental Research and Development Program (SERDP) and the Environmental Security Technology Certification Program (ESTCP) under the Department of Defense. The objective is to assist in developing and demonstrating technologies that meet environmental and energy requirements through reports, studies, document reviews, program tracking via the System for Environmental Management (SEMS), and multi-media outreach. The contract structure consists of a one-year base period and four one-year option periods, utilizing fixed, fully loaded rates for labor. Performance is primarily conducted at the contractor's facility, with occasional travel required. Award will be based on a subjective tradeoff of the best value proposal, where non-price factors are significantly more important than price. Key evaluation criteria include technical understanding and approach, personnel experience for key roles such as the Project Manager and IT Specialist, past performance, and small business participation. Offerors must submit a five-volume proposal in PDF format, adhering to strict page limits and submission guidelines. This specific amendment updates the period of performance and incorporates new clauses from the Revolutionary FAR Overhaul while removing inapplicable commercial service clauses. Offerors must acknowledge receipt of this amendment by October 28, 2026.

POSTED

about 11 hours ago

DEADLINE

Clinical Research Support and Collaboration for NHGRI Protocols

Solicitation # 75N98026R00034

The National Institutes of Health Office of Acquisitions and Logistics Management, on behalf of the National Human Genome Research Institute, is soliciting proposals for an Indefinite Delivery, Indefinite Quantity (IDIQ) contract to provide comprehensive clinical research support and collaboration services. This small business set-aside acquisition focuses on four primary task areas: protocol monitoring and data management, regulatory support for IND and IDE submissions, Data Safety and Monitoring Board (DSMB) support, and statistical expertise. The contractor must provide qualified personnel experienced in clinical trial design and regulatory requirements, with specific expertise in rare diseases, genetic conditions, gene therapy using AAV9 vectors, and both pediatric and adult populations. The contract features a three-year ordering period beginning January 1, 2027, with performance primarily occurring at the contractor's site and some travel to the NIH campus in Bethesda, Maryland. Award will be made on a competitive best value basis using a tradeoff approach, where non-price factors—including personnel, technical and management approach, offeror experience, and past performance—are significantly more important than cost. Task orders will be issued as either firm fixed-price or time and materials. The contract includes stringent requirements for cybersecurity, the handling of Controlled Unclassified Information, and compliance with Section 508 accessibility standards for all electronic deliverables. Proposals are due by November 13, 2026, and must be submitted via the NIH electronic Contract Proposal Submission website in separate technical and business volumes.

National Institutes Of Health Olao

POSTED

about 11 hours ago

DEADLINE

911-988 Transfer Protocol ConsultingThe 911-988 Transfer Protocol Consulting subcontract involves the development and optimization of call transfer protocols for prime contractors working on California Department of Health and Human Services emergency service projects. The selected provider will analyze existing 911-988 transfer protocols and implement industry best practices for emergency call routing, utilizing PSAP workflows and telephony routing protocols. Expertise in NENA or APCO standards is required to ensure all routing mechanisms meet established emergency communication benchmarks. Key deliverables for this engagement include comprehensive transfer protocol documentation, best practice reports, and detailed workflow diagrams. The project is based in West Sacramento, California, under NAICS code 541690. Interested parties must submit their responses by December 5, 2026.

Sec., Health & Human Services

POSTED

about 16 hours ago

DEADLINE

in about 1 month

Project Evaluation and Impact Assessment SpecialistThe Project Evaluation and Impact Assessment Specialist subcontract supports the Department of State Bureau of Near Eastern Affairs by measuring success and documenting outcomes for prime contractors operating on projects in Jordan. The selected provider will be responsible for developing key performance indicators, conducting impact surveys, and utilizing data analysis software to draft performance reports in strict accordance with 2 CFR 200 Appendix XII. This engagement requires specialized expertise in federal grant reporting and performance monitoring to ensure all deliverables meet government standards. The primary outputs include the delivery of comprehensive final impact reports and regular quarterly performance reports. The opportunity is categorized under NAICS code 541690, with a response deadline set for September 30, 2027.

