The Office of the Secretary of Defense awarded an Indefinite Delivery Contract (IDC) under the Crowdsourced Vulnerability Discovery and Disclosure (CVDD) program to HackerOne Inc., a for-profit cybersecurity services provider. The total small business set-aside contract has a ceiling value of $34,000,000. Through this IDC and associated delivery orders, HackerOne provides the Department of Defense with a range of cybersecurity services, including bug bounty programs, vulnerability disclosure, penetration testing, and crowdsourced security assessments. The contract work is performed primarily in the Washington D.C., San Francisco, and Arlington, VA areas. Recent delivery orders under this IDC have ranged from $309,748 to $513,000 for specific services such as providing CVDD bug bounty programs, CUAS and MYSTATUS CVDD services, and general crowdsourced vulnerability discovery and disclosure. This IDC supports the Department of Defense's efforts to enhance information security through the use of crowdsourcing and ethical hacking techniques. The original CVDD solicitation was issued by the Office of the Secretary of Defense in July 2018 as a total small business set-aside. It sought proposals for a multiple award IDIQ contract to provide crowdsourced vulnerability discovery and disclosure services across the Department of Defense. The solicitation included requirements for bug bounty software, vulnerability disclosure programs, penetration testing, and other cybersecurity assessments leveraging crowdsourced expertise. The resulting CVDD IDIQ contract was awarded in September 2018, enabling the Department to issue subsequent delivery orders to HackerOne and other small business contractors for these critical cybersecurity services.
Mod # | Description | Reason For Modification | Federal Obligation (Click to sort descending) | Date (Click to sort ascending) |
|---|---|---|---|---|
| P00007 | Other Administrative Action | $0 | 3/16/22 | |
| P00006 | Other Administrative Action | $0 | 12/17/21 | |
| P00005 | Other Administrative Action | $0 | 12/10/21 | |
| P00004 | Change Order | $0 | 7/14/21 | |
| P00003 | Other Administrative Action | $0 | 9/28/20 |
Name | Description | Awardee | Potential Value (Click to sort descending) | Award Date (Click to sort descending) | Completion Date (Click to sort descending) | Updated At (Click to sort descending) |
|---|---|---|---|---|---|---|
Delivery Order HQ003418D0032-HQ003420F0668 | Hackerone Inc. | $441.8k | 9/29/20 | 9/29/21 | 9/27/21 | |
Delivery Order HQ003418D0032-HQ003419F0581 | Hackerone Inc. | $513.0k | 8/30/19 | 10/10/19 | 4/20/20 | |
Delivery Order HQ003418D0032-HQ003421F1002 | Hackerone Inc. | $217.1k | 9/30/21 | 9/29/22 | 4/17/24 | |
Delivery Order HQ003418D0032-HQ003418F0674 | Hackerone Inc. | $325.2k | 9/30/18 | 12/31/18 | 3/25/20 | |
Delivery Order HQ003418D0032-HQ003420F0623 | Hackerone Inc. | $309.7k | 9/29/20 | 9/29/21 | 3/18/21 |
Name | Description | Solicitation Number | Federal Agency | Type | Posted Date (Click to sort descending) |
|---|---|---|---|---|---|
DDS Crowdsourced Vulnerability Discovery & Disclosure Services (CVDD) FA2 | HQ003418R0202 | DOD Washington Headquarters Service | Solicitation 1/2 | 7/13/18, 9:27 AM | |
Crowdsourced Vulnerability Discovery and Disclosure (CVDD) Services | HQ003418R0202 | DOD Washington Headquarters Service | Award Notice 2/2 | 10/23/18, 4:13 PM |