Cybersecurity Information and Program Services (CSIPS)

The Department of Transportation Immediate Office of the Secretary Transportation established this Master BPA for Cybersecurity Information and Program Services on December 26, 2019, with a shared ceiling of $46.2 million. Ordering closed on March 17, 2026—the vehicle is no longer active.

The BPA has issued 31 task orders across six task areas spanning information security assessment, cybersecurity management support, security authorization services, penetration testing, policy and training support, and enterprise logging infrastructure. Task orders range from firm-fixed-price agreements to labor-hour and time-and-materials arrangements, with typical durations of one to three years. The most recent task order awarded September 30, 2025, to Criterion Systems, L.L.C. for Task Area 6 policy and program support carried a ceiling of $3.96 million and ultimate completion date of September 29, 2028.

Combined task-order potential value stands at $110.2 million, with $87.5 million obligated (79% of potential). Competition is concentrated among three primes: Criterion Systems, L.L.C. holds 11 orders worth $33.3 million combined potential; Kingfisher Systems, Inc. holds 7 orders worth $25.6 million; and Ernst & Young LLP holds 5 orders worth $20 million. These three firms account for 23 of 31 orders (74%). The remaining six orders distributed among Maximus Federal Technology Solutions, LLC; Deloitte Consulting LLP; and K2Share, LLC cover roughly 26% of task-order count but only about 19% of combined potential value.

Customer concentration is heavy: the Department of Transportation Immediate Office of the Secretary Transportation placed 15 orders representing $67.2 million of the $110.2 million combined potential (61%). Four other DOT modal administrations—Federal Highway Administration, Maritime Administration, Pipeline and Hazardous Materials Safety Administration, and Federal Railroad Administration—account for the remaining orders. Fifty-eight percent of task orders carried no set-aside designation; the remainder mix unrestricted and set-aside categories.

Ordering momentum declined sharply: the vehicle averaged 6.75 orders per year from 2021 through 2024 but produced only one order in 2025 before the March 2026 closure. New pursuits against this vehicle are not viable; existing holders may seek final modifications or closeout activity on open task orders.