Hack DHS: Crowdsourced Vulnerability Assessment Services (CVAS)

The Department of Homeland Security seeks to establish an ordering vehicle for crowdsourced vulnerability assessment services through its Hack DHS program. Under the contract, vendors would conduct pre-assessment research and recruitment of security researchers, live vulnerability discovery assessments against public-facing and internal DHS systems, vulnerability validation and triage, coordination of remediation efforts, and post-assessment reporting. Vendors must provide an existing security researcher community and platform to support the full scope of work, including workflow management APIs and full packet capture monitoring of researchers. Responses to the RFI are due by March 17th and are limited to two pages using Times New Roman 12-point font.

No set-aside designation applies. Relevant NAICS codes include 541511 and 541512. Potential incumbent vendors currently provide similar bug bounty services to DHS. The initial base period of performance under the contract would be one year, with four optional one-year extensions, and work will take place primarily at contractor facilities with occasional visits to DHS sites in the Washington D.C. area.