47QFRA20C0012_P00048_VDP_Justification and Approval__20260318_Redacted.pdf

CUI//SP-SSEL

JUSTIFICATION AND APPROVAL

JUSTIFICATION FOR OTHER THAN

FULL AND OPEN COMPETITION

Contract # 47QFRA20C0012

Vulnerability Disclosure Policy (VDP) Platform in support of:

The Cybersecurity and Infrastructure Security Agency

United States (U.S.) General Services Administration (GSA) Federal Acquisition Service (FAS)

Assisted Acquisition Services (AAS) Civilian

Interagency Agreement Number 47QFRA18S0011

Controlled by AAS Contracting Officer: Lila Schmideke: lila.schmideke@gsa.gov

The General Services Administration (GSA) Assisted Acquisition Services (AAS) makes this Justification and Approval (J&A) for Other Than Full and Open Competition orders pursuant to Federal Acquisition Regulation (FAR) 6.104 (GSA Class Deviation Revolutionary FAR Overhaul

(RFO)-2025-06).

1. Identification of Agency and Contracting Activity:

Agency:

GSA acting in support of the Cybersecurity and Infrastructure Security Agency (CISA)

Contracting Activity:

GSA Assisted Acquisition Services (AAS) Contracting Office (QFCCD) 1800 F Street, NW Washington, D.C. 20405

2. Nature and/or Description of Action Being Approved:

This is an individual Justification and Approval (J&A) to award a noncompetitive modification to an existing open market contract # 47QFRA20C0012 with EnDyna, Inc for vulnerability disclosure policy (VDP) platform services. CISA requires continued use and maintenance of a cybersecurity vulnerability disclosure platform, as well as vulnerability triage reporting and a vulnerability identification reward program (bug bounty). The modification will use a firm-fixed-price contract type and will extend the current five year contract that expires on 2 May 2026 by no more than three years, increasing the awarded total contract value of $ by an estimated $

The CISA Continuous Diagnostic and Mitigation (CDM) Program enhances the cybersecurity posture of federal civilian networks through integrated tools, services, and dashboards that provide visibility into cyber threats and enable rapid response. As a critical component of comprehensive vulnerability management within the CDM framework, the vulnerability disclosure policy (VDP) platform contract extends this protective capability by establishing a structured channel for external security researchers and third parties to report potential vulnerabilities in internet-accessible federal systems. This platform provides Federal Civilian Executive Branch (FCEB) agencies with coordinated vulnerability disclosure services and professional triage capabilities that validate and prioritize vulnerability reports, ensuring that external threat intelligence is effectively integrated into the broader CDM ecosystem for enhanced federal cybersecurity.

This sole-source modification will provide the Government sufficient time to conduct a competitive acquisition, avoid a break in service for the mission critical capabilities acquired under the VDP contract, and implement a new procurement strategy that aligns procurements by functional area. The new strategy will provide cybersecurity support to participating FCEB agencies, with the goals of synchronizing efforts, encouraging interagency collaboration, and enhancing CDM program features and benefits. Competitive procurements in support of this strategy are currently in the market research and acquisition planning phases. It is currently anticipated that the future acquisition for VDP capabilities will be incorporated into the greater CDM program functional area strategy to achieve the desired goals.

Version 02/26/2026 Page 2

3. A Description of Supplies/Services Required to Meet Agency’s Need (Including the Estimated Value):

CISA partners with industry and Government to understand and manage risk to our Nation’s critical infrastructure and to prevent or minimize disruptions to our critical information infrastructure to protect the public, the economy, Government services, and the overall security of the United States. It does this by supporting a series of continuous efforts designed to further safeguard Federal Government systems by reducing potential vulnerabilities, protecting against cyber and physical intrusions, and anticipating future threats.

The EnDyna VDP contract provides CISA and partnering FCEB agencies a secure platform to facilitate the submission, tracking, and reporting of vulnerabilities discovered in internet-accessible information systems in response to requirements in CISA’s Binding Operational Directive 20-01. The EnDyna team configures, operates, and administers the platform; ensures it achieves and maintains an Authority to Operate (ATO); provides triage services to ensure the validity, proper routing, and tracking of vulnerability submissions; and facilitates a bug bounty incentive payment program for FCEB agencies to reward valid submissions.

