USDA Cybersecurity and Privacy Operations Center BPA Awardees: Two Already Held CPOC-Adjacent Contracts

USDA Cybersecurity and Privacy Operations Center BPA Awardees Named, 25 Winners From 60 Bidders

USDA Cybersecurity and Privacy Operations Center BPA awardees now number 25, picked from 60 bidders on a new $1 billion cybersecurity vehicle. If you’re one of the 25, the near-term opportunity is competing for call orders as USDA spends against that ceiling. For the roughly 35 firms that didn’t win a seat, the vehicle has no announced on-ramp. Their path back runs through a subcontractor relationship with one of the 25, not a fresh bid. Either way, the $1 billion figure matters less than what’s behind it. Is it new federal cybersecurity demand, or work USDA already had running in smaller contracts?

CPOC is USDA’s Cybersecurity and Privacy Operations Center. It runs enterprise-wide security engineering, monitoring, and privacy operations for USDA’s eight mission areas and 29 agencies and offices. CPOC opened a five-year ordering period on September 21, 2026, under a new BPA. A BPA, or blanket purchase agreement, is a multiple-award vehicle that GSA Schedule holders compete for. It lets USDA place call orders against pre-negotiated terms.

• Two BPA holders, Alpha Omega and Easy Dynamics, already held separate CPOC-adjacent contracts from 2023 and 2025.
• The $1 billion figure is a five-year ceiling across all 25 holders combined, not a per-vendor guarantee. A BPA obligates nothing on its own. Only the call orders issued against it do, so no obligation figure is expected this early in the term.
• The $1 billion ceiling, the 25-awardee roster, and both predecessor-contract dollar figures below are unverified against the primary federal award record.

The reported award does hold an answer to the new-demand question. Two of the 25 new BPA holders, Alpha Omega and Easy Dynamics, held CPOC-adjacent point contracts before this vehicle existed. I don’t read that as a scandal. It suggests part of the $1 billion ceiling could represent task-level work USDA was already buying, not entirely new demand.

The Predecessor Contracts Behind the Headline Number

USDA’s cybersecurity buying at CPOC didn’t start with this BPA. The office’s predecessor, USDA’s Information Security Center, ran a five-year cyber-operations contract. Alpha Omega, teamed with Dynamo Technologies, won it in 2023 at a $70 million ceiling, running to roughly 2028. Easy Dynamics won its own $50 million recompete in June 2025, covering identity and access management plus cloud work at CPOC. Both contracts predate this BPA, and both firms now hold a BPA seat.

That timing should change how you read the $1 billion figure, though not by subtraction. The $120 million represents two predecessor ceilings, not confirmed obligated spend. How much of either remains unspent is undisclosed. The one settled point is that some known predecessor work exists inside a $1 billion vehicle. USDA hasn’t disclosed how large a share, or whether other CPOC-adjacent contractors outside the 25 carry similar work.

For Alpha Omega and Easy Dynamics, the table reads as continuity: both kept a BPA seat. Dynamo Technologies, Alpha Omega’s 2023 teaming partner, is the one known predecessor firm without a seat on the new BPA. The reported award doesn’t say whether the teaming changed or something else happened. USDA also hasn’t disclosed whether Alpha Omega’s and Easy Dynamics’ own predecessor contracts keep running alongside the BPA or wind down into it.

Don’t treat $1 billion as fresh call-order competition. The remainder after subtracting the predecessor ceilings isn’t a clean pipeline estimate either, since neither figure is settled. Watch which mission areas issue call orders first. The contract ceiling vs. obligated funding gap on the new BPA decides whether the headline number becomes real revenue for anyone, holders included.

The USDA Cybersecurity and Privacy Operations Center BPA Awardees, and the Firms Left Out

The 25 USDA Cybersecurity and Privacy Operations Center BPA awardees split into two groups. By profile, 21 read as small business and mid-market cybersecurity and governance/risk/compliance firms. Only AttainX is explicitly reported as a small-business awardee. Here are the 21.

• Alpha Omega, Easy Dynamics, AttainX, Argus Secure Technology, Artemis Federal, and ASSYST.
• B&M Consulting Group, Crest Security Assurance, Customer Value Partners, Delviom, Emagine IT, and Excel Technologies.
• Excentium, Graham Technologies, Koniag Data Solutions, Maveris, Saliense Consulting, SofitC3, Valiant Solutions, Vinsys Information Technology, and 22nd Century Technologies.

Four large primes hold seats at a different tier: Accenture Federal Services, Deloitte & Touche, Guidehouse, and Leidos.

