SpyCloud: Cyber & Information Exposure Risk Monitoring

The contract under solicitation number W9128Z26CA008 is a one-year, firm-fixed-price delivery order awarded as a sole-source acquisition to SpyCloud for Cyber & Information Exposure Risk Monitoring services under the CHESS multiple award IDIQ contract vehicle. The procurement is justified under FAR 16.505(b)(2)(i)(B) due to SpyCloud's uniquely specialized capabilities, including its global access to stolen credentials, session cookies, malware-infected device intelligence, and dark web data—capabilities deemed irreplaceable by any other vendor and critical to preventing account takeovers, ransomware, and data breaches across DoD, Intelligence Community, and law enforcement agencies. The period of performance runs from March 9, 2026, through March 8, 2027, with performance centered at Aberdeen Proving Ground, Maryland, and delivery of services provided through API-accessible, real-time threat intelligence feeds. The service includes continuous processing of over 300 billion identity intelligence records, automated filtering to exclude U.S. person data per Privacy Act requirements, and detection of forged or synthetic data using geographic and behavioral analysis. The acquisition is structured as a commercial item under FAR 15.403-1(b)(3), with no formal evaluation factors, adjectival ratings, or cost comparison criteria applied, as award is based solely on technical uniqueness rather than price or competition. Key deliverables encompass Supply Chain GVT services for 100 domains, Investigations PRO licensing, and 25 analyst credits, though explicit pricing, CLIN structures, or total contract value are not provided. The government retains full authority for inspection and acceptance at the contracting office location, with compliance requirements centered on handling Controlled Unclassified Information and foreign-sourced data—including from sanctioned nations such as China, Russia, and Iran—raising potential implications under EAR and ITAR, though no explicit certifications or compliance attestations from the vendor are documented. No packaging, labeling, barcoding, or physical delivery requirements exist, as the service is entirely digital. The acquisition is funded through FY2026 RDT&E Army funds via the Army Contracting Command–Aberdeen Proving Grounds, with primary point of contact Lindsay Vierheller and secondary contact Sesun J Park, while no Contracting Officer, COR, or COTR names are explicitly listed. The absence of formal Section K representations, UEI or CAGE codes, socioeconomic status declarations, or invoice submission