A 12-month sole source bridge award to incumbent contractor Criterion extends the period of performance from July 20, 2026 to July 19, 2027 for Cybersecurity and Privacy Program Support Services. This action supports the Federal Railroad Administration (FRA) during the USDOT's reorganization into a digital factory model, ensuring compliance with FISMA, OMB Circular A-130, and departmental directives. The scope covers continuous maintenance of the Risk Management Framework (RMF) and Information Security Continuous Monitoring Program (ISCMP) for 12 IT systems, including operation and configuration of security tool suites such as Tenable Nessus, BigFix, and SCCM. The contract requires senior key personnel with advanced credentials and deep institutional knowledge of FRA’s safety-critical infrastructure. No budget amount or performance location is specified.

In compliance with transparency requirements, this notice was made public within 14 days after the award of a 12-month sole source bridge to incumbent Criterion for Cybersecurity and Privacy Program Support Services, extending the period of performance from July 20, 2026 to July 19, 2027. The services are essential for the FRA to maintain FISMA compliance, including the Risk Management Framework and continuous monitoring across eight production systems and four systems under development, spanning cloud and on-premises environments. The contractor will operate and configure DOT and DHS security tool suites (e.g., Tenable Nessus, BigFix) and must provide senior key personnel with advanced credentials like CISSP and CISA. This action supports FRA’s integration under the new Digital Factory model mandated by the FY26 THUD Appropriations Act.