The CISA Cybersecurity Acquisition Support RFI Wants Help Buying $600 Million a Year in Cyber Tools

GSA Is Running This Buy on CISA’s Behalf

CISA’s Cybersecurity Division and CDM Program buy cyber tools and software licenses through more than 600 procurements a year, per the RFI’s own text. GSA’s Assisted Acquisition Services wants help managing that volume. It posted the CISA cybersecurity acquisition support RFI, formally titled “CISA Strategic Cyber Tools Buying” (solicitation 47QFRA26K0008). Responses close September 1, 2026. If you sell acquisition support, resell cyber tools, or integrate systems for the Continuous Diagnostics and Mitigation (CDM) program, mark that date. It’s your window to shape the buying vehicle before it hardens into a solicitation.

Three facts define the opportunity.

• GSA Assisted Acquisition Services Region 8 runs this market research on CISA’s behalf. The RFI doesn’t name who would run a resulting contract.
• This federal cybersecurity procurement action is separate from CDM’s technical-integration work. It buys acquisition-support and license-management services only.
• CISA wants a software-management platform with automated alerts for license renewals and overspending, not just a buying process.

I read the RFI and its 22-page requirements attachment directly. SAM.gov’s web interface failed to render, so I pulled both from its public API. That resolves a naming ambiguity. “SCABS” (Strategic Cybersecurity Acquisition and Buying Services) is a different, earlier notice: 47QFRA24K0005. GSA AAS Region 8 posted it in February 2024 and closed it that March. This RFI comes from the same office, carries no SCABS branding, and reads best as a continuation of it under a new name.

What the CISA Cybersecurity Acquisition Support RFI Asks a Contractor to Do

The RFI numbers five functions it wants a contractor to run.

1. Project Management Support. Running the buy as a program, not a series of one-off purchases.
2. Strategic Buying Advisory Support. Software-buying expertise to advise CISA and track a fast-moving cybersecurity market.
3. Acquisition and Procurement Support. Executing individual cyber-tool purchases.
4. Enterprise License and Procurement Management. Tracking, renewing, and consolidating software licenses across CDM’s FCEB customers instead of agency by agency.
5. Surge Support. Absorbing unplanned procurement volume.

The pricing bar is high. Per the requirements attachment, CDM has historically captured 70-80% discounts off GSA’s Multiple Award Schedule. CISA wants a contractor who can match or beat that. It also wants license costs priced separately from services like integration, reselling, or advisory work. Citing Executive Order 14402, the RFI asks what fixed-price structure would work here.

None of these five functions is CDM’s existing technical-integration work: the sensors, dashboards, and DEFEND task orders delivering capability today. The RFI’s capability questions ask only about acquisition, licensing, and strategic advisory work. A procurement and enterprise license management firm therefore fits better here than a pure systems integrator.

Four Companies Show the CDM DEFEND Ecosystem’s Depth, Not Who Will Bid

No public source names a firm positioned to bid on the CISA cybersecurity acquisition support RFI. The four companies below are CDM DEFEND technical integrators in a different service line. They are not this action’s competitive set.

This requirement traces to a larger consolidation plan

This scope “was previously identified as part of a larger approach” bundling multiple contracts “as follow-ons to DEFEND,” per the RFI’s capability questions. That tracks with a separate CISA IDIQ sources-sought notice, 47QFRA25K0003. The notice “supports CISA’s intent to shift its existing Dashboard and DEFEND task orders to more functionally aligned contracts,” GovConWire reported in March 2025. The “Cyber DOME” name comes from one Tier 3 account, gdicwins.com. Treat it as an unconfirmed nickname, not an established program title.

The four CDM DEFEND primes

Trade press reported five CDM DEFEND task-order awards from 2018-2024 across four companies, two of them Booz Allen’s. That reporting placed those awards in GSA FEDSIM’s Alliant 2 process with DHS. ManTech and CACI hold task orders through April 2027, per HigherGov.

Booz Allen’s 2018 task order carried a potential six-year term. No source states when it ended. Its separate $421M/$1.2B DEFEND task order, awarded August 2024, may run alongside the 2018 one or replace it. Nothing in the record settles which. CGI’s status is also not established. HigherGov resolves the other three companies’ Alliant II IDVs, listed below. It has no PIID for CGI’s 2020 award or CACI’s 2018 task order.

Who’s likely to respond

The likely field breaks into three types of firm: acquisition-support and procurement-consulting firms (the RFI’s direct audience), cyber-tools resellers and license-agreement managers, and CDM Approved Products List systems integrators. CISA replaced the APL’s old framework with a new Technical Capability Catalog. That catalog now feeds a Cyber Product List, superseding the legacy APL. This contract sources from both during the transition.

Before you treat any of these four as a teaming target

• Pull each company’s current CDM DEFEND status via HigherGov’s PIID index: Booz Allen 47QTCK18D0004, ManTech 47QTCK18D0031, CACI 47QTCK18D0009, CGI via Alliant 2/FEDSIM (no PIID located). Name-based USASpending/FPDS searches won’t surface these.
• Check GovTribe or SAM.gov for a recompete or bridge notice on the 2018/2020 awards.
• Determine whether any of the four has signaled bidding intent. None has, as far as I found.

