FDA Cybersecurity Risk Management and Compliance Services

The U.S. Food and Drug Administration (FDA) is conducting market research through this Sources Sought Notice to identify small businesses, particularly SBA certified 8(a) vendors, capable of providing Cybersecurity Risk Management and Compliance Services. The FDA seeks contractors with GSA Schedule capabilities in Information Technology Professional Services (54151S) and Highly Adaptive Cybersecurity Services (54151HACS) to support its cybersecurity compliance objectives. Key contract requirements include providing ongoing security authorization services, Learning Management System support, security policy support, Enterprise Governance Risk and Compliance (eGRC) support, cybersecurity risk management documentation services, and transition services in accordance with the Federal Information Security Modernization Act (FISMA) 2014 guidelines. The contractor must demonstrate specific experience with security authorizations, FedRAMP compliance, ongoing authorization processes, and auditing activities. Capability statements addressing these detailed requirements must be submitted by February 4, 2026 at 2:00 PM ET to michelle.dacanay@fda.hhs.gov. This is a Sources Sought Notice only and does not commit the Government to award a contract.

This procurement includes no set-aside designation beyond the stated preference for small businesses and 8(a) vendors. The Sources Sought Notice does not identify any current incumbents or award value range. However, the numerical scope indicates the FDA maintains over 20,000 end users and nearly 400 production and pre-production systems across 111 FISMA-reportable systems, with 59 authorized cloud systems currently in operation. The contractor will be responsible for implementing security controls, conducting continuous monitoring, performing risk assessments, managing documentation, and ensuring compliance with federal cybersecurity standards across this substantial IT infrastructure. The work scope encompasses support for the FDA's Cybersecurity, Counterintelligence, and Insider Threat Program to improve the agency's overall cybersecurity posture and compliance with multiple federal laws and executive orders.