CISA Evaluates Single-Contract Approach for Cybersecurity Software Procurement

Per Nextgov, the Cybersecurity and Infrastructure Security Agency is assessing the feasibility of centralizing its acquisition of cybersecurity software and analytical tools through a unified contract structure. This approach would involve outsourcing management of these purchases to a third-party vendor, potentially streamlining current procurement processes. The agency currently obtains these resources via the Continuous Diagnostics and Mitigation program and its Capacity Building division. A sources sought notice published on August 12 seeks input on acquisition strategies for an estimated $600 million in annual cybersecurity software expenditures. The initiative aims to scale this investment to $6 billion annually over the contract’s duration. Collaboration with the General Services Administration’s Assisted Acquisition Services team is underway to develop a standardized framework for enterprise licensing, procurement platforms, and material acquisitions. This effort aligns with CISA’s shift from the CDM program’s approved product list to a newly proposed Cyber Product List and Technical Capability Catalog, which will establish baseline requirements for future procurements. The proposed scope encompasses advisory services for strategic purchasing, acquisition coordination, enterprise license management, software asset tracking, category management, vendor oversight, and procurement analytics. Additional components include market research, pricing evaluations, and technical assessments. Stakeholders are required to submit responses to the information request by 5 p.m. ET on September 1.