EnDyna’s VDP platform and bug bounty program is a commercially available Software as a Service (SaaS) solution that meets the statutory requirements for FCEB agencies to develop and publish identified vulnerabilities. CISA offers this service as agencies lack a formal and centralized mechanism that can bi-directionally share information from third parties about IT security risks and vulnerabilities. The estimated value of this modification to extend the contract for three years is $

4. An Identification of the Statutory Authority Permitting Other Than Full and Open Competition:

This sole-source modification will be awarded pursuant to the authority of 41 United States Code (U.S.C.) 3304 as implemented by FAR 6.103-1 (GSA Class Deviation RFO-2025-06), Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements.

5. A Demonstration That the Proposed Contractor’s Unique Qualifications or the Nature of the Acquisition Requires Use of the Authority Cited:

This sole-source modification is essential to maintain uninterrupted operation of a critical VDP platform and associated services while the Government diligently plans and executes a long term competitive acquisition. A lapse in these services would create unacceptable risks to national cybersecurity. Continuing the VDP contract with EnDyna is the only viable option to prevent:

1. A lapse of the software-as-a-service VDP platform ATO.

2. A critical loss of visibility into cyber vulnerabilities across government-wide internet-accessible systems, leaving them exposed to potential exploitation. Only the incumbent, EnDyna possesses the ability to coordinate, manufacture, and assess findings for agencies utilizing the bug bounty program, a program detecting high risk vulnerabilities through third-party researchers.

3. A damaging interruption to ongoing bug bounty engagements, which incentivize ethical hackers to identify and report vulnerabilities before they can be weaponized by malicious actors.

EnDyna’s VDP platform solution currently holds a Federal ATO issued by the Department of Homeland Security (DHS) Chief Information Officer (CIO). This ATO was achieved through extensive Accreditation and Authorization (A&A) processes and comprehensive system testing, representing a substantial investment of time, resources, and expertise. The existing ATO is inextricably linked to EnDyna's current platform and operations, making the current VDP and bug bounty solution essential to remain in place to ensure continuity of services. Any lapse in services would jeopardize this critical security accreditation, rendering the platform unauthorized to process necessary information and creating significant security compliance issues.

The VDP platform's continuous operation is vital because publishing vulnerabilities allows agencies to take action triaging and addressing or mitigating operational risks and threats to their environments. Ceasing services would jeopardize Federal networks, infrastructure, and information critical to national security. While the Government intends to re-compete this requirement and achieve a subsequent ATO, replicating the current ATO process with a new platform and vendor would be a costly and time-consuming undertaking, with no guarantee of achieving the same level of security assurance. Changes in contractors and resulting operational disruptions could compromise the existing security accreditation, potentially exposing government data to unauthorized access. The Government estimates that it could take up to 24 months to finalize and approve its functional approach procurement strategy, to complete market research and acquisition planning, and to execute a competitive acquisition. An additional 12 months will likely be required for a new vendor to achieve ATO on a new VDP platform and to fully integrate into the existing cybersecurity ecosystem.

EnDyna possesses unique qualifications that make it the only viable contractor capable of meeting the Government's immediate needs and is the only contractor capable of providing the level and quality of services required in the time needed to fulfill the requirements. EnDyna possesses the integral relationships with affiliates as well as the extensive accreditation to facilitate, monitor, and establish solutions that decrease threats to federal networks, infrastructure, and property. Their highly qualified and experienced workforce actively performs the required services with unique understanding of the VDP program, CISA's vulnerability policies, and the nuances of ongoing vulnerability assessment and triage efforts for FCEB agencies. Introducing a new contractor would necessitate a significant learning curve, potentially leading to errors, delays, and a degradation of service quality.

Without extended coverage from EnDyna during the contemplated three-year transition period, vulnerabilities would go undetected and unaddressed, presenting catastrophic risk to federal networks, infrastructure, and information. This would not only jeopardize the security of government systems but also undermine the effectiveness of the CDM program, which is vital for protecting national cybersecurity. Therefore, a sole-source modification to the contract with EnDyna is the only course of action to ensure the continued operation of this critical cybersecurity program and to safeguard the nation's digital infrastructure.

