SSJ: NIH OD OCIO: Information Security Management Support Services

The Government is extending Task Order 75N97021F00077 under GSA Contract 47QTCA19D00HF for 10 months and 15 days, from June 1, 2026, to April 16, 2027, to maintain uninterrupted Information Security Management Support Services for the Office of the Director, Office of the Chief Information Officer at the National Institutes of Health in Bethesda, Maryland. This sole-source modification is authorized under GSAR 538.7104-3(b)(iii) as a logical follow-on to a previously competed Federal Supply Schedule order, ensuring continuity of critical cybersecurity operations while the Government prepares for a competitive recompete under the Foundational IT Centralization initiative. The services encompass seven core functions including asset and vulnerability management, continuous monitoring, incident response, security training, audits, and policy development, all aligned with FISMA requirements and NIST standards to sustain Authorizations to Operate and mitigate risks of non-compliance that could trigger adverse findings from audit bodies such as the GAO or OIG. The incumbent contractor’s deep institutional knowledge and seamless integration into NIH’s security infrastructure make transition to a new vendor during this period unacceptably risky, justifying the extension to avoid operational gaps, preserve real-time dashboards and service desk functions, and uphold the integrity of the cybersecurity posture. No pricing details are provided in the documentation, as the extension relies on prior competitive pricing and is evaluated for fairness and reasonableness based on risk mitigation and cost avoidance. The place of performance remains Bethesda, Maryland, with the Government assuming responsibility for inspection and acceptance based on established performance standards. Key personnel, security clearances, and compliance obligations are inherent to the scope, and no new solicitation or competitive process is being initiated at this stage. The extension is structured to provide a buffer for transition activities while preventing any lapse in essential cybersecurity services vital to NIH’s mission and IT modernization objectives.