Cybersecurity Information and Program Services (CSIPS)

The Cybersecurity Information and Program Services (CSIPS) Blanket Purchase Agreement (BPA) is a multiple-award contract vehicle established by the U.S. Department of Transportation to provide comprehensive cybersecurity services across its various agencies and offices. The BPA enables task orders for a wide range of cybersecurity solutions, including information security assessments, cybersecurity management support, security authorization services, policy development, training, and technical cybersecurity support. With a total shared ceiling of $46.2 million and an award date of December 26, 2019, the contract vehicle is designed to offer flexible, on-demand cybersecurity capabilities to support the Department of Transportation's diverse technological infrastructure and security requirements.

The task orders under this BPA consistently demonstrate a focus on critical cybersecurity functions across multiple DOT agencies, including the Federal Highway Administration, Maritime Administration, Federal Railroad Administration, and the Immediate Office of the Secretary. Prime contractors frequently winning task orders include Ernst & Young LLP, Criterion Systems (a tribally-owned, minority-owned small business), Kingfisher Systems, Deloitte Consulting, and Maximus Federal Consulting. Task orders typically range from $1.4 million to $10.8 million, with performance periods spanning one to three years. Most task orders utilize either labor hours or firm fixed-price contract types and do not employ specific small business set-aside designations. Geographical performance is primarily concentrated in Washington, D.C., with task orders supporting cybersecurity needs such as information security assessments, management support, cloud security, authorization services, and policy development across various DOT operational components.