Security Operations Support Services
Closed Pre-Solicitation Posted
- Solicitation number
- 20146850
- Agency
- Customs and Border Protection Department of Homeland Security
- Responses due
- Set-aside
- No set-aside
Opportunity facts
- NAICS code
- 541519 Other Computer Related Services
- Place of performance
- Washington, District of Columbia 20006, United States
- Points of contact
-
- John Marschall john.d.marschall@cbp.dhs.gov (202) 344-1116
- Dawn Ford dawn.m.ford@cbp.dhs.gov +12023252
Notice details come from SAM.gov. Updated .
About this opportunity
U.S. Customs and Border Protection (CBP) is seeking a contractor to provide comprehensive Security Operations Support Services for its cybersecurity infrastructure. The solicitation focuses on delivering advanced cybersecurity capabilities across 16 distinct task areas, including Program Management, Cyber Defense Forensics, Attack Sensing & Warning, Incident Response, Threat Intelligence, Risk Management, and Security Engineering. Key contract requirements include providing 24x7x365 security monitoring, supporting Zero Trust Architecture implementation, and maintaining robust incident response capabilities across CBP's information systems. The contractor must demonstrate expertise in cloud-based security technologies, big data analysis, and proficiency with platforms like SIEM, SOAR, and EDR. Significant dates include an RFI response deadline of April 10, 2025, with questions to be submitted by April 3, 2025, and all responses to be emailed to John Marschall at the specified government email address.
The pre-solicitation notice indicates no specific small business set-aside, with the current contract held by Leidos, Inc. The anticipated total contract value is approximately $250 million, covering a performance period from September 24, 2025 to June 23, 2030, which includes a six-month base period and four 12-month option periods. The contract will support approximately 150 ATO-authorized systems and currently requires 75-125 full-time employees, primarily located in Ashburn, VA. Contractor personnel must possess extensive cybersecurity experience, with many positions requiring specific professional certifications like CISSP and CISM, and some roles necessitating Top Secret/Sensitive Compartmented Information security clearance. The cloud infrastructure will involve multiple platforms including AWS, Google, and Azure, with integration of tools such as CrowdStrike, Splunk, and Swimlane to support comprehensive cybersecurity operations.
Notice text
The scope of this task order includes continuing the Security Operations Support Services work of the incumbent contractor in accordance with the Government’s and contractor’s processes, procedures, and schedule to successfully perform the following tasks:
- Program Management / Project Management;
- Cyber Defense Forensics (CDF) Support;
- Attack Sensing & Warning (AS&W) Support;
- Cyber Incident Response Team (CIRT) Support;
- Cyber Threat Intelligence (CTI) Support;
- Cyber Risk Management (CRM) Support;
- Security Modernization (SecMod) Support;
- Vulnerability Assessment (VA) Support;
- Security Engineering and Sustainment (SES) Support;
- Enterprise Logging Solution (ELS) Support;
- Development Security Operations (DevSecOps) Support (Optional);
- Information System Security Officer (ISSO) Support;
- Cyber Threat Hunting (CTH) Support;
- Operations Enhancement (OE) Support;
- Office of Professional Responsibility Cyber Investigations (CI) Support; and
- Security Technology & Policy (STP) Support
Attachments
| File | Type | Posted |
|---|---|---|
| CBP SOC RFI QA responses V7_040825.pdf | ||
| RFI_Draft PWS SOC 040125 v2.pdf | ||
| RFI Instructions for Security Operations Support Services .pdf | ||
| CBP CSD SOC Support Services RFI 032025.pdf | ||
| SOC PWS Draft Rev1_022525.pdf |
On GovTribe
Work this opportunity on GovTribe
- Track it in your pipeline
- Find teaming partners
- Similar opportunities
- Ask GovTribe AI about this opportunity