Privacy, Risk, Information Security Management (PRISM)

The Centers for Medicare and Medicaid Services (CMS) is seeking comprehensive support for Privacy, Risk, Information Security Management (PRISM) services through their Information Security and Privacy Group (ISPG). The procurement integrates multiple security and privacy initiatives including privacy policy support, CyberGeek platform maintenance, enterprise cybersecurity awareness and training, and incident response capabilities. Key objectives encompass strengthening privacy and security policy management using Agile principles, managing privacy service line agreements throughout their lifecycle, enhancing cybersecurity platforms with AI-driven automation, and implementing modernized training programs. The scope covers program and policy management as well as privacy service line and agreement management, with emphasis on leveraging artificial intelligence for security operations automation. Interested parties must submit responses by August 7, 2025, via email to the designated Contracting Officers, and must address three specific questions regarding privacy agreement lifecycle management, AI-driven security tools, and cybersecurity training modernization approaches.

This Sources Sought Notice indicates CMS is conducting market research to determine the availability of small businesses capable of providing these services, with tentative NAICS codes 541512 (Computer Systems Design Services) and 541519 assigned to the procurement. The agency has not yet determined whether to implement a small business set-aside but is specifically evaluating small business capacity in the market. No incumbent contractors, award values, or budget ranges are specified in the available documentation. Respondents must provide organizational details including UEI numbers, contact information, and conflict of interest statements as part of their submissions. The market research phase will inform CMS's decision on the most appropriate procurement channel and potential set-aside designations for the formal solicitation. This pre-solicitation activity represents the initial step in what appears to be a comprehensive cybersecurity and privacy management support contract.