Security & Compliance Support (ATO/POA&M)

The contract seeks specialized support to achieve and maintain Authorization to Operate (ATO) for systems handling sensitive health information, with a focus on compliance with HIPAA, NIST standards, and HHSAR regulations. Key deliverables include the development and maintenance of a System Security Plan, ongoing continuous monitoring, active vulnerability management, and rigorous tracking of Plans of Action and Milestones to ensure remediation of identified gaps. This work is critical to sustaining the security posture of HHS systems and must adhere to federal cybersecurity frameworks and healthcare data protection requirements. The contract is classified as a subcontract under NAICS code 541618 and is being managed by the Omas Strategic Buying Center under the Department of Health and Human Services. Performance is required in Rockville, Maryland, with a zip code of 20852. The solicitation was posted on August 7, 2026, and responses are due by August 17, 2026, at 8:00 PM Eastern Time. The opportunity is open to eligible subcontractors capable of delivering comprehensive cybersecurity compliance services aligned with HHS mandates and federal security standards.