This Justification (J&A) opportunity from Department Of Transportation was posted on August 4, 2026. The submission period has ended. Browse the details below for market research, or find similar active opportunities.
Notification of Award of Sole Source Bridge Action_Cybersecurity and Privacy Program Support Services
Contract Overview
Solicitation details, issuing organization, response deadlines, documents, and interested companies for this government contract opportunity.
Active Opportunities Like This One
AI Contract Overview
The Federal Railroad Administration has awarded a 12-month sole source bridge contract to the incumbent contractor, Criterion Systems LLC, for highly specialized Cybersecurity and Privacy Program Support Services. Running from July 19, 2026, to July 19, 2027, with an estimated value of 775,027 dollars, this action ensures uninterrupted compliance with the Federal Information Security Modernization Act of 2014, OMB Circular A-130, and Departmental cybersecurity directives. The award is necessitated by the United States Department of Transportation's reorganization into a digital factory model under the 1DOT initiative and the FY26 THUD Appropriations Act. The scope of work involves the continuous maintenance of the Risk Management Framework and the Information Security Continuous Monitoring Program across twelve IT systems, including eight production systems and four under active development. These systems span Microsoft Dynamics 365 applications, various cloud environments, and on-premises datacenters. The contractor is responsible for operating and configuring DOT and DHS Security Tool Suites, utilizing tools such as Tenable Nessus, BigFix, and the CSAM repository. Due to the safety-critical nature of the infrastructure, the contract requires senior key personnel with advanced credentials, including CISSP and CISA, to leverage their unique institutional knowledge and mitigate operational risks during the enterprise consolidation.
General Info
Place of Performance
Washington, DC, 20590, USASet-Aside
Documents
2AI Contract Breakdown
Uniform Contract FormatContract not broken down yet
CLEATUS splits the solicitation into Uniform Contract Format (UCF) sections: scope, pricing, deliverables, and evaluation criteria.
Timeline
Organization & Contact Information
Full Description
In strict compliance with GSAR 538.7104-3(b)(ii), this notice is being made publicly available within 14 days after the award of the modification to ensure procedural transparency under GSA’s modernized FSS ordering procedures. This action is a 12-month sole source award to the incumbent contractor, Criterion, for uninterrupted, highly specialized Cybersecurity and Privacy Program Support Services. This bridge extends the period of performance from July 20, 2026 to 07/19/2027. This contract action is necessitated by the United States Department of Transportation’s (USDOT) reorganization of its Information Technology (IT) function into a digital factory model under the 1DOT reorganization
The FRA requires uninterrupted, highly specialized Cybersecurity and Privacy Program Support Services. These services ensure the FRA fully complies with the Federal Information Security Modernization Act (FISMA) of 2014, OMB Circular A-130, and relevant Departmental cybersecurity directives.
The scope of work encompasses comprehensive coverage for all FRA FISMA-reportable systems, requiring the continuous maintenance of the Risk Management Framework (RMF) and the Information Security Continuous Monitoring Program (ISCMP). The architecture currently under administration includes:
- Eight (8) production systems (including three hosted in the cloud, seven Moderate Security Impact systems, and five Privacy systems).
- Four (4) systems under active development, bringing the total technical architecture to twelve (12) IT systems.
- Environment Composition: Microsoft Dynamics 365 applications, cloud environments (SaaS, PaaS, IaaS), and on-premises datacenters.
The contractor is required to operate, monitor, and configure the DOT and DHS Security Tool Suites utilized within the FRA enclave. This includes specialized engineering and administration of tools such as Tenable Nessus, BigFix, SCCM, SCOM, DB Protect, Netsparker, Burp Suite, and the DOT Cybersecurity Assessment and Management (CSAM) repository. The required services mandate senior key personnel—specifically a Project Manager and Senior Information System Security Specialists—possessing advanced credentials (CISSP, CISA, CAP/SSCP, CIPP, CCSK) and deep, institutionalized knowledge of FRA’s safety-critical infrastructure.
These services are essential for the integration of FRA team under the new Digital Factory model mandated by the FY26 THUD Appropriations Act – passed as section D of the Consolidated Appropriations Act, 2026, Consolidated Appropriations Act, 2026 (P.L. 119-75).
Please see the attached sole source justification.
More opportunities from Department Of Transportation → 693JJ6 Federal Railroad Administration
Same awarding agency
Earlier notices in this NAICS code
Posted before this notice, open and closed
Find Active Opportunities Like This
Get AI-powered intelligence on the opportunities still open
Every page of the solicitation package shredded into a compliance breakdown
AI-powered matching based on your capabilities and past performance
Competitor and incumbent history on the requirement
Automated alerts on amendments, Q&A deadlines, and award
Join 750+ contractors already using CLEATUS
