Arctic Submarine Laboratory (ASL) - Cyber Security Engineering, test and evaluation, and Risk Management Framework (RMF)

The U.S. Navy’s Arctic Submarine Laboratory (ASL) is seeking a qualified contractor to provide comprehensive cybersecurity engineering, test and evaluation, and Risk Management Framework (RMF) support services for its VICE and SEAWOLF/LA‑Class submarine systems. The work includes migration to RMF Revision 5 (NIST SP 800‑53 Rev 5), continuous monitoring, vulnerability scanning, STIG application, and maintenance of Windows 10/11 baselines, with all documentation recorded in eMASS. The contract is a one‑year firm‑fixed‑price effort (July 2026‑July 2027) performed on‑site at the ASL facility in San Diego, CA. The solicitation is a sole‑source RFQ with a submission deadline of 2 July 2026 (HST). • Provide RMF support (A&A, AO, non‑IT packages) and migrate controls to NIST 800‑53 Rev 5. • Conduct ACAS/SCAP scans, apply STIGs, and document findings in eMASS. • Maintain and transition Windows 10 baseline to an approved Windows 11 baseline, including regression testing and system‑integration support. • Deliver all required artifacts, POA&M remediation, and act as Navy‑qualified validator.