Limited Sources Justification (LSJ) for CSP-RMF Support Bridge

Background
The Department of Health and Human Services (HHS) is issuing a Limited Sources Justification (LSJ) for the award of Task Order No. 140D0426F0095 to Booz Allen Hamilton Inc. for Cyber Security Program Risk Management Framework (CSP-RMF) Support Bridge.

This task order is necessary to maintain critical cybersecurity management and process oversight for the National Institute of Allergy and Infectious Diseases (NIAID) during a transition period until a competitive follow-on task order can be awarded. The current task order is set to expire on December 14, 2025, and due to delays caused by a protest and subsequent shutdowns, there is an urgent need for continued support to protect NIAID's IT systems and ensure compliance with regulatory requirements.

Work Details
The contractor will provide comprehensive Risk Management Framework (RMF) services, including:
- Preparing documentation for RMF processes
- Categorizing Information Systems
- Selecting Security Controls
- Implementing Security Controls
- Assessing Security Controls
- Authorizing Information Systems
- Monitoring Security Controls.

Additionally, the contractor will follow an issue resolution process for any identified vulnerabilities or issues throughout the RMF. This includes communicating issues to stakeholders, documenting risk-based decisions such as risk acceptance, correcting vulnerabilities, retesting, or creating a Plan of Action and Milestones (POA&M). This process ensures an audit trail, accelerates the RMF, and documents management accountability.

Period of Performance
The period of performance will be six months, anticipated to start on December 15, 2025, and continue through June 14, 2026.

Place of Performance
The contract will be performed at locations relevant to NIAID's operations.