47QFRA26K0008_Amendment 02 _ CISA Strategic Cyber Tools _ RFI Sources Sought _ 24 Aug 2026.pdf

GENERAL SERVICES ADMINISTRATION (GSA)

ASSISTED ACQUISITION SERVICES (AAS)

REQUEST FOR INFORMATION (RFI)

Amendment 002 - 24 Aug 2026

**Changes annotated in Red Font**

1. PURPOSE

This notice is for informational purposes only and IS NOT a request for proposal. It does not constitute a solicitation and shall not be construed as a commitment by the U.S.

Government. A response in any form is not an offer and the U.S. Government is under no obligation to award a contract as a result of this announcement. The U.S. Government will not be responsible for any costs incurred by interested parties in responding to this notice.

Any information submitted by respondents is strictly voluntary. Contact with anyone other than the authorized U.S. Government personnel by potential offerors or their employees regarding this project is strictly prohibited.

This Request for Information (RFI) is a means of conducting market research to determine the capabilities and interest of companies who can support Cybersecurity and Infrastructure Security Agency’s (CISA’s) Tools requirement. The primary North American Industry Classification System (NAICS) code assigned to this procurement is 541512; (task order scope is not limited to this NAICS).

THERE IS NO SOLICITATION OUT AT THIS TIME. This request for capability information does not constitute a request for quotes; submission of any information in response to this market survey is purely voluntary and the Government assumes no financial responsibility for any costs incurred.

2. INTRODUCTION

General Services Administration (GSA), Federal Acquisition Service (FAS), Assisted Acquisition Services (AAS), Civilian Business Unit is releasing this RFI on behalf of CISA. The purpose of this RFI is to assist the Government in conducting market research focused on identifying industry partners capable of delivering enterprise procurement support to the programs within CISA's Capacity Building (CB) Subdivision, as outlined in the following objectives. This information will be used for market research only. The Government is not obligated to release a future solicitation.

This RFI does NOT constitute a Request for Proposal (RFP) and is not to be construed as a commitment, implied or otherwise, by the Government that a procurement action will be issued. Response to this notice is not a request to be added to a bidders list or to receive a copy of a solicitation. No entitlement to payment of direct or indirect costs or charges by the Government will arise as a result of the submission of the requested information. No reimbursement will be made for any costs associated with providing information in response to this announcement or any follow up information requests. Responses to this RFI may be considered in the future determination of an appropriate acquisition strategy for the program. The Government may not respond to any specific questions or comments

Template Version 08/26/2024 1 submitted in response to this RFI or information provided as a result of this request. Any information submitted by respondents as a result of this notice is strictly voluntary.

3. BACKGROUND

The CISA within the Department of Homeland Security (DHS) serves as the nation’s cyber defense agency, leading the effort to understand, manage, and reduce risk to cyber and physical infrastructure across Federal Civilian Executive Branch (FCEB) agencies, the private sector, and State, Local, Tribal, and Territorial (SLTT) governments. CISA works daily with partners to detect and mitigate cyber threats and vulnerabilities. CISA’s Cybersecurity Division (CSD) promotes risk-based policies and best practices across the FCEB. Within CSD, the CB subdivision serves as CISA’s enterprise cybersecurity services management arm and the lead for federal enterprise cybersecurity governance. CB's mission is to enable customers to manage cybersecurity risk by building their capacity through effective cybersecurity policies, tools, and procedures.

4. GOALS AND OBJECTIVES OF THE REQUIREMENT

CISA seeks to expand its buying power for its various programs. The intent is to expand CISA’s buying power for the Continuous Diagnostics and Mitigation (CDM) Program (including FCEB partners) and larger CB initiatives by centralizing cyber tool purchasing.

This support should lead to efficient buying at both the enterprise and individual transactional level, resolving a number of challenges associated with IT/Cyber procurements at scale. Today, Capacity Building and CDM conducts over 600 procurements each year at a dollar value of over $600M across all the Dynamic and Evolving Federal Enterprise Network Defense (DEFEND) buying groups (i.e. , Chief Financial Officers [CFO] Act Agencies and non-CFO Act Agencies) with an expectation of growth in volume. To manage the scale of these procurement actions requires both strategic and tactical procurement approaches for a dynamic cyber capability and requirement set and large CISA customer base (i.e., the FCEB). CISA requires specialized strategic cybersecurity product procurement support to enable the capability deployment and implementation activity for CDM and the broader set of projects across the enterprise.

