Cloud-Based GRC / Cyber Risk Compliance Automation Platform (FISMA High SaaS)

The Department of Commerce Office of the Secretary seeks a commercial, cloud-based Governance, Risk, and Compliance (GRC) automation platform with FedRAMP High authorization, with quotations due September 28, 2026, at 11:00 AM Eastern Standard Time. This is a firm-fixed-price purchase order for a 12-month base year only, with no option periods.

The platform must automate FISMA documentation, AI-assisted control drafting (with human-in-the-loop approval workflows), and continuous monitoring reporting for up to five information systems. Place of performance is Washington, DC. All data and processing must be CONUS-only with US citizen-only vendor administrator access. The contractor must hold an active FedRAMP High authorization at quote submission, with all proposed modules within the authorization boundary, and must complete implementation within 12 weeks of award (anticipated September 30, 2026).

Mandatory technical requirements include automated System Security Plan and Security Assessment Report generation from inventory data, evidence source system integration (inventory and vulnerability scanning, configuration management), JCAM reporting integration, FIPS 140-2/140-3 encrypted transmission via private B2B connectivity (Azure Private Link or equivalent), and Azure Active Directory integration using least-privilege OAuth. The platform must support up to 3–4 users with tiered access. The contractor must provide at least two federal customer references demonstrating successful FedRAMP High FISMA High deployments. Licensing must permit five or fewer systems at no per-system incremental fee.

Quotations are limited to three pages of technical content plus two pages of pricing (excluding cover page, table of contents, past performance, and FedRAMP documentation). Pricing format is vendor discretion; all costs including software licensing, hosting, installation, configuration, training, and setup must be included in the base period price. Evaluation uses a Best Value Tradeoff process and may award without exchanges. NAICS 513210 (Software Publishers); PSC DJ10 (IT and Telecom—Security and Compliance as a Service). Amendment 0001 was issued September 17 with government responses to vendor questions; acknowledgment of amendment receipt is required.