The Department of Transportation, Office of the Secretary, Office of the Chief Information Officer intends to extend cybersecurity management support services under a sole-source modification to an existing Blanket Purchase Agreement order awarded to Ernst & Young LLP, effective September 15, 2026.

The extension covers five months through February 28, 2027, beyond the current BPA order expiration of September 28, 2026. The justification rests on logical follow-on rationale: Ernst & Young's existing management and subject matter team possesses established knowledge of the DOT environment and has demonstrated success in improving DOT's cybersecurity posture and Federal Information Security Management Act (FISMA) compliance. The original acquisition was conducted competitively under the Cyber Security Information & Program Services (CSIPS) Blanket Purchase Agreement issued against GSA Schedule GS-00F-290CA. The Government determined Ernst & Young's labor rates to be fair and reasonable at the GSA Schedule level.

Services consist of penetration testing and cybersecurity support for DOT infrastructure, applications, and information systems, including risk and vulnerability assessments, Red Team, Purple Team, and Blue Team operations, and security posture reporting with artificial intelligence automation. Work supports compliance with Binding Operational Directive 16-04, FISMA requirements, Office of Management and Budget directives, and Executive Order 14028. The extension is necessary to maintain continuity of critical cybersecurity services while DOT restructures its information technology workforce and pursues a new competitive recompete for this requirement. No formal market research was conducted at the modification level due to the competitive nature of the original award and the interim nature of this extension.

Penetration testing

Opportunity facts

About this opportunity

Notice text

Files

Work this opportunity