Top

Justification and Approval - Vulnerability Disclosure Policy Platform (VDP) Platform

Awarded

47QFRA20Q0048Federal

Contract Overview

Solicitation details, issuing organization, response deadlines, documents, and interested companies for this government contract opportunity.

AI Contract Overview

The Cybersecurity and Infrastructure Security Agency (CISA) is extending its contract for a secure, commercial Software-as-a-Service platform that enables Federal Civilian Executive Branch agencies to receive, validate, track, and manage cybersecurity vulnerability disclosures from external researchers. This platform supports the implementation of Binding Operational Directive 20-01 by providing a centralized, scalable system for Vulnerability Disclosure Policies, allowing secure collaboration between agencies and security researchers. It includes features such as role-based access, API integrations, configurable reporting, and optional bug bounty program support, all designed to ensure the confidentiality, integrity, and availability of vulnerability data while enabling efficient remediation of threats to federal systems. The contractor is responsible for configuring, operating, securing, and maintaining the platform, including sustaining its Authority to Operate and complying with all federal cybersecurity authorization requirements. Services extend to technical support, user onboarding, vulnerability triage and routing, operational reporting, and assistance to agencies implementing bug bounty programs. The extension ensures uninterrupted service continuity during a transition period, preserving the government’s ability to receive and manage coordinated vulnerability disclosures without disruption. The contract, managed by the General Services Administration under solicitation number 47QFRA20Q0048, is administered from Kansas City, Missouri, with performance primarily based in Arlington, Virginia.

General Info

CISA extends secure SaaS platform for federal vulnerability disclosures and bug bounty programs.

Agency

General Services Administration → GSA Gas Aas Region 6View Agency

NAICS

541519 - Other Computer Related ServicesView NAICS

Place of Performance

Arlington, VA, 22203, USA

Set-Aside

NONE

Documents

(1)

47QFRA20C0012 VDP Platform Justification and Approval

PDF•7 pages•justification-and-authorization

AI Contract Breakdown

Uniform Contract Format

What is UCF?

Uniform Contract Format (UCF) uses AI to break down any contract into standardized sections—scope, pricing, deliverables, and evaluation criteria.

Timeline

PhaseAwarded

PostedJul 16

Justification (J&A)

AwardedSep 12

Contract was awarded

Ready to pursue this opportunity?

Start your free trial to track this contract, build proposals with AI assistance, and manage your pipeline.

Organization & Contact Information

AgencyGeneral Services Administration → GSA Gas Aas Region 6

Contacts2 people available

OfficeKANSAS CITY, MO, 64108, USA

Organization / Agency

General Services Administration → GSA Gas Aas Region 6

View Agency Profile

Office AddressKANSAS CITY, MO, 64108, USA

Contacts

Adrienne Davis

contact@example.gov

Matthew Schupbach

contact@example.gov

Full Description

The Cybersecurity and Infrastructure Security Agency (CISA) partners with Federal agencies, industry, and other stakeholders to strengthen the security and resilience of the Nation's critical infrastructure and Federal information systems. As part of this mission, CISA supports ongoing efforts to reduce cybersecurity risk by identifying, assessing, and facilitating the remediation of vulnerabilities affecting Federal Civilian Executive Branch (FCEB) systems. These efforts support the implementation of Binding Operational Directive (BOD) 20-01, which requires FCEB agencies to establish and maintain Vulnerability Disclosure Policies (VDPs) to receive and address vulnerability reports submitted by external security researchers.

This requirement provides CISA and participating FCEB agencies with continued access to a secure, commercially available Software-as-a-Service (SaaS) Vulnerability Disclosure Policy (VDP) platform that enables the centralized submission, validation, routing, tracking, and reporting of cybersecurity vulnerabilities identified in internet-accessible Federal systems. The platform supports secure collaboration between security researchers and participating agencies, provides configurable reporting and metrics, role-based user management, application programming interface (API) integration capabilities, and optional functionality to support agency-managed bug bounty programs.

The contractor shall configure, operate, secure, and administer the platform; maintain the platform's Authority to Operate (ATO) and support applicable Federal cybersecurity authorization requirements; provide technical support and user onboarding; perform vulnerability triage, validation, routing, and tracking services; generate operational reporting; and support agencies that elect to implement bug bounty programs. The platform is designed to scale as agency participation changes while ensuring the confidentiality, integrity, and availability of vulnerability information and supporting the Government's continued ability to receive and manage coordinated vulnerability disclosures.

This modification extends the period of performance for the existing contract to ensure continuity of the enterprise Vulnerability Disclosure Policy (VDP) platform and associated support services. The modification continues uninterrupted support for participating Federal Civilian Executive Branch agencies and maintains the Government's capability to receive, triage, track, and manage vulnerability disclosures during the transition period.