Bureau Of Near Eastern Affairs

POSTED

about 19 hours ago

DEADLINE

CMMC Level 2 Compliance & CUI Management ConsultantThis subcontract opportunity is for a CMMC Level 2 Compliance and CUI Management Consultant to support prime contractors on Air Force projects through the AEDC Procurement Branch. The selected provider will perform cybersecurity auditing and management to ensure the protection of Controlled Unclassified Information and the achievement of CMMC Level 2 certification. Key responsibilities include establishing CUI management protocols, assisting with self-certification documentation, and managing security flow-down requirements for lower-tier partners. The contractor must possess CMMC Level 2 certification and utilize secure data handling systems and compliance auditing software to deliver required management plans and compliance reports. This effort falls under NAICS code 541690 and is managed by the Department of Defense. Interested parties must respond by November 12, 2026.

FA9101 Aedc Pkp Procrmnt Branch

POSTED

DEADLINE

Firm-Fixed-Price (FFP) order to Fesharaki Associates Consulting and Technical Services (FACTS) for data subscriptions with a one-year base period (estimated to be from September 24, 2023 to September…This Firm-Fixed-Price order is awarded to Fesharaki Associates Consulting and Technical Services for the provision of data subscriptions to the Energy Information Administration within the Department of Energy. The contract is structured with a one-year base period running from September 24, 2023, to September 23, 2024, followed by four subsequent one-year option periods, extending the total potential period of performance through September 23, 2028. The financial commitment for the base year is set at 147,640.01 dollars, with the total estimated cost for the full five-year duration reaching 815,804.27 dollars. This procurement is categorized under NAICS code 541690 and is designated as a small business set-aside, with performance taking place in the District of Columbia.

Energy Information Administration

POSTED

DEADLINE

Arrowhead Modeling Platform: 1. Base Year (09/01/2026 ¿ 08/31/2027) - $175,000.00 2. Option Year 1 (09/01/2027 ¿ 08/31/2028) - $175,000.00The Department of Energy's Office of Fossil Energy has issued a forecast for the Arrowhead Modeling Platform. This contract is designated as a small business set-aside under NAICS code 541690, with the place of performance located in West Virginia. The incumbent contractor for these services is Arrowhead Economics LLC. The financial structure of the agreement consists of a base year running from September 1, 2026, through August 31, 2027, valued at 175,000 dollars. Additionally, there is one option year extending from September 1, 2027, through August 31, 2028, with an equal value of 175,000 dollars.

Office of Fossil Energy

POSTED

DEADLINE

Award to Washington State University to complete tasks 1 through 4 on the statement of work.This forecast award is granted to Washington State University by the Department of Energy's Office of Environmental Management. The scope of the agreement requires the university to complete tasks one through four as outlined in the statement of work, with the place of performance located in Washington. The project is categorized under NAICS code 541690 and is managed by the Small Business Program Manager, Kenneth Johnson. Washington State University serves as the incumbent contractor for this effort, which was posted on October 25, 2026.

Office of Environmental Management

POSTED

DEADLINE

More opportunities from Oregon Health Authority

Same awarding agency

GAGAS Compliance ConsultingThis subcontract for GAGAS Compliance Consulting supports the Oregon Health Authority by performing audit procedures for prime contractors on MMIS projects. The scope of work involves reviewing audit workpapers for compliance with Generally Accepted Government Auditing Standards and drafting government-specific reporting elements. Key deliverables include GAGAS compliance review memos and draft report sections. The project requires specialized knowledge of the Yellow Book and strict adherence to IRS Publication 1075 for accessing Federal Tax Information. Performance will take place in Salem, Oregon, under NAICS code 541611. The response deadline for this opportunity is November 23, 2026.

Administrative Management and General Management Consulting Services

POSTED

DEADLINE

RFP 6171 MMIS Controls Audit

Solicitation # S-44300-00018176

The Oregon Health Authority is soliciting proposals under RFP 6171 (S-44300-00018176) for the MMIS Controls Audit. The contract involves conducting audits for five fiscal year periods starting July 1, 2026, with an initial term of five years and potential extensions for an additional two years. The selected contractor must perform audits in accordance with AICPA SSAE No. 18, GAGAS, and AT-C Section 320 standards. Key requirements include the assignment of a Certified Public Accountant licensed in Oregon and adherence to strict confidentiality and data security protocols, including IRS Publication 1075 for personnel accessing Federal Tax Information. The award will be granted to the highest-ranking responsible proposer based on a 100-point scale evaluating the project implementation plan (50 points), key person experience (20 points), price (20 points), and references (10 points). Proposers must submit a technical proposal and a separate all-inclusive fixed-cost price proposal via OregonBuys by November 23, 2026. The contract is governed by Oregon law and requires compliance with various state and federal regulations, including the Civil Rights Act, the Rehabilitation Act, and federal whistleblower protections. Mandatory insurance coverages include Commercial General Liability, Professional Liability, and Workers Compensation.