The primary objective is to enhance procurement processes, achieve cost savings, and develop tracking tools for better management and analysis of procurements by establishing mechanisms and providing support that:

1. Is SIMPLE and EASY TO USE. End users (e.g., CDM and agency customers) must be able to procure and receive tools quickly (in a matter of days or weeks).

2. ESTABLISHES OPTIMAL PRICING WITH FLEXIBLE TERMS. Through their unique relationships and expertise, the contractor shall maintain a menu of products, tools, and software (SW) that has to establish optimal pricing and flexible terms and conditions (T&Cs). Flexible T&Cs includes, but is not limited to mechanisms to eliminate shelfware, ability to pool licensing on behalf of CISA’s customers, transferability, co-terming of licenses, etc. Optimal pricing is defined as the most advantageous pricing being offered for a particular tool across the FCEB year-to-year.

Template Version 08/26/2024 2

3. LEVERAGES EXPERIENCED, HIGHLY SKILLED CYBER AND IT

PROCUREMENT INDUSTRY PARTNERS. Utilize Best-in-Class, industry-leading Software buying expertise to advise CISA, keep pace with the dynamic specialized cybersecurity SW marketplace and drive cost and procurement efficiencies through strategic and tactical acquisition.

5. SCOPE

The scope of this contract is to procure cybersecurity tools and advisory services supporting large scale procurements and license tracking of cyber SW, products, and tools.

The Contractor shall support CISA with strategic and transactional procurement support, enterprise license management, and direct materials purchasing on behalf of the FCEB (including CFO Act and non-CFO Act agencies). Herein and after FCEB refers to both CFO Act and non-CFO Act agencies. The Contractor shall directly support CB to implement an efficient SW buying management process and associated procurement support platforms with the capability to cover, at minimum, a $600M cyber SW procurement footprint per year, equating to a value of approximately $6B or more over the contract lifecycle.

The CDM Approved Product List (APL) has served as the CDM program’s catalog of relevant tools and services since its inception (in 2013). The CDM APL represented a catalog of products, SW, and technologies meeting both CDM requirements and other cybersecurity capability areas. This legacy APL aligned directly to a technical requirements document known as the “Technical Capabilities Volume Two: Requirements Catalog”.

The current administration is aimed at strengthening the unified cyber defense of the Federal government. Future initiatives seek to eliminate duplicative tools from the cyber tool stack, leveraging the collective buying power of the Federal enterprise to reduce fragmentation and standardize tool offerings across all departments and Agency components. CISA is the lead for identifying products and technologies that fulfill core cybersecurity capabilities. These selected products and tools will be organized and managed in a catalog that provides a consolidated enterprise view of all core cyber tools.

To achieve this administration’s strategic vision, CISA’s Capacity Building subdivision enhanced the legacy APL technology and product validation framework, ensuring alignment with all cybersecurity core capability areas. As part of this updated approach, CB created the Technical Capability Catalog (TCC) to replace the former Volume 2 requirements catalog. Today, the TCC serves as the foundation for the new Cyber Product List (CPL), which will supersede the legacy CDM APL. Together, the CPL and TCC provide the baseline for this contract, offering essential context for future next-generation contracts following the DEFEND Task Orders.

The Function descriptions below cover broad areas, and future support may be provided in tasks/subtasks crossing multiple functional areas. The Contractor is expected to be agile and flexible when providing support.

● Function 1: Contract and Project Management

Template Version 08/26/2024 3

● Function 2: Strategic Buying Advisory Support

● Function 3: Acquisition and Procurement Support

● Function 4: Enterprise License Procurement Management

● Function 5: Surge Capacity

6. GOVERNMENT ESTIMATE (annual estimated range) This annual estimate is subject to change. It is currently estimated at a minimum of $600M annually, with an estimated contract lifecycle range of at least $6B.

7. PERIOD OF PERFORMANCE

The anticipated Period of Performance (PoP) for this effort is a one-year base period and nine (9) one-year option periods for a total of ten years. (Subject to Change based on decided contract structure.)

