IT Security Documentation & RMF Artifact Development

The contract requires the development and ongoing maintenance of System Security Plans and Risk Management Framework artifacts to ensure compliance with NIST, FISMA, and HHS/NIH security frameworks. This work focuses on producing and updating federal compliance documentation that supports the security posture of systems managed by the National Institutes of Health, specifically under the NIAID division of the Department of Health and Human Services. The contractor will be responsible for aligning all documentation with current federal standards and ensuring continuous adherence to mandatory security controls and reporting requirements. Performance of this subcontract is centered in Bethesda, Maryland, with a NAICS code of 541611 indicating it falls under Management, Scientific, and Technical Consulting Services. The contract was posted on July 10, 2026, and is structured as a subcontract, meaning the winning entity will operate under the primary contractor or prime agreement. There is no set-aside designation specified, and the work is critical to sustaining the agency’s federal cybersecurity posture, requiring expertise in RMF processes, documentation rigor, and deep familiarity with HHS and NIH-specific compliance expectations.