Notice of Intent to Solicit and Award a Sole-Source Modification for the Vulnerability Disclosure Policy (VDP) Platform
Closed Special Notice Posted
- Solicitation number
- 47QFRA20C0012
- Agency
-
Federal Acquisition Service
General Services Administration
- Responses due
- Set-aside
- No set-aside
Opportunity facts
- NAICS code
- 541519 Other Computer Related Services
- Place of performance
- McLean, Virginia 22102, United States
- Points of contact
Notice details come from SAM.gov. Updated .
About this opportunity
The General Services Administration's Federal Acquisition Service has published a Special Notice regarding a sole-source modification for the Vulnerability Disclosure Policy (VDP) Platform. The notice announces GSA's intention to modify an existing contract with Endyna, Inc., a contractor based in McLean, Virginia. The modification will extend critical cybersecurity services to the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) and other Federal Cybersecurity Executive Branch agencies. Endyna currently operates and maintains the VDP platform, which enables federal agencies to receive, track, and manage vulnerability submissions from security researchers. The notice was posted on January 12, 2026, and interested parties may respond until January 26, 2026. While GSA intends to award this modification as a sole-source contract, the agency retains discretion to pursue competitive procurement instead.
The primary objective of this modification is to provide continuity of critical VDP services while GSA develops a competitive procurement strategy for future program requirements. Endyna's responsibilities include configuring and operating the platform, maintaining its Authority to Operate certification, providing vulnerability triage services, and facilitating a bug bounty incentive payment program for participating federal agencies. Although this notice is not a competitive solicitation, interested firms believing they can meet the requirements are invited to submit responses demonstrating their ability to provide immediate, uninterrupted service without compromising quality, accuracy, or reliability. GSA will evaluate all responses received by the January 26, 2026 deadline and consider qualified alternatives. The work falls under the NAICS category "Other Computer Related Services" and the PSC category for IT and Telecom security and compliance support services. This sole-source modification will allow adequate time for GSA to implement a new competitive procurement strategy while maintaining uninterrupted security services for federal agencies.
Notice text
The U.S. General Services Administration, Federal Acquisition Service, hereby publicises its intention to modify an existing open market contract with Endyna, Inc., located at 1345 Lancia Drive, McLean VA, 22102. The anticipated modification will provide the Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and partnering Federal Cybersecurity Executive Branch (FCEB) agencies continued access to a secure platform to facilitate the submission, tracking, and reporting of vulnerabilities discovered in information systems. The contractor, EnDyna, configures, operates, and administers the platform; ensures it maintains an Authority to Operate (ATO); provides triage services to ensure the validity, proper routing, and tracking of vulnerability submissions; and facilities a bug bounty incentive payment program for FCEB agencies to reward valid submissions. EnDyna is the only firm currently able to continue to provide the services and maintain the ATO without a break in these critical services. The anticipated sole-source modification will allow the Government adequate time to competitively procure future VDP program requirements and implement a new procurement strategy.
Be advised that the aforementioned information is anticipatory in nature and is not binding. A determination by the Government not to compete based upon responses to this notice is solely within the discretion of the Government. This notice is not a request for competitive proposals; however, any firm believing that it can fulfill the requirement of providing these services may be considered on the following competitive procurement. Interested parties may identify their interest and capabilities in response to this notice, and must clearly show the firm's ability to be immediately responsive without compromising the quality, accuracy, and reliability of services provided. The Government will consider all responses.
On GovTribe
Work this opportunity
- Track it in your pipeline
- Find teaming partners
- Similar opportunities
- Ask GovTribe AI about this opportunity