IT Security SSN.docx

Center for Consumer Information and Insurance Oversight (CCIIO) Security and Privacy Support Contract Agency: DHHS/CMS/CCIIO/MITG Contracting Office: 7500 Security Blvd. Baltimore, MD 21244 Document Type: Sources Sought Notice (SSN) Title: CCIIO Security and Privacy Support Contract SSN Posted Date: 10/16/25 Response Date: 11/13/25 Classification Code: D - Information technology services, including telecommunication services NAICS Code: 541512 - Computer Systems Design and Related Services Incumbent: Reli Group Sources Sought Notice The Centers for Medicare and Medicaid Services (CMS) is issuing this sources sought synopsis to GSA Multiple Award Schedule (MAS) vendors as a means of conducting market research to identify parties having an interest in and capable of performing services related to address the agency’s need for CCIIO Security and Privacy Support. These needs are described in the appendix below. The result of this market research will contribute to determining the agency’s method of procuring such services in the future. The applicable North American Industry Classification System (NAICS) code tentatively assigned to this procurement is 541512 “Computer Systems Design Services.” There is no solicitation / request for quote or proposal / fair opportunity notice at this time. This request for capability information does not constitute a request for proposals. Submission of any information in response to this market survey is purely voluntary. CMS assumes no financial responsibility for any costs incurred. Any information that the responder considers proprietary should be clearly marked as such. No submissions will be returned and any non-proprietary information will become the property of CMS.

CMS is principally interested in determining whether there are any vendors that can provide the services set forth in the corresponding Statement of Need on GSA MAS. If your organization has the potential capacity to perform such services, please provide the following information: 1) organization name and UEI, point of contact email address and telephone number; 2) responses to the six questions in the Statement of Need; and 3) an affirmative statement verifying that your company does not anticipate having a conflict of interest. If significant subcontracting or teaming is anticipated in order to deliver technical capability, organizations should address the administrative and management structure of such arrangements.

CMS will evaluate market information to ascertain potential market capacity to determine whether there are businesses capable of supporting the services outlined in the Statement of Need.

Telephone inquiries will not be accepted or acknowledged, and no feedback or evaluations will be provided to companies regarding their submissions.

This is a SSN only. This SSN is solely for information and planning purposes. The SSN does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. This request for information does not commit the Government to contract for any supply or service. CMS is not seeking proposals and will not accept unsolicited proposals. The U.S. Government will not pay for any information or administrative costs incurred in response to this SSN. Entities may participate in a future RFP, if issued, even if they do not respond to this SSN.

Interested parties who consider themselves qualified to perform the services necessary to address the needs described herein are invited to submit a response by the following date: 11/13/25. All responses under this RFI must be submitted via email to the following email address; Victoria.Nguyen@cms.hhs.gov, corey.lloyd@cms.hhs.gov and Benjamin.Stidham@cms.hhs.gov. If you have any questions concerning this notice, please contact the Contracting Officer, Benjamin Stidham, at the following email address: Benjamin.Stidham@cms.hhs.gov.

Statement of Need:

Background: The CCIIO Security and Privacy Support Contractor is tasked with generally supporting CMS in establishing security oversight, monitoring data analysis, governance compliance. The Contractor will provide support the following tasks:

· Task 1: State Administering Entity and Non-Exchange Entities Support

· Task 2: Internal CMS Security and Privacy Program Support

· Task 3: Management of Mission-Critical MARS-E Suite and Supporting Documents Support

· Task 4: Agreements Management Support

· Task 5: Information System Security Officer Support

· Task 6: Exchange Security and Privacy Strategies and Standards Development and Integration

· Task 7: Cyber Security Support

· Task 8: Outcome Investigation and Forensic Analysis A summary of each task is included below:

· Task 1: State Administering Entity and Non-Exchange Entities Support: This task focuses on supporting state-based health insurance exchanges and non-exchange entities that operate in the marketplace. The contractor serves as an administrator for document repositories and information management platforms, managing security and privacy artifacts submitted by states through systems like the State Exchange Resource Virtual Information System (SERVIS). Key activities include knowledge and records management, providing lifecycle support for Administering Entities (AE) and Non-Exchange Entities (NEE), and delivering technical assistance and outreach to state AEs. The task ensures compliance with Affordable Care Act (ACA) program requirements and maintains proper oversight of state-submitted documentation. This comprehensive support helps CMS maintain effective oversight of the various exchange models including State-Based Exchanges, Federally Facilitated Exchanges, and State Partnership Exchanges.

· Task 2: Internal CMS Security and Privacy Program Support: This task provides internal support to CMS's security and privacy programs. The contractor assists CMS in maintaining and enhancing its internal security and privacy capabilities. This support includes assistance with policy development, compliance monitoring, and program administration activities. The task ensures that CMS's internal security and privacy frameworks remain robust and effective.

· Task 3: Management of Mission-Critical ARC-AMPE Suite and Documentation Support: This task involves managing mission-critical systems and supporting documentation, specifically the Acceptable Risk Controls for Affordable Care Act (ACA), Medicaid, and Partner Entities (ARC-AMPE) suite. The contractor is responsible for maintaining these critical systems that support CMS operations. Documentation support ensures that all system-related materials are properly maintained and updated. This task is essential for maintaining operational continuity of critical CMS systems. The contractor must ensure these systems remain functional and well-documented to support ongoing CMS missions.

