CMS Cybersecurity Risk Management Program Support Services
Forecast Recompete Updated
- Agency
-
Centers for Medicare and Medicaid Services
Department of Health and Human Services
- Solicitation expected
- Estimated value
- $50,000,000 to $100,000,000
- Set-aside
- Total Small Business
Forecast facts
- Incumbent contract
-
- 47QTCA19D00HL Federal IDV award held by Assyst Inc. Ordering ends Aug 13, 2029 · Ceiling $100,000
- Anticipated award
- Through
- Acquisition strategy
- Follow-on to Existing Contract
- NAICS code
- Not on record
- Forecast number
- 270478
- Points of contact
Forecast details come from CMS's procurement forecast. Agencies' dates and values are estimates.
About this forecast
The Centers for Medicare and Medicaid Services is recompeting support services for its Cybersecurity Risk Management Program, with solicitation release estimated for October 20, 2026, and award expected January 4, 2027. CMS requires support to manage cybersecurity risk across the enterprise through data-driven, continuous risk monitoring that delivers near-real-time visibility into system security posture and prioritizes remediation efforts. The program's strategic objectives include strengthening continuous monitoring, advancing risk-based data analytics and reporting, launching a ThreatTrace assessment program for hosting-provider cyber risk detection, and continually evolving program capabilities.
The award is expected to range from $50 million to $100 million on a total small business set-aside basis, with a five-year period of performance beginning January 29, 2027. This is a competitive GSA Multiple Award Schedule order placed through the Information Technology category. Contracting Officer Andrew Mummert (andrew.mummert@cms.hhs.gov, 410-786-0403) and Warren Glass (warren.glass@cms.hhs.gov, 410-786-1137) at CMS serve as primary points of contact.
The recompeted award succeeds GSA Federal Supply Schedule contract 47QTCA19D00HL, originally awarded to Assyst Inc. on August 14, 2019, with a $100,000 ceiling and ultimate completion date of August 13, 2029. Under this schedule, Assyst issued a delivery order for CMS Cyber Risk Management valued at $30.1 million (January 25, 2024), representing the primary scope of work being recompeted. Assyst is a minority-owned, Subcontinent Asian American-owned small business based in Sterling, Virginia, with an approved GSA price list covering over 70 labor categories in cybersecurity, health IT, and IT professional services ranging from $55.11 to $214.21 per hour.
Forecast text
The CMS Cybersecurity Risk Management (CRM) Program aligns processes, data, technologies, and services to manage cybersecurity risk across the enterprise. It drives a shift toward data-driven, continuous risk monitoring, enabling near-real-time visibility into system security posture and smarter prioritization of remediation efforts. As a core part of the CMS Risk Management Strategy, the program builds the processes needed to assess, respond to, and monitor risk to agency operations, assets, and stakeholders over time. Its strategic objectives include strengthening continuous monitoring, advancing risk-based data analytics and reporting, launching a ThreatTrace assessment program for hosting-provider cyber risk detection, and continually evolving the program's capabilities.
On GovTribe
Work this forecast
- Track it in your pipeline
- Find teaming partners
- Similar forecasts
- Ask GovTribe AI about this forecast