Notification of Award of Sole Source Bridge Action_Cybersecurity and Privacy Program Support Services
Awarded Limited / Sole Source Justification Posted
- Solicitation number
- IT-1
- Agency
-
Federal Railroad Administration
Department of Transportation
- Set-aside
- No set-aside
Opportunity facts
- Contract number
- 693JJ621F000026 Federal contract award
- Awardee
- Criterion Systems, L.L.C.
- NAICS code
- 541513 Computer Facilities Management Services
- Place of performance
- Washington, District of Columbia 20590, United States
- Points of contact
Notice details come from SAM.gov. Updated .
About this opportunity
The Federal Railroad Administration has awarded a sole-source bridge contract to Criterion Systems LLC for Cybersecurity and Privacy Program Support Services, with an estimated value of $775,027 and a period of performance from July 19, 2026, to July 19, 2027.
The justification cites GSAR 538.7104-3(b)(ii), grounding the sole-source award in the unique and highly specialized nature of the services and the incumbent's nontransferable, system-specific architectural knowledge. Market research in early 2026 confirmed that no alternative commercial vendor can assume administration of FRA's safety-critical systems instantaneously without operational breaks. The award bridges the FRA's reorganization under the Department of Transportation's digital factory model (1DOT), mandated by the FY26 THUD Appropriations Act. Uninterrupted service is operationally critical: a 90 to 120-day transition period for onboarding new personnel would create unacceptable cybersecurity and operational risks to rail systems and compromise continuous compliance with the Federal Information Security Modernization Act of 2014 and OMB Circular A-130.
The scope encompasses comprehensive coverage for 12 FISMA-reportable IT systems: eight production systems (three cloud-hosted, seven with Moderate Security Impact designation, and five Privacy systems) and four systems under active development. The contractor operates, monitors, and configures DOT and DHS Security Tool Suites, including Tenable Nessus, BigFix, SCCM, SCOM, DB Protect, Netsparker, Burp Suite, and the DOT Cybersecurity Assessment and Management repository. Required personnel include a Project Manager and Senior Information System Security Specialists with advanced credentials (CISSP, CISA, CAP/SSCP, CIPP, CCSK). Upon conclusion of this bridge, the legacy FRA pipeline will transition into the centralized USDOT Digital Factory vehicle for full and open competition. Cost reasonableness derives from historical price analysis, GSA Schedule alignment verification, and an Independent Government Cost Estimate formulated by the FRA IT program office.
Notice text
In strict compliance with GSAR 538.7104-3(b)(ii), this notice is being made publicly available within 14 days after the award of the modification to ensure procedural transparency under GSA’s modernized FSS ordering procedures. This action is a 12-month sole source award to the incumbent contractor, Criterion, for uninterrupted, highly specialized Cybersecurity and Privacy Program Support Services. This bridge extends the period of performance from July 20, 2026 to 07/19/2027. This contract action is necessitated by the United States Department of Transportation’s (USDOT) reorganization of its Information Technology (IT) function into a digital factory model under the 1DOT reorganization
The FRA requires uninterrupted, highly specialized Cybersecurity and Privacy Program Support Services. These services ensure the FRA fully complies with the Federal Information Security Modernization Act (FISMA) of 2014, OMB Circular A-130, and relevant Departmental cybersecurity directives.
The scope of work encompasses comprehensive coverage for all FRA FISMA-reportable systems, requiring the continuous maintenance of the Risk Management Framework (RMF) and the Information Security Continuous Monitoring Program (ISCMP). The architecture currently under administration includes:
- Eight (8) production systems (including three hosted in the cloud, seven Moderate Security Impact systems, and five Privacy systems).
- Four (4) systems under active development, bringing the total technical architecture to twelve (12) IT systems.
- Environment Composition: Microsoft Dynamics 365 applications, cloud environments (SaaS, PaaS, IaaS), and on-premises datacenters.
The contractor is required to operate, monitor, and configure the DOT and DHS Security Tool Suites utilized within the FRA enclave. This includes specialized engineering and administration of tools such as Tenable Nessus, BigFix, SCCM, SCOM, DB Protect, Netsparker, Burp Suite, and the DOT Cybersecurity Assessment and Management (CSAM) repository. The required services mandate senior key personnel—specifically a Project Manager and Senior Information System Security Specialists—possessing advanced credentials (CISSP, CISA, CAP/SSCP, CIPP, CCSK) and deep, institutionalized knowledge of FRA’s safety-critical infrastructure.
These services are essential for the integration of FRA team under the new Digital Factory model mandated by the FY26 THUD Appropriations Act – passed as section D of the Consolidated Appropriations Act, 2026, Consolidated Appropriations Act, 2026 (P.L. 119-75).
Please see the attached sole source justification.
Awarded contract 693JJ621F000026 to unknown vendor for unknown amount on 2026-07-21.
Files
| File | Type | Posted |
|---|---|---|
| Criterion Sole Source_Bridge_Redacted.pdf | ||
| Criterion Sole Source_Bridge_Redacted.pdf |
On GovTribe
Work this opportunity
- Track it in your pipeline
- Find teaming partners
- Similar opportunities
- Ask GovTribe AI about this opportunity