Three Dollar Figures Are Circulating. Two Procurements, Not One.

Three dollar figures describe two related but distinct procurements. The $600 million and at-least-$6-billion figures come from GSA’s market research behind this RFI. They’re not yet competable. The $18-20 billion figure is a reported range, not a single number. It comes from a different, related procurement.

GSA issued a separate sources-sought RFI, 47QFRA25K0003, in February 2025 for a new 10-year CISA IDIQ. Its SAM.gov description folds in two earlier RFIs: “Deployment Services” (47QFRA23K0003) and SCABS itself (47QFRA24K0005). This RFI descends from that second notice. GovConWire reported the following month that the same notice would also shift existing Dashboard and DEFEND task orders to more functionally aligned contracts. Its scope overlaps this RFI’s acquisition-support functions, not just technical integration.

Washington Technology reported an expected RFP in February 2026 and an expected award by February 2027. That projection has now lapsed by six months. A Feb. 24, 2026 industry writeup (gdicwins.com) still called the effort pre-solicitation, and no RFP has issued since. Treat both dates as unconfirmed forecasts. Don’t merge the two dollar totals either. They’re separate estimates for related but distinct actions, even where scopes overlap.

No source states whether the $6 billion floor includes software-license costs priced separately from services. My read: if it does, some share is pass-through spend, not revenue. Model your addressable share against the services-and-advisory functions, not the headline total.

How to Respond, by Segment

Your next move on RFI 47QFRA26K0008 depends on which of its five functions matches your firm. Read the segment that fits your business, not the one you hope to grow into.

• Acquisition-support and procurement-consulting firms: this RFI is written for you. Respond by the deadline below, backed by documented prime-contractor past performance.
• MSP/MSSP, GRC, and systems-integration vendors on the CDM Approved Products List: not the primary audience, though a centralized buying layer and the APL-to-CPL transition could change how your products reach CDM customers.
• Firms with no current CDM relationship: not responding doesn’t exclude you from any resulting solicitation, per the RFI’s own terms, but responding now is your only chance to shape the requirement while it’s still open.

The RFI text I reviewed doesn’t state a NAICS code or set-aside. Confirm both against the live SAM.gov notice before investing response time.

Confirm Your Firm’s Fit Before You Respond

Before responding, confirm your firm can substantiate the experience CISA and GSA want, not generic credentials.

• Confirm your UEI, CAGE code, and socio-economic status (8(a), HUBZone, WOSB, SDVOSB) are current for the cover page.
• Pull a past-performance example your firm can document as prime, ideally within the last five years and sized to a multi-agency federal buy (a general federal-proposal best practice, not an RFI requirement I found stated).
• Price out separating license costs from value-added services, benchmarked against CDM’s 70-80% MAS discount.
• Identify which RFI function your firm doesn’t perform, then scope a teaming partner for that gap before September 1.

FAQ

What happens to the CDM DEFEND task-order holders if this RFI leads to a contract?

Nothing changes for them directly. This RFI buys acquisition-support and license-management services, a different scope than DEFEND’s technical integration. ManTech and CACI’s task orders run through April 2027, per HigherGov. The current status of Booz Allen’s Aug. 2024 award isn’t established. All run separately unless the CISA IDIQ, 47QFRA25K0003, later consolidates DEFEND itself.

Could an existing GSA vehicle absorb this instead of a new contract?

The RFI asks industry that exact question. It names pricing benchmarks to weigh: SEWP VI, OneGov, MAS, or a transactional basis. No vehicle is chosen. Alliant II Unrestricted, the GWAC carrying the CDM DEFEND task orders above, is worth watching too. I haven’t modeled it here. A stand-alone contract, absorption into an existing vehicle, or folding into the separate CISA IDIQ (47QFRA25K0003) all remain live outcomes.

What’s the next observable event after the September 1, 2026 deadline?

The RFI says responses may feed an Industry Day or one-on-one Market Analysis Discussions with GSA and CISA. Neither is confirmed to happen. Watch for a session invitation, an Industry Day announcement, or a draft RFP.

What would need to be true for this to become a live, competable opportunity?

A released solicitation or draft RFP naming a specific contract vehicle. Until then, the RFI is a shaping opportunity. You can influence requirements before they harden, but you cannot yet propose against anything.

What’s the fastest way to lose this opportunity?

Generic capability language instead of documented prime-contractor experience loses it. So does exceeding the 10-page limit. Submissions over that may be disregarded.

BD classification: SHAPE Confidence: Moderate Evidence that would upgrade this: A released solicitation or draft RFP naming a contract vehicle, or a confirmed incumbent/teaming structure. Evidence that would downgrade this: CISA or GSA canceling the effort, or folding cyber-tools buying into an existing vehicle with no new competition.