Office of the Chief Information Officer Risk Management Framework
Ended Master BPA Awarded
- Federal agency
-
National Heart Lung and Blood Institute
- Awardees
- 6
- Task orders
- 29
- Obligated
- $68,877,938
Vehicle facts
- Opportunity
-
- 75N92021R0008 Solicitation number
- Agency
-
- National Heart Lung and Blood Institute National Institutes of Health, Department of Health and Human Services
- Combined task order value
-
- $68,877,938 Current, with exercised options
- $74,794,708 Potential, with all options
- Last date to order 100% complete
- Shared ceiling 80% used
- $86,127,000.00
IDV award and task order details come from SAM.gov/FPDS.
About this vehicle
The National Heart Lung and Blood Institute established this Master BPA against the GSA MAS to provide Office of the Chief Information Officer risk management framework services, but ordering closed on April 11, 2026, three months ago and is no longer available for new task orders.
The vehicle was active for just over five years, awarding 29 task orders between September 2021 and September 2025. Order velocity peaked in 2022 with 11 awards, then declined steadily—from six orders in 2023 to four in 2024 to three in 2025. The portfolio has obligated $58.3 million of the combined potential value of $73.1 million, representing 80 percent drawdown. Recent completed orders address security assessment and authorization, system security documentation, cybersecurity assessment management, FISMA support, and enterprise cloud security control assessments.
Four prime contractors hold the entirety of awards. Compass Federal Consulting has the largest position with 12 orders and $24.8 million combined potential value, followed by Veris Group LLC at 10 orders and $17.7 million, Booz Allen Hamilton at five orders and $20.2 million, and Iron Vine Security LLC at two orders and $10.4 million. Task orders are unrestricted; 28 of 29 awards carried no set-aside designation.
Customer concentration is pronounced: the National Heart Lung and Blood Institute placed 16 orders worth $36 million in combined potential value, or approximately 49 percent of the portfolio. The NIH Office of the Director accounts for four orders at $12 million, and the National Library of Medicine for two at $6.3 million. The remaining 24 percent of orders span the Center for Scientific Review, the National Institute of Environmental Health Sciences, the National Institute of Allergy and Infectious Diseases, and other institutes across NIH.
Task-order values range from under $100,000 to $7.7 million in ceiling value, with most orders priced on firm-fixed-price, labor-hours, or time-and-materials bases. Performance periods typically span two to four years. Since the ordering deadline has passed, this vehicle is closed to new competition.
Description
This is a Blanket Purchase Agreement issued against GSA Multiple Award Schedule (MAS) to provide the Office of the Chief Information Officer (OCIO) risk management framework services.
IDV awards
Latest task orders
Show 15 more
Latest 25 of 29 listed here. See the rest on GovTribe.
Top awardees by obligations
| Rank | Awardee | Obligated | Share |
|---|---|---|---|
| 1 | Compass Federal Consulting LIMITED Liability Company | $24,437,213 | 35% |
| 2 | Booz Allen Hamilton Inc. | $20,172,579 | 29% |
| 3 | Veris Group, LLC | $18,299,483 | 27% |
| 4 | Iron Vine Security LLC | $5,968,664 | 9% |
Top funding agencies by obligations
| Rank | Funding agency | Obligated | Share |
|---|---|---|---|
| 1 | Department of Health and Human Services | $68,877,938 | 100% |
Obligations by fiscal year
| Fiscal year | Obligated |
|---|---|
| FY2026 | $11,413,660 |
| FY2025 | $11,421,623 |
| FY2024 | $14,209,556 |
| FY2023 | $15,351,634 |
| FY2022 | $10,702,446 |
| FY2021 | $5,779,017 |
Quick answers
What is the Office of the Chief Information Officer Risk Management Framework contract vehicle?
Office of the Chief Information Officer Risk Management Framework is a blanket purchase agreement (BPA) vehicle run by National Heart Lung and Blood Institute (National Institutes of Health), awarded on April 12, 2021.
Which companies hold Office of the Chief Information Officer Risk Management Framework?
6 companies hold Office of the Chief Information Officer Risk Management Framework's IDV awards, one each. The latest went to Veris Group, LLC on April 12, 2021. The awardees whose task orders obligated the most are Compass Federal Consulting LIMITED Liability Company, Booz Allen Hamilton Inc. and Veris Group, LLC.
How much has been spent through Office of the Chief Information Officer Risk Management Framework?
29 task orders have been placed under Office of the Chief Information Officer Risk Management Framework, obligating $68,877,938.
What is the shared ceiling of Office of the Chief Information Officer Risk Management Framework?
Office of the Chief Information Officer Risk Management Framework's shared ceiling is $86,127,000; its task orders have used 80% of it.
Which agencies use Office of the Chief Information Officer Risk Management Framework the most?
The departments whose task orders under Office of the Chief Information Officer Risk Management Framework obligated the most are Department of Health and Human Services ($68,877,938).
How much was obligated through Office of the Chief Information Officer Risk Management Framework in fiscal year 2025?
Task orders under Office of the Chief Information Officer Risk Management Framework obligated $11,421,623 in fiscal year 2025.
On GovTribe
See this vehicle's full record
- Every IDV award and task order
- Funding by agency, awardee, NAICS and set-aside
- Teaming partners on this vehicle
- Ask GovTribe AI about this vehicle