6. A Description of Efforts Made to Ensure That Offers Are Solicited From As Many Potential Sources As Practicable:

In accordance with FAR Section 5.101 (GSA’s FAR Class Deviation RFO-2025-05), the Contracting Officer published a notice announcing the Government’s intent to pursue a sole-source modification. This notice provided industry an opportunity to express interest and provide capabilities for the Government’s consideration. No questions, responses, or capability statements were received by the Government. EnDyna is the only practicable source.

7. A Determination by the Contracting Officer That the Anticipated Cost to the Government Will Be Fair and Reasonable:

The AAS Contracting Officer will determine if the proposed price is fair and reasonable by obtaining pricing data and performing price analysis. The expectation of reaching a fair and reasonable price was determined through market research in order to determine best value for CISA. The estimated value of this modification to extend the contract for three years is

The Contracting Officer has determined the anticipated costs to be fair and reasonable and will determine the proposed price to be fair and reasonable by using price analysis techniques in FAR 15.404-1 (RFO-2025-15), including comparing proposed prices to historical pricing from the current VDP contract, competitive published prices, and the IGCE.

8. A Description of the Market Research Conducted and the Results or a Statement of the Reason Market Research Was Not Conducted:

AAS conducted market research through discussions with technical experts at CISA and by posting a presolicitation synopsis on SAM.gov. A presolicitation notice was posted on 12 January 2026 and was open for 14 calendar days. This notice allowed industry partners to indicate their interest and provide capabilities to meet the requirements. No responses were received. Market research has confirmed that this requirement must be executed on a sole-source basis until the competitive follow-on acquisition is planned and executed.

9. Any Other Facts Supporting the Use of Other Than Full and Open Competition:

The Government intends on restructuring the VDP services into a functionally aligned contract that leverages existing infrastructure and Commercial Off The Shelf (COTS) products/services to the maximum extent. The Government conducted initial market research in April of 2024 and will expand market research in the third and fourth quarters of fiscal year 2026 to validate anticipated approaches to restructure services like VDP and other cyber capabilities. However, there is no practical alternative to this noncompetitive acquisition at this time. It would be neither cost effective nor realistic to expect another contractor to perform during the period of performance.

10. A Listing of the Sources, if Any, That Expressed, in Writing, an Interest in the Acquisition:

To date, the AAS Contracting Officer has not received any statements of interest regarding the proposed sole-source modification with the exception of the incumbent EnDyna.

11. A Statement of the Actions, if Any, the Agency May Take to Remove or Overcome Any Barriers to Competition Before Any Subsequent Acquisition for the Supplies or Services Required:

As stated above, CISA and GSA AAS are planning to acquire VDP services on a competitive basis in the future. CISA is currently undergoing transformational changes and is in the process of gaining approval for a new functionally aligned procurement strategy. This sole-source modification will maintain critical services while a new competitive acquisition is planned and executed.

12. Contracting Officer Certification that the Justification is Accurate and Complete to the Best of the Contracting Officer’s Knowledge and Belief:

I certify that this Justification is accurate and complete to the best of my knowledge and belief, and I determine on the basis of the findings above that an other than full and open competition approach is in accordance with the requirements and is in the best interest of the Government.

Lila R. Schmideke Date Contracting Officer, AAS Civilian Assisted Acquisition Services

Technical and Requirements Personnel Assertion:

I hereby certify that the supporting data which forms the basis of the justification is complete and accurate to the best of my knowledge and belief.

Joseph Sheridan Date Technical Point of Contact Cybersecurity and Infrastructure Security Agency

Concurrences:

Brandy Lane Date Lead Program Manager, AAS Civilian

Nate Mobasseri Date Program Division Director, AAS Civilian Assisted Acquisition Services s Date

Contracting Director, AAS Civilian Assisted Acquisition Services

Date

Sector Director, AAS Civilian

Final Approval:

I certify that this justification is accurate and complete to the best of my knowledge and belief, and I determine on the basis of the findings above that an other than full and open competition approach is in accordance with the requirements and is in the best interest of the Government.

Jacqueline Sullo Date Competition Advocate, AAS Civilian