Cyber Security Engineering and Risk Management Framework Support

The Army Contracting Command at Aberdeen Proving Ground is preparing to solicit cybersecurity engineering and DoD Risk Management Framework support services, with the official solicitation expected by October 29, 2026 and award anticipated in November 2026. This is a 100-percent Women-Owned Small Business (WOSB) set-aside, designated as Economically Disadvantaged WOSB (EDWOSB), under NAICS 541519 with a 150-employee size standard.

Performance will occur at Aberdeen Test Center, Building 358, Aberdeen Proving Ground, Maryland. The contractor will provide RMF analysis, planning, execution, and maintenance of Authority to Operate status for four ATC systems—the Aberdeen Test Center Local Area Network (ATC LAN), Logically Isolated Network (ATC LIN), Secure Test Environment (ATC STE), and Test and Evaluation Network (ATC T&EN)—across SECRET and TOP SECRET classification levels. Core tasks include reviewing engineering changes for system compliance, supporting configuration management, providing architectural support, identifying and assessing cybersecurity requirements per DoD RMF and ICD 503 standards, selecting and implementing security controls, conducting security assessments, supporting authorization activities, and maintaining continuous monitoring.

All contractor personnel must hold active SECRET security clearances (Type 3 Investigation) at contract commencement; one surge position requires TOP SECRET clearance (Type 5 Investigation). Key personnel must comply with DoDM 8140.03 cyber workforce standards. The IT Systems Solutions Architect-Senior/Contract Manager requires CISSP certification and minimum ten years of RMF lifecycle management experience. Three IT Certified Professionals-Senior require CASP+, SecurityX, or CYSA+ certification (CISSP mandatory for lead) with minimum five years of RMF experience; one surge position requires three years of Top Secret environment documentation experience.

The contract is firm fixed-price with a base year of November 23, 2026 through November 22, 2027, followed by four optional 12-month extension years through November 2031. Estimated workload is 2,040 hours annually per labor category (4,080 hours total base year, with 4,080 surge hours). The incumbent contractor is W91CRB-21-C-0044. Questions on the draft pre-solicitation were accepted until October 22, 2026, via email only. The final solicitation will post for two weeks prior to November 2026 award.