● Base Period: September 23rd, 2027 - September 22nd, 2028

● First Option Period: September 23rd, 2028 - September 22nd, 2029

● Second Option Period: September 23rd, 2029 - September 22nd, 2030

● Third Option Period: September 23rd, 2030 - September 22nd, 2031

● Fourth Option Period: September 23rd, 2031 - September 22nd, 2032

● Fifth Option Period: September 23rd, 2032 - September 22nd, 2033

● Sixth Option Period: September 23rd, 2033 - September 22nd, 2034

● Seventh Option Period: September 23rd, 2034 - September 22nd, 2035

● Eighth Option Period: September 23rd, 2035 - September 22nd, 2036

● Ninth Option Period: September 23rd, 2036 - September 22nd, 2037

8. QUESTIONNAIRE & SUBMISSION INSTRUCTIONS

Complete the questionnaire as outlined below:

1. Responses shall be submitted electronically by email only to CDM Next Generation Tools inbox (cdm.nextgen.tools@gsa.gov). Use the attached questionnaire to provide the requested information (i.e., no substitutions, additions, or deletions).

a. Respondents must clearly reference the Acquisition ID in the subject line of their email (47QFRA26K0008), to ensure the Government receives timely response.

2. All information submitted shall be UNCLASSIFIED. Any information that the Contractor considers “proprietary” should be clearly marked as such, on each page. All submissions become Federal Government property and will not be returned (including any proprietary information).

3. Responses shall be submitted no later than 5 p.m. Eastern Time on 1 September 2026.

Template Version 08/26/2024 4 mailto:cdm.nextgen.tools@gsa.gov

4. All responses shall maintain one-inch margins and be single-spaced and no smaller than 10-point Times New Roman font. Submissions should not exceed 20 pages in total and should include the following, at a minimum. Submissions exceeding the 20 page limit (including Cover Page and Table of Contents) may be disregarded.

a. Provide a Cover Page: that includes the following information:

i. Company name;

ii. Mailing address;

iii. Email address;

iv. Web site address and the name, telephone number, and email address of a point of contact having the authority and knowledge to clarify responses with U.S. Government representatives;

v. Unique Entity Identification (UEI) Number, Commercial and Government Entity (CAGE) Code, company structure (Corporation, LLC, partnership, joint venture, etc.); and

vi. Socio-Economic 8(a) Program status, HubZone, Women-Owned Small Business (WOSB), Service-Disabled Veteran-Owned Small Business (SDVOSB), and Business size.

b. Complete Exhibit 1: Corporate Overview (listed below) shall be no longer than one (1) page in length.

c. Complete Exhibit 2: Prior and Current Corporate Experience (listed below) shall be no longer than one (1) page in length per each example of Corporate Experience). All Corporate Experience must be performed by the respondent as a Prime contractor.

d. Complete Exhibit 3: Corporate Capabilities and Approaches (listed below) shall be no longer than five (5) pages and is further limited below.

**Contractors who do not respond to this RFI are not excluded from any resulting solicitation(s).

Template Version 08/26/2024 5

Exhibit 1: Corporate Overview

Question Answer

Name of Company

Name of Business Unit Responding to the RFI (if applicable)

UEI Number

Commercial and Government Entity (CAGE) Code

Corporate Address

Total Number of Full Time Employees

Website URL

Small Business under North American Industry Classification System (NAICS) Code (insert code)

□ YES

□ NO

Type of Small Business, if applicable (e.g., Woman-Owned, Service Disabled Veteran Owned, 8(a), HUBZone)

Do you have a cost accounting system deemed adequate by a cognizant audit agency? (e.g., Defense Contract Audit Agency (DCAA))

□ YES

□ NO

Do you have an approved Purchasing System? □ YES

□ NO

One Point of Contact (POC) (Enter name, phone number, and email address)

Name:

Phone #:

Email:

Describe your company/business unit’s experience, if any, with delivering and maintaining a procurement and sourcing lifecycle solution (as highlighted by the Draft requirements document), which enables cost savings for all types of product and software acquisitions

International Organization for Standardization (ISO) 9001 Quality Management System (QMS)

□YES

□NO

ISO 20000-1 Information technology Service Management System (ITSMS)

□ YES

□ NO

ISO/International Electrotechnical Commission (IEC) 27001 Information Security Management Systems (ISMS)

□ YES

□ NO

Other, please specify □ YES

□ NO

How does your company integrate commercially available offerings to meet the needs of the stated mission requirements?