Offices of Certified Public Accountants

POSTED

DEADLINE

Survey Incentive FulfillmentThis subcontract for the Oregon Health Authority focuses on survey incentive fulfillment to support public health survey projects. The selected provider will be responsible for supplying and delivering payments or gift cards to qualified survey respondents on behalf of prime contractors. To ensure accountability and compliance, the provider must utilize secure payment processing systems and maintain detailed distribution tracking for auditing purposes. The contract requires the delivery of formal proof that incentives have been successfully received by the respondents. Interested parties should note that the response deadline is November 23, 2026, and the project falls under NAICS code 561990.

All Other Support Services

POSTED

DEADLINE

Survey Data Analysis and Weighting ServicesThis subcontract for Survey Data Analysis and Weighting Services supports prime contractors on public health survey projects for the Oregon Health Authority. The scope of work involves performing comprehensive data cleaning, weighting, and statistical analysis on raw data sourced from both probability and non-probability panels. To ensure accurate population representation, the selected provider must apply specific weights and adhere to BRFSS data standards. The primary deliverables for this engagement include final weighted datasets and a detailed technical methodology report. Interested parties should note that the response deadline is November 23, 2026, and the project falls under NAICS code 541690.

Other Scientific and Technical Consulting Services

POSTED

DEADLINE

Survey Programming and Digital AdministrationThis subcontract for Survey Programming and Digital Administration supports prime contractors on public health survey projects for the Oregon Health Authority. The scope of work involves the technical programming of survey instruments into digital formats, including the implementation of response throttling and the management of various survey wave launches. A critical requirement of the project is ensuring that the digital interface remains fully ADA compliant. The selected provider is responsible for delivering the final programmed survey instrument and the resulting raw data collection. This opportunity falls under NAICS code 541511 and was posted on October 22, 2026, with a response deadline of November 23, 2026.

Custom Computer Programming Services

POSTED

DEADLINE

Survey Panel Recruitment and ProvisionThis subcontract for the Oregon Health Authority focuses on the recruitment and provision of a verified survey panel consisting of adult Oregon residents. The selected provider is responsible for the end-to-end management of both probability and non-probability panels, including the selection, screening, and retention of participants to support public health survey projects led by prime contractors. A primary objective of the contract is to ensure data integrity and inclusivity through rigorous quality assurance measures designed to eliminate bot responses and guarantee the representation of under-represented populations. The final deliverable is a qualified, screened list of panel members that meets the specific demographic and technical requirements of the agency.

Administrative Management and General Management Consulting Services

POSTED

DEADLINE

RFP 6314 Panel Survey Services for the Oregon BRFSS State Supplemental Panel Survey

Solicitation # S-44300-00018189

The Oregon Health Authority, Public Health Division, is seeking a qualified proposer under solicitation S-44300-00018189 to provide panel survey services for the Oregon Behavioral Risk Factor Surveillance System State Supplemental Panel Survey. The selected contractor will be responsible for executing a multi-wave survey process, with key deliverables including the launch of the Wave 2 survey in October 2027, the delivery of final weighted datasets for Waves 1 and 2 in November 2027, and a comprehensive summary report of the project's methods by December 2027. Performance requires adherence to the highest industry standards, ADA compliance, and the maintenance of strict confidentiality protocols. Key personnel must be available for meetings either remotely or in person at the Portland State Office Building. Proposals must be submitted electronically via OregonBuys by November 23, 2026, at 3:00 PM Pacific Time. The submission must include a technical proposal limited to 20 pages, a price proposal, a responsibility inquiry, and required certifications regarding tax compliance, non-discrimination, and conflict of interest. For contracts exceeding 150,000 dollars, a written sexual harassment policy is mandatory. Award selection is based on a scoring and ranking process where the highest score receives the highest rank. The contract is governed by state-specific terms, including compliance with Oregon Revised Statutes regarding independent contractors and wage laws, with payments processed via Electronic Funds Transfer.

