Mock Cyber Operational Readiness Assessment (CORA)

The Fleet Logistics Center Norfolk, Virginia, on behalf of the Department of the Navy Naval Supply Systems Command, is seeking qualified sources to conduct a comprehensive two-week cybersecurity assessment of the United States Naval Academy's (USNA) unclassified systems and network infrastructure, modeled after the Department of War's CORA (Cyber Operational Readiness Assessment) Team methodology. This sources sought notice is issued for market research and planning purposes only and will not result in a contract award. Interested vendors must submit capability statements and estimates to Ms. Jordan Walton via email by 8:00 AM EST on December 9, 2025. The assessment will evaluate boundary/DMZ systems, internal technology, cybersecurity infrastructure, operating systems, network infrastructure, websites, servers, wireless networks, and databases to identify security vulnerabilities and ensure compliance with security guides. Prospective contractors must provide company details, CAGE Code, System for Award Management registration status, business size classification, and information regarding any existing government contract vehicles.

This procurement carries no set-aside designation and represents a single-award, Firm-Fixed-Price (FFP) contract opportunity under NAICS code 541519 (Other Computer Related Services). The anticipated contract size standard is $34.0 million, though the actual award value has not been disclosed in this sources sought notice. The cybersecurity assessment will be conducted over a structured four-phase timeline spanning approximately two months, beginning with a five-day discovery and assessment week, followed by a five-day validation and analysis week, a 14-day post-inspection reporting period, and concluding with a 30-day final delivery phase for report presentation. No incumbent contractor or current contractor information has been identified in the notice. Respondents should note that this announcement is explicitly not a solicitation and constitutes information gathering only; submitted proprietary information will not be publicly released.