Vulnerability Disclosure Program Enterprise Management System (VDP EMS)
Closed Pre-Solicitation Posted
- Solicitation number
- FA701425X000X
- Agency
-
District Washington
Headquarters Air Force, Department of Defense
- Responses due
- Set-aside
- No set-aside
Opportunity facts
- NAICS code
- 541519 Other Computer Related Services
- Place of performance
- Linthicum Heights, Maryland, United States
- Points of contact
Notice details come from SAM.gov. Updated .
About this opportunity
The Department of Defense Cyber Crime Center (DC3) is conducting market research for an enterprise management system to support its Vulnerability Disclosure Program (VDP) and Defense Industrial Base (DIB) VDP through a pre-solicitation notice. The system must provide enterprise-grade VDP platform licenses for two instances, vulnerability submission and management workflows, API integration with DC3's existing Atlassian Jira-based Vulnerability Report Management Network systems, mediation support for researcher inquiries, vulnerability triage tools including CVSS scoring, advanced analytics and custom reporting capabilities, and dedicated customer support teams. DC3 has specifically indicated they are seeking proprietary, crowdsourced VDP platform licenses from vendors such as HackerOne, BugCrowd, or SynAck, and will not consider integrators partnering with platform providers as this would impact mission success. The government has provided a draft Performance Work Statement for vendor review and feedback, with responses originally due July 10, 2025, but subsequently extended to July 18, 2025. The anticipated NAICS code is 541519 with a $34 million size standard, and interested vendors must submit responses electronically to the designated contracting officers.
This procurement does not utilize any set-aside designations and no current incumbents or contractors are identified in the documentation. The contract structure includes a base year running from February 1, 2026 to January 31, 2027, with four potential option years that could extend the contract through January 31, 2031, representing a possible five-year total contract duration. A notable requirement includes the vendor's responsibility for producing and distributing 250 annual crowdsourced vulnerability recognition items ("swag" such as stickers, coins, and t-shirts) to researchers, including logistics coordination for items like "hacker of the month" or "hacker of the year" awards. The system will be located in Linthicum Heights, Maryland, and must support comprehensive vulnerability report data exchange in JSON format. While no specific contract value is disclosed in the pre-solicitation materials, the NAICS size standard of $34 million suggests this could be a substantial procurement opportunity for qualified vendors in the cybersecurity platform space.
Notice text
3 versions
Update #3 · Latest ·
During the RFI phase of this requirement, two questions were received. The questions and answers are provided below. Please review the Q&A and keep them in mind when the official solicitation is published. This RFI has NOT been extended further.
Question 1: Is the Government specifically seeking vendors who can provide a proprietary, crowdsourced VDP platform license (e.g., HackerOne, Bugcrowd), or will you also consider integrators who can deliver compliance, security automation, and Microsoft Sentinel-based triage/reporting workflows in partnership with a platform provider?
DC3 is directly seeking a proprietary, crowdsourced VDP platform license; Hackerone, BugCrowd, SynAck. Anything outside of this would impact mission success.
Question 2: Can you clarify the “250 crowdsourced vulnerability - bug tag and annual mailings”? Understand the concept here is that we would be responsible for the logistics and shipping of any DC3 provided items used to recognize researchers.
This would be in regard to delivering “swag” (inexpensive tangible goods like stickers, coins, t-shirts) to the researcher community. Specifically, DC3 disseminates “swag” for things such as “hacker of the month” or “hacker of the year.” The vendor will be responsible for distributing the “swag” on DC3’s behalf (verifying mailing addresses, packaging swag, paying for the shipping, getting the swag to the shipper, etc).
End Questions and Answers
---------------------------------------------------------------------
The Department of Defense Cyber Crime Center (DC3) is conducting market research for an enterprise management system to support its Vulnerability Disclosure Program (VDP) and Defense Industrial Base (DIB) VDP. The system shall facilitate collaboration, compliance, and management of the VDPs. Key requirements include:
- Enterprise-grade VDP platform license/subscription for two instances (DoD VDP and DIB VDP).
- Vulnerability submission and management workflows.
- Integration, via API, with DC3's Atlassian Jira-based Vulnerability Report Management Network (VRMN) systems.
- Mediation support for researcher inquiries.
- Tools and processes for effective vulnerability triage and resolution (e.g., CVSS scoring).
- Advanced analytics and custom reporting capabilities.
- Dedicated account team with customer support and customer success functions.
Interested vendors are encouraged to review the attached draft Performance Work Statement (PWS) for detailed requirements and provide feedback on the PWS.
7/14/2025 - Amended solicitation to extend response due date to 18 Jul 2025.
Update #2 ·
The Department of Defense Cyber Crime Center (DC3) is conducting market research for an enterprise management system to support its Vulnerability Disclosure Program (VDP) and Defense Industrial Base (DIB) VDP. The system shall facilitate collaboration, compliance, and management of the VDPs. Key requirements include:
- Enterprise-grade VDP platform license/subscription for two instances (DoD VDP and DIB VDP).
- Vulnerability submission and management workflows.
- Integration, via API, with DC3's Atlassian Jira-based Vulnerability Report Management Network (VRMN) systems.
- Mediation support for researcher inquiries.
- Tools and processes for effective vulnerability triage and resolution (e.g., CVSS scoring).
- Advanced analytics and custom reporting capabilities.
- Dedicated account team with customer support and customer success functions.
Interested vendors are encouraged to review the attached draft Performance Work Statement (PWS) for detailed requirements and provide feedback on the PWS.
7/14/2025 - Amended solicitation to extend response due date to 18 Jul 2025.
Update #1 ·
The Department of Defense Cyber Crime Center (DC3) is conducting market research for an enterprise management system to support its Vulnerability Disclosure Program (VDP) and Defense Industrial Base (DIB) VDP. The system shall facilitate collaboration, compliance, and management of the VDPs. Key requirements include:
- Enterprise-grade VDP platform license/subscription for two instances (DoD VDP and DIB VDP).
- Vulnerability submission and management workflows.
- Integration, via API, with DC3's Atlassian Jira-based Vulnerability Report Management Network (VRMN) systems.
- Mediation support for researcher inquiries.
- Tools and processes for effective vulnerability triage and resolution (e.g., CVSS scoring).
- Advanced analytics and custom reporting capabilities.
- Dedicated account team with customer support and customer success functions.
Interested vendors are encouraged to review the attached draft Performance Work Statement (PWS) for detailed requirements and provide feedback on the PWS.
Files
| File | Type | Posted |
|---|---|---|
| VDP Follow On RFI.pdf | ||
| PWS_VDP Enterprise Management System_v2_27 Jun 25.pdf |
Similar open opportunities
| Opportunity | Agency | Set-aside | Responses due |
|---|---|---|---|
| Dcsa innovation gateway | Defense Counterintelligence and Security Agency | No set-aside | |
| DISA Cybersecurity Service Provider (CSSP) / J34 External Vulnerability Scans (EVS) and Web Vulnerability Scans (WVS) | Defense Information Systems Agency | No set-aside |
On GovTribe
Work this opportunity
- Track it in your pipeline
- Find teaming partners
- Similar opportunities
- Ask GovTribe AI about this opportunity