Describe your experience managing Sub Contractors.

Template Version 08/26/2024 6

Exhibit 2: Prior and Current Corporate Experience

Please respond to the following inquiries (Note: If your company is divided into separate business units, responses shall be based upon the Corporate Experience of the business unit responding to the RFI):

Please complete the following table for prior Corporate Experiences performed in the last five years in which the Contractor (serving as prime contractor) provided or currently provides service similar in size, complexity, and scope (supporting multiple federal agencies) to the stated requirements and technical environment as listed in Sections III and IV. Use individual Task Order values for the table below, not the overall Indefinite Delivery Indefinite Quantity (IDIQ) or Blanket Purchase Agreement (BPA) ceiling value the task order may have been awarded under.

Question Answer

Contract Vehicle/Contract Number

Contract/Project Name

Value at Award

Value at Completion/Current Value

Contract Type: check the type that represents the largest ($) for this contract

□Time-and-Materials (T&M)/Labor-Hour (LH) □Firm-Fixed-Price (FFP) □Cost-Plus-Incentive-Fee (CPIF) □Cost-Plus-Award-Fee (CPAF)

Client Department or Agency

Project Description

Client POC, Name, E-mail, Phone

Percentage of Services Sub-contracted

Number of Users

Average Monthly Service Contact Volume

Amount of Tools/Other Direct Costs (ODCs) Procured for Life of Task Order

Other Comments (limit 150 characters)

Template Version 08/26/2024 7

Exhibit 3: Corporate Capabilities and Approaches Acquisition-Based

1. Discounts: Historically, the CDM Program has received on average 70-80% discounts off of the Multiple Award Schedule (MAS) while minimizing fees and pass-through costs of integrators and Value-added Resellers (VARs). The Government intends to leverage and expand on these historical discounts and increased optimal pricing and terms.

1.1. How would you structure discounts, and what is your methodology for assisting the Government in achieving and exceeding the historical discounts achieved to date?

1.2. What mechanisms or methodologies do you recommend putting in place through this contract to maintain this success?

1.3. How would you transparently validate these savings for every purchase?

1.4. How do you recommend the government should hold the Contractor accountable for this benchmark on a continued basis?

1.5. What specific Fixed-Price (FP) business model would you recommend to guarantee and demonstrate superior pricing compared to pricing benchmarks on SEWP VI, OneGov, and MAS or otherwise on a transactional basis?

2. Contract Structure: In support of Executive Order 14402 (issued 30 April 2026) what overall Fixed-Price contract structure would create the most effective competition and value?

2.1. What structures would be less desirable or ineffective?

3. Contractor Pricing Structure: How should the Government structure the procurement and pricing of software licenses separately from the value-added services provided by industry partners (e.g., value-added resellers, systems integrators, or other intermediaries)? Please describe:

3.1. The specific value-added services provided throughout the software acquisition lifecycle;

3.2. How those services can be objectively defined, measured, and priced independently of software license costs;

3.3. Recommended pricing models for these services (e.g., fixed-price, labor-based, transaction-based, subscription, performance-based, or other approaches); and

3.4. Any contractual or business considerations the Government should evaluate to ensure transparency, competition, and best value while preserving the benefits provided by industry partners.

4. Terms and Conditions: What are some recommendations the Government should consider on meeting the objective to incorporate flexible (T&Cs)? Flexible T&Cs include, but are not limited to, mechanisms to eliminate shelfware, ability to pool

Template Version 08/26/2024 8 licensing on behalf of CISA’s customers, transferability of licenses, co-terming of licenses, etc.

5. Vendor Configuration: What vendor configuration (e.g., number of vendors, functional allocation of work, use of multiple awards, or other approaches) would best enable the Government to maintain competition for technical capabilities and most advantageous pricing over the life of the requirement? Please explain the rationale for your recommended approach, including any benefits, risks, and implementation considerations.

6. Acquisition Approach: Given the scope of the requirement (ie, sourcing and procurement of SW (software) tools, catalog and category management, etc), is there a recommended vehicle or acquisition structure that the Government should consider that would effectively support the need to maximize success?

