CISA Indefinite Delivery Indefinite Quantity Contract

The Cybersecurity and Infrastructure Security Agency (CISA), through the General Services Administration Federal Acquisition Service Assisted Acquisition Services Region 8, is seeking an Indefinite Delivery Indefinite Quantity (IDIQ) contract for cybersecurity services and solutions. The contract will cover five primary service areas: Cyber/IT Project Management Support, Requirements Management, Capability Implementation, Operations/Sustainment/Ancillary Support, and Solution Development, with an additional product area for cybersecurity tools. Initial task orders are expected to include Continuous Diagnostics and Mitigation (CDM) program requirements, strategic cybersecurity acquisition support, and implementation services for identity and access management, endpoint detection and response, mobile, cloud, and Internet of Things (IoT) technologies. The RFI seeks industry input on the proposed acquisition structure, with responses due by 11:00 AM ET on March 7, 2025. Evaluation will focus on corporate capabilities, prior experience, and potential approaches to meeting CISA's comprehensive cybersecurity needs.

The procurement is not set aside for any specific business category, though small businesses are anticipated to have direct participation opportunities in Solution Development and product areas. The estimated contract value is substantial, ranging from $18-20 billion over a 10-year period, consisting of a 5-year base contract with a 5-year option. The primary NAICS code for this opportunity is 541512 (Computer Systems Design Services), and the contract will support CISA's Capacity Building division with a focus on enhancing cybersecurity posture across Federal Civilian Executive Branch agencies. The contract will include a comprehensive cyber training program capable of supporting up to 500 students annually through various training formats, including micro-courses and intensive pathway programs. The Cybersecurity Virtual Learning Environment (CVLE) will be a key component, designed to support up to 150 concurrent students across multiple target infrastructures and delivering training from entry-level to advanced cybersecurity topics.