CPFB Cybersecurity

The Consumer Financial Protection Bureau established this Master BPA for cybersecurity services with a shared ceiling of $68 million on September 12, 2016, but ordering closed on September 11, 2021, making this vehicle closed to new call awards.

All 12 task orders issued under this BPA are unrestricted competitive awards, with no set-aside designations. The portfolio shows uneven competitive concentration: Knowledge Consulting Group Inc. holds three orders worth a combined $55 million in potential value, Deloitte Consulting LLP holds five orders worth $34 million, and Booz Allen Hamilton Inc. holds four orders worth $12.1 million. The combined potential value across all task orders is $101 million, against which $71.7 million has been obligated. All ordering activity funded the Consumer Financial Protection Bureau directly; no other agencies placed calls against the vehicle.

Task orders on this BPA contracted labor-hour cybersecurity support spanning incident response, credential and access management (ICAM), and general cybersecurity functions. Individual call values ranged from approximately $348,000 to $30 million in potential ceiling. The largest single order, awarded to Knowledge Consulting Group Inc. in September 2016, carried a ceiling of $30.1 million; two additional KCG orders awarded in October 2019 each exceeded $12 million in potential value. Deloitte's highest-value order, awarded in February 2022 for ICAM support, carried a ceiling of $4.3 million.

Activity accelerated briefly in 2019, with six orders awarded that year, but momentum slowed sharply thereafter: two orders in 2017, one in 2022, and none after February 2022. The most recent task orders show performance periods extending through late 2023. Nearly all orders priced on labor-hour basis, with obligated amounts closely tracking ceiling values, indicating tightly scoped, fully-funded work streams rather than open-ended task orders.

Since the ordering period closed in 2021, this vehicle no longer accepts new calls. Contractors should redirect pursuit efforts to any successor CPFB cybersecurity vehicles if available.