Cybersecurity Support Services Bridge Contract

This contract is an 8(a) sole source award for Cybersecurity Support Services targeting the Defense Security Cooperation Agency’s Information Technology environment, under the umbrella of the Department of Defense and administered by Washington Headquarters Services. The performance location is in Arlington, Virginia, with all work conducted at the DSCA facility on 201 12th Street South, Suite 107. The contract is structured as a Firm Fixed Price arrangement with a base period running from June 15 to September 14, 2026, followed by multiple one-month option periods extending through December 2026, with a one-month extension authorized under FAR 52.217-8. The pricing structure requires detailed submission of labor categories including Cybersecurity Engineers, Security Architects, IAM2 and IAT1 Cybersecurity Analysts, Incident Responders, and Mid-Level IAT2 and IAM2 positions, with total evaluated price determined by summing base and all option period costs, where the extension price is calculated as one-sixth of the final option year’s total. Offerors must be an 8(a) certified small business with a Secret Facility Clearance Level and must demonstrate compliance with all security, personnel, and reporting requirements outlined in the Performance Work Statement and supporting attachments. The contractor must provide all personnel, equipment, and non-personal services necessary to support cybersecurity governance, risk management, compliance, and operations functions under the DSCA Cybersecurity Branch. Required deliverables include weekly status reports, monthly discovery scans, and weekly compliance reporting, all subject to review and acceptance by the Contracting Officer’s Representative within five business days of submission. Performance is evaluated based on technical acceptability and price reasonableness, with awards made to the most advantageous offeror. All personnel must possess, at minimum, a SECRET clearance upon contract start and maintain it throughout performance; replacements must hold equivalent clearances. Strict physical and information security protocols govern operations, including prohibitions on personal electronic devices in government spaces, mandatory reporting of security incidents or lost identification badges, and adherence to DoD 5220.22, DoD 5205.02, DOD 5400.7-R, and DOD 5200.48 for OPSEC, CUI, and FOIA compliance. The contractor must also comply with DFARS clauses on safeguarding covered defense information, prohibition of covered telecommunications equipment, antiterrorism awareness, whistleblower rights, and cloud computing services,