PHI/PII Security & FISMA Compliance Implementation

The contract requires the implementation and documentation of security controls designed to protect protected health information and personally identifiable information, with full alignment to Federal Information Security Management Act standards. This includes establishing technical, administrative, and physical safeguards to ensure data confidentiality, integrity, and availability, while preparing comprehensive documentation to support annual Security Control Assessments through the CFACTS platform. The work must be executed in a manner that enables seamless auditing and continuous compliance validation. The contract is classified as a subcontract under NAICS code 541611, issued by the Office of Acquisition and Grants Management within the Department of Health and Human Services. The solicitation was posted on July 22, 2026, with a response deadline of August 20, 2026. Performance location and contact details are not specified, but the scope is focused on achieving and maintaining FISMA compliance through documented, measurable security controls. All deliverables must be structured to facilitate government audits and demonstrate ongoing adherence to federal information security requirements for sensitive health and personal data.