Sources Sought Notice_Updated 7.29.25.docx

Sources Sought Notice The Centers for Medicare and Medicaid Services (CMS) is issuing this source sought synopsis as a means of conducting market research to identify parties having an interest in and who are capable of providing services that address the agency’s need for Privacy, Risk, Information Security Management (PRISM). These needs are described in the Statement of Need below. The result of this market research will contribute to determining the agency’s method of procuring such services in the future. The applicable North American Industry Classification System (NAICS) code tentatively assigned to this procurement is 541512 “Computer Systems Design Services, 541519 - Other computer related services.” There is no solicitation / request for quote or proposal / fair opportunity notice at this time. This request for capability information does not constitute a request for proposals. Submission of any information in response to this market survey is purely voluntary. CMS assumes no financial responsibility for any costs incurred. Any information that the responder considers proprietary should be clearly marked as such. No submissions will be returned, and any non-proprietary information will become the property of CMS.

CMS is principally interested in determining whether there are any small businesses that are capable of providing the services set forth in the corresponding Statement of Need. If your organization has the potential capacity to perform such services, please provide the following information:

1) Organization name and UEI, point of contact email address and telephone number.

2) Responses to the three questions in the Statement of Need section.

3) Affirmative statement verifying that your company does not anticipate having a conflict of interest.

If significant subcontracting or teaming is anticipated to deliver technical capability, organizations should address the administrative and management structure of such arrangements.

CMS will evaluate market information to ascertain potential market capacity to determine whether there are small businesses capable of supporting the services outlined in the Statement of Need.

CMS will use responses to this notice to inform any decision to set-aside the procurement contemplated herein for small businesses and the channel through which to acquire the services. Telephone inquiries will not be accepted or acknowledged, and no feedback or evaluations will be provided to companies regarding their submissions.

Interested parties who consider themselves qualified to perform the services necessary to address the needs described herein are invited to submit a response to this Sources Sought Notice by the following date: August 7th, 2025. All responses under this Sources Sought Notice must be via email to the Contract Specialist , Richard Thomas and the Contracting Officer, Benjamin Stidham, at the following email addresses: Richard.thomas@cms.hhs.gov and benjamin.stidham@cms.hhs.gov.

Privacy, Risk, Information Security Management (PRISM) Statement of Need The Centers for Medicare & Medicaid Services (CMS) seeks a qualified contractor to provide comprehensive support for the Information Security and Privacy Group (ISPG). This procurement integrates key objectives from Privacy Policy Support, CyberGeek platform maintenance, Enterprise Cybersecurity Awareness and Training, and incident response initiatives to ensure a unified and effective approach to security and privacy management.

Objectives The primary objective of this procurement is to acquire expert services that will support CMS in the following areas:

For more details on the requirement, please review the Statement of Objective (SOO).

Additionally, CMS is interested in learning more about industry’s experience on the following questions (1/2 page response limit per question):

1. How would you manage the lifecycle of privacy agreements, including automation for renewals and compliance tracking?

2. What AI-driven tools or solutions have you implemented in federal environments, and how did they improve security or operational efficiency?

3. Describe your approach to modernizing cybersecurity training programs, including how you ensure engagement, accessibility, and measurable learning outcomes.

Describe your company’s approach to assessing the current technical landscape and processes to find areas for enhancements and improve effectiveness and efficiencies in the SAM processes employed by MITG.