CISA Issues Sources Sought Notice Floating $600M a Year, $6B Over Contract Life
The Cybersecurity and Infrastructure Security Agency (CISA) has initiated a request for information that signals its intent to explore the possibility of outsourcing its cyber software procurement. The announcement, made on August 12, indicates that CISA is looking to partner with contractors who can assume the role of centralized federal cybersecurity purchasing agents. This initiative projects a robust plan involving over 500 procurements annually, which could amount to a staggering $6 billion over a decade starting in September 2027.
This move comes at a critical time for CISA, which currently operates with a workforce that is approximately one-third smaller than it was in early 2025. As the agency seeks to bolster its capabilities and efficiency in purchasing cyber software, it has outlined its requirements through a notice posted via the General Services Administration (GSA).
The essence of CISA’s request emphasizes the need for a contractor to deliver a range of services that includes transactional procurement support, enterprise license management, and direct materials purchasing for agencies within the federal civilian executive branch. The agency is particularly interested in strategic buying advisory services, software asset management, and procurement analytics, which will help ensure that its purchasing process is both effective and efficient.
Additionally, the notice specifies the need for various analyses such as historical spend analysis and pricing analysis. CISA aims to develop a well-rounded procurement strategy that not only identifies suitable products but also maximizes cost savings. The agency believes that this strategic partnership could enhance its buying power and lead to improved pricing and more flexible licensing terms, ultimately streamlining the procurement process for cybersecurity tools.
One of the primary objectives of this initiative is to ensure that necessary tools reach federal agencies more quickly. CISA has also expressed the desire for enhanced tracking capabilities that would allow it to monitor its purchases closely, thus fostering greater transparency in expenditures. The effective management of software assets and vendor relationships is at the core of this mission.
This outsourcing initiative will underpin the agency’s Continuous Diagnostics and Mitigation (CDM) program. The CDM program provides essential tools and integration services designed to improve cybersecurity governance among civilian agencies. Furthermore, it manages a product catalog critical to the federal enterprise cyber governance framework. However, it is worth noting that this catalog is currently closed to new submissions, as indicated on the GSA’s CDM tools page.
The fiscal landscape surrounding CISA also reflects challenges, with the administration’s budget request for fiscal year 2027 proposing approximately $707 million in cuts to CISA programs. This would translate to a net reduction of around $360 million after accounting for transfers, subsequently reducing the number of positions at the agency to 2,865, according to the Department of Homeland Security’s budget justification.
The sources sought notice, however, does not obligate the government to award a contract at this stage. CISA retains the flexibility to either restructure its requirements based on the responses received or integrate them into existing procurement vehicles. Interested parties have until 5 p.m. Eastern Time on September 1 to submit their responses, marking an important deadline for potential contractors eager to engage with CISA on this initiative.
In summary, CISA’s search for a contractor to handle its cyber software procurement marks a significant step toward modernizing its purchasing processes amid workforce reductions and budget constraints. The agency’s focus on strategic planning and procurement analytics reflects a commitment to agile and effective cybersecurity capabilities, ensuring that federal agencies can respond adeptly in an increasingly challenging cyber landscape. The evolution of such procurement structures will likely play a crucial role in the overarching narrative of federal cybersecurity efforts in the years to come.