IT Risk Management Services

The Bureau of Reclamation established this Master IDIQ on June 5, 2018, to deliver cybersecurity and risk management services when internal staff capacity is insufficient or specialized expertise is required, but ordering closed on June 3, 2023, and no new task orders may be placed against the vehicle.

The vehicle is no longer active for new work. All 25 task orders awarded under the IDIQ were issued between June 2018 and June 2023, with ordering momentum peaking in 2021 at six orders and declining to two in 2023 before the vehicle closed. The combined potential value across all task orders is $15.7 million, and 100 percent of that value has already been obligated; no capacity remains.

Work contracted under the vehicle centers on federal cybersecurity compliance and infrastructure security: Information System Security Officer (ISSO) services dominate the portfolio, appearing in roughly half of awarded orders with individual order values ranging from $230,400 to $3.8 million. Additional work includes FISMA compliance implementation and maintenance, cybersecurity assessments, incident response support, Industrial Control System (ICS) security services, NERC-CIP compliance, and specialized technical support at Bureau power offices including Grand Coulee.

Competition under the vehicle is concentrated. Spry Methods, Inc. holds 9 orders valued at $9.4 million combined, while Booz Allen Hamilton Inc. holds 16 orders valued at $6.3 million combined; these two primes account for 100 percent of awarded work. All 25 orders are unrestricted (no set-aside used). The sole customer agency is the Bureau of Reclamation itself, which placed all orders.

Task orders employ firm fixed-price pricing and range from $129,771 (a 2023 closeout order) to $3.8 million for sustained ISSO services with extensions. Typical multi-year ISSO orders span 12 months with ceiling values between $800,000 and $1.8 million. Smaller specialized assessments and technical support orders cluster between $200,000 and $700,000.

This vehicle is closed to new awards and no longer offers an entry opportunity for new primes or existing contractors seeking to expand their portfolio under Bureau of Reclamation risk management services.

The United States Bureau of Reclamation (USBR) Risk Management Services Group is responsible for implementing and maintaining compliance with Federal cybersecurity, and related privacy, requirements. The purpose of the professional services IDIQ is to perform required work in support of risk management activities through a task order when workload either exceeds the capacity of the assigned staff or requires specialty knowledge and experience staff does not possess.