Vulnerability Disclosure Program (VDP) Enterprise Management System (EMS)

The Department of the Air Force, on behalf of the Department of Defense Cyber Crime Center (DC3), is soliciting a commercial enterprise management system (VDP EMS) to support its Vulnerability Disclosure Programs for both the Department of Defense and the Defense Industrial Base. The system must provide vulnerability submission workflows, researcher engagement tools, advanced reporting and analytics capabilities, community engagement features, and seamless integration with existing DC3 IT systems, particularly Jira. Key requirements include automated workflows with 24-hour submission acknowledgement and 95% triage completion within 5 business days, maintaining 95-100% system uptime, supporting up to 250 crowdsourced vulnerability researchers annually, and providing a dedicated account team with remote support capabilities. Evaluation will emphasize technical capability and risk assessment significantly more than cost, using color-coded adjectival ratings across critical factors including collaboration, compliance, management, integration capabilities, and reporting. Prospective offerors must submit questions by January 2, 2026 at 1600 EST, and proposals are due by January 9, 2026 at 1600 EST, with the most recent amendments issued on January 12, 2026.

This procurement is not designated as a set-aside and has no identified incumbent contractor. The contract covers annual licenses and subscriptions for two VDP EMS instances with a base period of 12 months (February 1, 2026 through January 31, 2027) and four potential additional 12-month option years, extending through January 2031, with a possible six-month extension available. While specific award values are not disclosed in this solicitation, the CLIN worksheet indicates the government will evaluate pricing proposals on a firm fixed-price basis with pricing to be determined by the offeror. The place of performance is identified as Linthicum Heights, Maryland 21090. Importantly, the government notes that funds are not presently available for this contract, and the government's obligation is contingent upon the availability of appropriated funds, with no legal liability arising until the Contracting Officer provides written confirmation of fund availability.