DRAFT Solicitation for Hack DHS: Crowdsourced Vulnerability Assessment Services (CVAS)

The Department of Homeland Security Office of Procurement Operations seeks to award multiple indefinite delivery, indefinite quantity contracts through full and open competition to conduct crowdsourced vulnerability assessment services. Contractors will utilize an existing community of over 1,000 security researchers to test public and private DHS assets for vulnerabilities. Proposals will be evaluated on technical acceptability of the offeror's vulnerability discovery and disclosure platform, as well as past performance in conducting similar assessments. Questions are due by May 3, 2022, with responses to the final solicitation due on the same date.

There are no set-aside designations. The primary NAICS code is 541511 and PSC code is D302. The minimum contract value is $2,500 and maximum total value across all awards is $40 million over a one-year base period and four optional one-year extensions. Up to four contractors may be selected to conduct four-month vulnerability assessment programs involving six systems, with bounty payouts determined based on severity of issues found through the contractor's established community of over 1,000 security researchers domestically and internationally.