Office of the Chief Information Officer Risk Management Framework

The Office of the Chief Information Officer Risk Management Framework (OCIO RMF) Blanket Purchase Agreement (BPA) is a multiple-award contract vehicle established by the National Institutes of Health (NIH) to provide comprehensive cybersecurity and risk management services. The BPA, with a total ceiling value of $86.1 million, enables NIH institutes and centers to procure specialized information security support through task order competitions. The primary focus of this vehicle is to deliver Risk Management Framework (RMF) services, which include security assessments, authorization processes, continuous monitoring, and information systems security support across various NIH components.

The task orders under this BPA consistently demonstrate a focus on cybersecurity risk management, with contract values ranging from approximately $50,000 to over $11 million. Three prime contractors dominate the vehicle: Compass Federal Consulting LLC, Veris Group (doing business as Coalfire Federal), and Booz Allen Hamilton Inc. Frequent funding agencies include specific NIH institutes such as the National Heart, Lung and Blood Institute, National Institute of General Medical Sciences, and National Library of Medicine. The task orders are predominantly firm-fixed-price or labor-hour contracts, with performance periods typically spanning two to three years. No small business set-asides were used in the awarded task orders, and performance locations are primarily concentrated in Maryland (Bethesda, Westlake) and Virginia (Chantilly, McLean). The contracts consistently support federal cybersecurity compliance, including implementation of the Federal Information Security Modernization Act (FISMA) and conducting comprehensive security assessments and risk management activities.