System Security & Compliance (NIST/FISMA/FedRAMP)

The contract requires the development and ongoing maintenance of a System Security Plan aligned with NIST standards, ensuring adherence to FISMA and FedRAMP requirements for federal compliance. This includes conducting monthly vulnerability assessments to identify and mitigate security risks, as well as providing comprehensive support for SOC 2 Type II audits to demonstrate robust controls over data security, availability, and confidentiality. The scope further mandates adherence to FIPS 140-3 for cryptographic module validation, along with implementation and documentation of CIS benchmarks and STIG guidelines to ensure stringent security configurations across systems and infrastructure. All deliverables must align with the Maryland State Department of Education’s cybersecurity framework, with performance expectations centered on continuous compliance and audit readiness. The work is structured as a subcontract under NAICS code 541611, with a response deadline of July 22, 2026. While specific performance location and point of contact details are not provided, the contractor is expected to support the agency’s broader mission of securing sensitive educational data in a federally regulated environment. No set-aside classifications are indicated, and the solicitation is accessible through the Maryland procurement portal.