· Task 4: Agreements Management Support: This task focuses on managing various agreements that CMS maintains with external partners and entities. The contractor provides support for agreement lifecycle management, ensuring compliance with contractual obligations. This includes managing Enhanced Direct Enrollment (EDE) agreements, web-broker agreements, and other partnership arrangements. The task ensures that all agreements are properly maintained and that parties comply with their obligations. Effective agreements management is crucial for maintaining the integrity of the marketplace and protecting consumer interests.

· Task 5: Information System Security Officer (ISSO) as a Service: This task provides dedicated ISSO services to CMS, with six to eight Senior Information Engineers serving as ISSOs for the CMS Exchange portfolio of systems. These individuals fulfill all responsibilities outlined in HHS Information Security and Privacy Policy, including security control assessment and contingency planning coordination. The ISSOs must complete required training within 60 days of their start date, including CMS FISMA Continuous Tracking System (CFACTS) and seven ISSO training modules. This task ensures that CMS has dedicated security professionals overseeing the Exchange systems. The "as a service" model provides CMS with experienced ISSO capabilities without the need to hire and train internal staff.

· Task 6: Exchange Security and Privacy Strategies & Standards Development and Integration: This task develops and integrates security and privacy strategies and standards for the Exchange ecosystem. It includes three sub-tasks: enterprise risk management for CCIIO and Marketplace systems, security and privacy governance with risk management and compliance, and partner program integrity. The contractor works to establish comprehensive security frameworks that govern all Exchange operations. This task ensures that security and privacy considerations are integrated into all aspects of Exchange operations. The strategic approach helps CMS stay ahead of emerging threats and regulatory requirements.

· Task 7: Cybersecurity Support: This comprehensive cybersecurity task includes multiple sub-tasks covering continuous diagnostics and mitigation, emerging technologies assessment, cyber risk management, and Zero Trust implementation support. The contractor provides specialized support for Open Enrollment cybersecurity readiness, ensuring systems are prepared for high-traffic periods. An optional Security Operations Center (SOC) capability may be included to provide 24/7 monitoring and incident response. Migration efforts include monitoring processes, tracking security tools in Splunk, and ensuring scanning and agent tools remain operational. This task provides comprehensive cybersecurity coverage to protect CMS systems and data from evolving threats.

· Task 8: Outcome Investigation and Forensic Analysis: This task provides investigative and forensic analysis capabilities to preserve marketplace integrity by investigating violations of federal regulations and CMS agreements. The contractor investigates agents, brokers, direct enrollment entities, web brokers, and agencies for compliance violations on an ad hoc basis as directed by CMS. Activities include reviewing technical artifacts, access logs, API logs, and firewall configurations to identify improper data access or transmission. The contractor also examines business processes, interviews personnel, and evaluates compliance with federal regulations and CMS safeguards. Investigation findings are compiled into comprehensive reports that CMS uses to determine appropriate enforcement actions against non-compliant entities.

Problem: CMS is interested in determining whether there are any businesses that are capable of providing the services set forth in the corresponding tasks. If significant subcontracting or teaming is anticipated in order to deliver technical capability, organizations should address the administrative and management structure of such arrangements. Responses to each question should not exceed 1-page each.

Desired Results: The principal outcome CMS is seeking to achieve is to establish comprehensive security oversight and monitoring capabilities that ensure ACA compliance across all state exchanges and federal Exchange entities while strengthening CMS's internal security posture. Through effective management of state administering entities, robust cybersecurity support, and thorough investigation capabilities, the contractor should preserve Exchange integrity and protect consumer data. The ultimate goal is to create a well-coordinated ecosystem where CMS can effectively monitor, support, and enforce compliance among all Exchange participants while maintaining the highest standards of security and privacy. All efforts should result in enhanced protection of consumer information, improved marketplace operations, and proactive identification and mitigation of security threats and compliance violations.

The contractor's success will be measured by their ability to provide seamless support across all eight task areas - from state entity oversight and internal CMS support to cybersecurity monitoring and forensic investigations - ensuring that the Exchange operates securely, efficiently, and in full compliance with federal regulations and CMS agreements. Additionally, CMS is interested in learning more about industry’s experience on the following questions (responses to all questions should not exceed 6 pages):

1. Describe your organization's experience in providing cybersecurity support services, including Continuous Diagnostics and Mitigation (CDM), Zero Trust implementation, and attack surface analysis for large-scale federal healthcare systems or similar complex IT environments. Include specific examples of contracts where you've delivered quarterly cybersecurity reports and risk assessments.

2. Detail your experience supporting state-based health insurance exchanges or similar federated systems with security and privacy compliance. Describe your approach to managing relationships with multiple state entities and providing tiered technical support through ticketing systems and help desk services.

3. Outline your approach to managing multiple concurrent tasks including state AE support, internal CMS meeting support (10-15 meetings per month), quarterly reporting, and ad-hoc research requests. Describe your project management methodologies and quality assurance processes.

4. Can you describe your experience with investigating violation of federal regulations including the specific federal regulations you previously investigated; how your company ensured compliance with federal regulations in your investigations; and how you collaborated with federal agencies?

5. Provide details of contracts similar in scope and complexity to this CCIIO Security and Privacy Support requirement. Include contract values, performance periods, customer references, and any lessons learned that would benefit this engagement.

6. Teaming and Subcontracting Strategy: If applicable, describe your teaming arrangements or subcontracting strategy for this requirement. How would you leverage partner capabilities to meet the diverse technical requirements while maintaining accountability and quality control?