7. KPIs: What specific, measurable key performance indicators (KPIs) would you recommend to best measure success across each of the three following scope areas:

7.1. Price savings;

7.2. License platform/tool (e.g, availability, data accuracy, data quality, etc); and

7.3. Quality of strategic advisory services?

Technical-Based

8. Contractor Role: In a model where the Government may purchase software licenses through multiple acquisition channels, what role should an enterprise tools contractor perform to support strategic software purchasing and enterprise optimization? Please describe:

8.1. The technical, analytical, and advisory capabilities the Contractor should provide;

8.2. The data, system(s) access, reporting, or governance necessary for the Contractor to identify duplicative purchases, analyze agency requirements, and recommend enterprise licensing strategies;

8.3. The recommended process(es) the Contractor should use for maintaining visibility into Government software purchases regardless of the acquisition vehicle used;

and

8.4. Any challenges, risks, or best practices the Government should consider when implementing such a model.

9. Software Management Platform: Please provide an overview of existing platform/tools/process or a high-level summary of an approach to meeting the license and procurement management services statement of objectives. Keep in mind the volume and scale of the annual transactions, enterprise agreements, and solution hosting requirements. Screenshots, process maps, and visuals are highly recommended.

Template Version 08/26/2024 9

9.1. How will you ensure the platform provides the Government with auditable, unbiased data on pricing and licensing, and what specific firewalls or processes would you implement to prevent any conflict of interest if you are also the primary product reseller?

9.2. Beyond simple tracking, describe your proposed methodology for proactively managing complex software license agreements (e.g., enterprise agreements, true-ups, co-terming renewals). How would your platform automate alerts and provide optimization scenarios to prevent over-spending or compliance failures?

Acquisition and Technical

10. Strategic Guidance Objectivity: The strategic planning portion requires providing data-driven advice that may lead to purchasing fewer products or shifting to lower-cost alternatives. How will you ensure this strategic advice is completely objective and not influenced by your revenue from product sales? Suggest a performance metric for the strategic planning portion that is independent of product volume.

11. APL Product Sourcing: The Government anticipates large scale procurements to be executed from the SW Original Equipment Manufacturer (OEMs) (see attached CDM APL for a listing of all products anticipated to be procured under this requirement).

Specifically, the government intends on renewing and procuring SW on the APL and future CPL. Can your company attest to sourcing products from these OEMs, and what would be the procurement approach for these transactions (ie, direct relationships, sourcing through one or more VARs, etc.)?

12. Supply Chain Management: Describe your supply chain and logistics strategy for procuring any of over 87,000 APL items on an as-needed basis. What is your plan for managing supply chain disruptions or fulfilling urgent, non-standard requests while still meeting the FP and superior-pricing requirements?

13. Single vs. Multiple Vendor Solution: The government is interested in understanding if including multiple contractors can better serve all or portions of the requirement or if a single vendor (with subcontractors) can better achieve optimal outcomes.This requirement was previously identified as part of a larger approach containing a comprehensive set of contracts as follow-ons to DEFEND. As this is being contemplated as a potential stand-alone contract, does industry feel that a single vendor can meet all of these requirements? If not, and partnering is needed to achieve the total solution, how do you recommend the work should be delineated based on the draft requirements document?

14. What additional information should the government seek from industry to confirm that all (T&Cs) can be met in a commercial environment?

Template Version 08/26/2024 10

**Additionally, the Government welcomes respondents to identify any questions, assumptions, concerns, or recommendations related to this requirement that were not specifically addressed in this RFI. Respondents are encouraged to provide insight into areas where additional clarification or market research may be beneficial. This information may be used to further inform the Government's acquisition strategy and requirement definition. The Government may also use this feedback to develop discussion topics for a potential Industry Day, one-on-one Market Analysis Discussions (MAD) sessions, or other future market research activities. Submission of questions or assumptions does not guarantee that they will be addressed publicly or that a follow-on engagement will occur.

9. ATTACHMENTS

Attachment Document Title Date Number of Pages

01 Requirements Document (Updated via Amendment 01 )

18 Aug 2026 21

Template Version 08/26/2024 11

9.ATTACHMENTS