CRMA J&A to Notice of Intent

Background
The National Geospatial-Intelligence Agency (NGA) is seeking approval for a three-month sole source extension under the Cybersecurity Risk Management and Assessment (CRMA) Task Order to avoid a break in cybersecurity operations that protect and defend against network cyber-attacks, and provide continuity of cybersecurity support services. The CRMA task order was awarded on 18 July 2018 with a 12-month Base period and two 12-month option periods utilizing the GSA Alliant 2 GWAC vehicle. The contract type is Firm-Fixed Price (FFP) Level-of-Effort (LOE). The CRMA effort will transition to the follow-on contract, Defender, under solicitation HM0476-21-R-0025, with an anticipated award in Q1FY2023.

Work Details
The current contractor, Deloitte Consulting LLC, provides cybersecurity support service to the Chief Information Officer (CIO) and Information Technology Services Directorate (CIO-T). The services include cybersecurity assessment and authorization, risk management, blue team and information system security automation and optimization services to ensure trust in GEOINT services and data. NGA has defined and implemented a Risk Management Framework (RMF) based on National Institute of Standards and Technology (NIST) standards and Intelligence Community Directives (ICDs), carried out by the CRMA contract. RMF processes, tasks, and documentation provide the framework upon which NGA manages risks throughout the information system lifecycle. Assessment and Authorization (A&A) activities, performed using the RMF, are critical to provide NGA authorizing officials with accurate, sufficient, and timely information by which they can make risk-related decisions.

Period of Performance
The period of performance for the three-month sole source extension is from 18 November 2022 through 17 February 2023.