CMS Cybersecurity Risk Management Program Support Services

The CMS Cybersecurity Risk Management (CRM) Program aligns processes, data, technologies, and services to manage cybersecurity risk across the enterprise. It drives a shift toward data-driven, continuous risk monitoring, enabling near-real-time visibility into system security posture and smarter prioritization of remediation efforts. As a core part of the CMS Risk Management Strategy, the program builds the processes needed to assess, respond to, and monitor risk to agency operations, assets, and stakeholders over time. Its strategic objectives include strengthening continuous monitoring, advancing risk-based data analytics and reporting, launching a ThreatTrace assessment program for hosting-provider cyber risk detection, and continually evolving the program's capabilities.

Estimated value

>=$50M and <$100M

Est. solicitation date

Oct 20, 2026

Anticipated award

Jan 4, 2027

Contract type

Firm Fixed Price

Period of performance

Jan 29, 2027 – —