IT Security Plan Development and Compliance

The contract involves the development and ongoing maintenance of an IT Security Plan that must fully comply with federal standards including FIPS 200, NIST Special Publications 800-18 and 800-53, and OMB Circular A-130. The scope includes implementing security controls aligned with these frameworks, ensuring continuous alignment with evolving federal requirements, and providing annual security awareness training for all relevant personnel. Incident reporting procedures must be established and maintained to meet mandatory federal reporting obligations, ensuring timely identification, response, and documentation of security events. The work requires deep expertise in federal information security policies and a proven ability to tailor security plans to organizational contexts while maintaining audit readiness. This is a small business set aside subcontract under NAICS code 541611, issued by the Upper Colorado Regional Office of the Department of the Interior. The opportunity was posted on August 4, 2026, with a response deadline of August 18, 2026. Performance location and specific office details are not provided, and no point of contact is listed. Interested parties must be certified as a small business to qualify for this set aside, and proposals are expected to demonstrate technical capability, compliance experience, and a clear methodology for delivering a sustainable, auditable security plan. The contract will be managed under federal subcontracting rules and expectations for adherence to federal cybersecurity mandates.