Continuous Diagnostics and Mitigation Program

The Department of Homeland Security Office of Procurement Operations awarded the Continuous Diagnostics and Mitigation Program Master BPA through the IT-70 Federal Supply Schedule with a shared ceiling of $6 billion and a last date to order of July 1, 2027—approximately 11 months of ordering authority remaining.

Established in October 1996, this vehicle supplies specialized IT tools and Continuous Monitoring as a Service (CMaaS) capabilities to federal civilian agencies for real-time network threat detection, continuous security monitoring, and risk-based decision support across the civilian .gov enterprise. Task orders reflect actual procurement of commercial security software licenses (Tenable, IBM BigFix, Tanium, Forescout), SIEMs, vulnerability assessment tools, identity and access management solutions, and accompanying professional services for implementation and support.

Activity has stalled. The vehicle generated 49 task orders from 2014 through February 2018, with peak ordering in 2015 (20 orders). No awards have been issued in the eight years since the most recent task order in February 2018. Current task-order portfolio shows combined potential value of $743.7 million with $545.7 million obligated (73% burn rate). This dormancy signals that procurement has likely migrated to successor vehicles; pursuit should confirm whether DHS is still accepting orders under this vehicle or has transitioned customers to newer contract mechanisms.

Booz Allen Hamilton dominates by potential value at $235.2 million across four orders, followed by Knowledge Consulting Group Inc. ($152.4 million, 14 orders) and Peraton Enterprise Solutions LLC ($123.1 million, 13 orders). Five primes capture roughly 92 percent of combined potential value, with a long tail of smaller awardees including CGI Federal Inc. and Northrop Grumman Systems Corporation. The concentration among top three primes is moderate by order count (about 53 percent) but steep by value (about 51 percent of portfolio).

Customers are heavily concentrated in DHS. The National Protection and Programs Directorate placed 10 orders worth $456.6 million, and DHS Office of Procurement Operations placed 12 orders worth $169.2 million. The two DHS offices together account for approximately 38 percent of task orders and 64 percent of combined potential value. GSA Office of the Chief Information Officer, DHS Cybersecurity and Infrastructure Security Agency, and other federal agencies round out the customer base.

All 49 task orders carry no set-aside designation—this is an unrestricted vehicle. Task orders use mixed pricing: Firm Fixed Price dominates, with occasional Time and Materials and Labor Hours structures for larger CMaaS integration efforts. Representative order values range from under $20 thousand for software maintenance to over $100 million for enterprise-scale CMaaS deployment and sensor management, though the largest historical orders have now closed out.

The Department of Homeland Security has awarded the Continuous Diagnostics and Mitigation (CDM) Program Tools and Continuous Monitoring as a Service (CMaaS) Master BPA through the IT-70 Federal Supply Schedule. The contract provides specialized IT tools and CMaaS to combat cyber threats in the civilian .gov networks. It includes real-time continuous monitoring, enhancing and automating Civilian Government existing continuous network monitoring capabilities, and correlating and analyzing critical security-related information Enhance risk-based decision making at the agency and federal enterprise level.