DA01--Enterprise Cybersecurity Program Audit Support (VA-26-00036760)

The Department of Veterans Affairs Technology Acquisition Center intends to solicit Enterprise Cybersecurity Program Audit Support as an SDVOSB set-aside on GSA MAS IT PS SIN 54151S, with anticipated release in early June 2026. This is a single-award task order for audit cycle management and OIT Audit Portal sustainment supporting FISMA, FISCAM, IRS Publication 1075, and other compliance audits across Veterans Health Administration, Veterans Benefits Administration, and National Cemetery Administration.

The base period is 12 months from award with three optional 12-month extensions and one optional 60-day transition services period (maximum 50 months total). Performance is fully remote at contractor facilities during standard federal business hours (8:00 AM to 5:00 PM Eastern Time); no travel is anticipated. Work involves project management, audit stakeholder coordination, findings tracking and corrective action management, trend analysis, OIT Audit Portal management with Tier 1–3 helpdesk support, approximately 50 data visualizations and dashboards per period, and SharePoint development.

Contractor must comply with VA Technical Reference Model, VA Critical Security Controls, FICAM standards including PIV card authentication, IPv6 compatibility, Trusted Internet Connection requirements, and comprehensive cybersecurity standards. All personnel require Tier 2 background investigation clearance per VA Handbook 0710. Generative AI capabilities are optional and subject to VA security and accreditation standards if proposed. All deliverables must use MS 365 suite applications or government-approved equivalents.

The RFI response deadline was April 7, 2026. The most recent modification (May 27, 2026) provided government responses to 73 technical questions. Contract Specialist Nicole Bestreski (nicole.bestreski@va.gov, 848-377-5144) is the point of contact. NAICS 541512 applies with a $34 million small business size standard.