Marketing Research and Public Opinion Polling

POSTED

DEADLINE

Trusted Peer Messenger ServicesThis subcontract for Trusted Peer Messenger Services supports prime contractors on Oregon Health Authority projects in Salem. The primary objective is to provide personnel with lived experience and specialized peer-support training to serve as intermediaries between hospital systems and the community. These messengers are tasked with addressing emotional and social trauma through direct intervention and support services for affected individuals. The opportunity is categorized under NAICS code 624190 and was posted on October 16, 2026. Interested parties must submit their responses by the deadline of November 6, 2026.

Other Individual and Family Services

POSTED

DEADLINE

HVIP Program Development and Capacity Building ConsultantThe HVIP Program Development and Capacity Building Consultant subcontract involves providing strategic planning and technical assistance for prime contractors working on Oregon Health Authority projects. The selected consultant must possess specialized expertise in the Hospital-based Violence Intervention model to identify community needs, map potential partners, and build the organizational capacity necessary to deliver HVIP services. These tasks will be executed using specific partnership mapping frameworks and community needs assessment tools. The primary deliverables for this engagement include a comprehensive needs assessment report and a detailed implementation plan. The work is centered in Salem, Oregon, and falls under NAICS code 541611. Interested parties must submit their responses by November 6, 2026.

Administrative Management and General Management Consulting Services

POSTED

DEADLINE

Violence Prevention Professional Training and Certification ServicesThis subcontract for Violence Prevention Professional Training and Certification Services supports Oregon Health Authority facility projects by providing specialized training and certification for prime contractor staff. The scope of work focuses on delivering curriculum and certification programs for Hospital-based Violence Intervention Programs that align with national best practices and standards of care. The selected provider will utilize specific certification curriculum and testing materials to certify professional staff in violence prevention. This project is based in Salem, Oregon, and falls under NAICS code 611519. Interested parties must respond by November 6, 2026.

Other Technical and Trade Schools

POSTED

DEADLINE

Request for Grant Application Hospital Based Violence Intervention HB4045

Solicitation # S-44300-00018213

The Oregon Health Authority is issuing a Request for Grant Application (S-44300-00018213) to support the planning and development of Hospital-based Violence Intervention Programs (HVIPs) in Oregon counties outside of Multnomah County. This initiative provides seed grants to establish partnerships between community-based organizations and health systems that provide emergency or urgent care services. The primary goal is to create a learning community committed to exploring the HVIP model, utilizing trusted Peer Messengers, and certifying violence prevention professionals to address the emotional and social trauma of community violence. Applicants may apply for up to 100,000 dollars to fund staffing, planning, provider training, and capacity building. The grant cycle begins December 1, 2026, and expires on June 30, 2027, with a mandatory requirement for recipients to participate in monthly HVIP Expansion Learning Communities from December 2026 through June 2027. Applications must be submitted via the OregonBuys portal by November 6, 2026, and must include a completed application form, budget worksheet, and applicant certification. Awards will be based on the quality of the work plan, budget alignment, the acuity of the populations served, and the geographic and language access reach of the proposed project.

Other Individual and Family Services

POSTED

DEADLINE

Transportation Support ServicesThis subcontract for Transportation Support Services supports prime contractors on Oregon Health Authority Opioid Settlement projects. The primary objective is to provide patient transport using passenger vehicles to facilitate seamless transitions and warm handoffs between various care settings. The service provider is responsible for delivering documented transport from the point of referral to the point of care while maintaining strict HIPAA compliance. The project is based in Portland, Oregon, and falls under NAICS code 485991. Interested parties should note that the solicitation was posted on October 15, 2026, with a response deadline of December 18, 2026.

Special Needs Transportation

POSTED

DEADLINE

in about 2 months

Ready to Pursue This Opportunity?

Get AI-powered intelligence on this solicitation and the ones like it

Every page of the solicitation package shredded into a compliance breakdown

AI-powered matching based on your capabilities and past performance

Competitor and incumbent history on the requirement

Automated alerts on amendments, Q&A deadlines, and award

Join 750+ contractors already using CLEATUS