Justification and Approval - Vulnerability Disclosure Policy Platform (VDP) Platform
Awarded Limited / Sole Source Justification Posted
- Solicitation number
- 47QFRA20Q0048
- Agency
-
Federal Acquisition Service
General Services Administration
- Set-aside
- No set-aside
Opportunity facts
- Contract number
- 47QFRA20C0012 Federal contract award
- Awardee
- Endyna, Inc.
- NAICS code
- 541519 Other Computer Related Services
- Place of performance
- Arlington, Virginia 22203, United States
Notice details come from SAM.gov. Updated .
About this opportunity
GSA Federal Acquisition Service is justifying a noncompetitive sole-source modification to contract 47QFRA20C0012 with EnDyna, Inc. to continue providing Vulnerability Disclosure Policy platform services to CISA and participating Federal Civilian Executive Branch agencies under a sole-source basis.
The modification extends the current contract, expiring May 2, 2026, by no more than three years. The justification rests on four factors: the platform's Authority to Operate was achieved through extensive accreditation and authorization processes that would be costly and time-consuming to replicate; service lapses would create unacceptable national cybersecurity risks; EnDyna possesses unique expertise and relationships integral to CISA's vulnerability disclosure program; and a new vendor would require up to 36 months to achieve ATO and fully integrate into the cybersecurity ecosystem. A presolicitation notice posted on SAM.gov on January 12, 2026 for 14 calendar days received no responses or capability statements from alternative sources.
The platform is a secure, commercially available Software-as-a-Service solution that enables centralized submission, validation, routing, tracking, and reporting of vulnerabilities in internet-accessible Federal systems. Contractor responsibilities include platform configuration, operation, security and administration; ATO maintenance; vulnerability triage and validation; and support for agency-managed bug bounty programs. The Government intends to conduct a competitive acquisition following a planned functional area restructuring, with market research and acquisition planning anticipated to take approximately 24 months, followed by 12 months for a new vendor's ATO achievement. Place of performance is not specified in the source material.
Notice text
The Cybersecurity and Infrastructure Security Agency (CISA) partners with Federal agencies, industry, and other stakeholders to strengthen the security and resilience of the Nation's critical infrastructure and Federal information systems. As part of this mission, CISA supports ongoing efforts to reduce cybersecurity risk by identifying, assessing, and facilitating the remediation of vulnerabilities affecting Federal Civilian Executive Branch (FCEB) systems. These efforts support the implementation of Binding Operational Directive (BOD) 20-01, which requires FCEB agencies to establish and maintain Vulnerability Disclosure Policies (VDPs) to receive and address vulnerability reports submitted by external security researchers.
This requirement provides CISA and participating FCEB agencies with continued access to a secure, commercially available Software-as-a-Service (SaaS) Vulnerability Disclosure Policy (VDP) platform that enables the centralized submission, validation, routing, tracking, and reporting of cybersecurity vulnerabilities identified in internet-accessible Federal systems. The platform supports secure collaboration between security researchers and participating agencies, provides configurable reporting and metrics, role-based user management, application programming interface (API) integration capabilities, and optional functionality to support agency-managed bug bounty programs.
The contractor shall configure, operate, secure, and administer the platform; maintain the platform's Authority to Operate (ATO) and support applicable Federal cybersecurity authorization requirements; provide technical support and user onboarding; perform vulnerability triage, validation, routing, and tracking services; generate operational reporting; and support agencies that elect to implement bug bounty programs. The platform is designed to scale as agency participation changes while ensuring the confidentiality, integrity, and availability of vulnerability information and supporting the Government's continued ability to receive and manage coordinated vulnerability disclosures.
This modification extends the period of performance for the existing contract to ensure continuity of the enterprise Vulnerability Disclosure Policy (VDP) platform and associated support services. The modification continues uninterrupted support for participating Federal Civilian Executive Branch agencies and maintains the Government's capability to receive, triage, track, and manage vulnerability disclosures during the transition period.
Awarded contract 47QFRA20C0012 to unknown vendor for unknown amount on 2020-09-25.
Files
| File | Type | Posted |
|---|---|---|
| 47QFRA20C0012_P00048_VDP_Justification and Approval__20260318_Redacted.pdf |
On GovTribe
Work this opportunity
- Track it in your pipeline
- Find teaming partners
- Similar opportunities
- Ask GovTribe AI about this opportunity