That leaves roughly 35 of the original 60 bidders without a seat. USDA’s reported award doesn’t name them, which is normal. A BPA competed under a GSA Schedule usually notifies unsuccessful offerors one by one rather than publishing the full list. The only paths onto this vehicle run through one of the 25 holders, by winning call orders or subcontracting to one that does.

USDA structured the BPA around three functional areas. The reported award doesn’t name them or say which holder covers which. CPOC’s stated mission suggests the rough breakdown below. USDA hasn’t disclosed the actual assignment across the three areas.

• Enterprise cybersecurity engineering and Risk Management Framework/authorization-to-operate support.
• Security operations center work, continuous monitoring, and threat analytics.
• Privacy operations and supply-chain risk management.

1. Identify which holders’ functional-area coverage overlaps your own capability set. Not every holder covers the same area.
2. If you’re outside the 25, ask a holder that pursues call orders in your specialty about a subcontract. Do it before USDA’s mission areas start issuing orders.
3. If you’re one of the 25, track which USDA mission areas issue call orders first. That’s where near-term demand concentrates.

The Realistic Path for the 35 Non-Selected Bidders

Some of the 35 non-selected bidders may carry federal cybersecurity past performance that fits a subcontract role. The reported award doesn’t name them. A firm that didn’t win a seat should contact a named holder directly rather than wait for a second on-ramp. Nothing signals that USDA plans to add holders during the term.

• Confirm your HACS SIN position. It keeps you eligible to bid USDA cybersecurity work outside this BPA, which has no announced on-ramp.
• Start outreach with holders that match your specialty. No evidence favors one holder’s call-order odds over another’s.
• Build a capability statement around CPOC’s mission, not generic cyber credentials.

What Would Turn the $1 Billion Ceiling Into Real Revenue

For a firm weighing this BPA, the next move is to track USDA’s call orders. The question is whether mission areas issue them fast enough to turn the ceiling into revenue, and for whom. None of the 25 holders has a confirmed call order yet, Alpha Omega and Easy Dynamics included. The near-term posture is to watch for the first one, not to assume continuation or new-scope work.

For the 35 non-selected bidders, the realistic path stays a subcontract with one of the 25. Two things would change that: USDA adding capacity, or standing up a parallel small-business vehicle. Neither is signaled. Watch instead for three details in the first call orders CPOC issues.

• Which of the three functional areas each order covers.
• Which of the 25 holders wins it.
• Whether the dollar value starts closing the gap between the $1 billion ceiling and actual spending.

For the 25 holders, the move is to pursue call orders as USDA issues them and check each order’s stated scope against their functional-area coverage. For everyone else, it’s building a subcontract relationship now, since no on-ramp is announced.

FAQ

Is USDA’s $1 billion CPOC cybersecurity BPA new demand or a consolidation of existing contracts?

Likely both. The $1 billion figure is a new five-year ceiling. But at least two of the 25 winners, Alpha Omega and Easy Dynamics, already held smaller CPOC-adjacent point contracts before this BPA existed. USDA hasn’t disclosed whether that predecessor work moved onto the new vehicle or still runs separately. Their continuity still suggests part of the ceiling overlaps work already underway.

Which companies won a spot on USDA’s CPOC Cybersecurity Support Services BPA?

Twenty-five firms hold seats. Most read as small business and mid-market cybersecurity firms by profile. AttainX is the only one explicitly reported as a small-business awardee. Four large primes also hold seats: Accenture Federal Services, Deloitte & Touche, Guidehouse, and Leidos.

How does a firm without a seat on this BPA still compete for USDA cybersecurity work?

USDA hasn’t announced an on-ramp onto this BPA. A subcontract or teaming relationship with a holder is the realistic route onto this specific vehicle. USDA components can still buy cybersecurity work outside this BPA. That includes buying directly off the GSA Multiple Award Schedule’s Highly Adaptive Cybersecurity Services SIN from a firm that holds its own position there.

What’s the difference between the BPA’s $1 billion ceiling and actual USDA cybersecurity spending?

The ceiling is the maximum USDA could order against the vehicle across all 25 holders over five years. Actual spending depends on how many call orders USDA’s mission areas issue, and at what dollar value. USDA hasn’t reported either figure yet.

What happened to Alpha Omega’s and Easy Dynamics’ earlier, smaller CPOC contracts?

Alpha Omega’s 2023 cyber-operations award carries a $70 million ceiling. Easy Dynamics’ 2025 ICAM/cloud recompete carries a $50 million ceiling. Both predate this BPA, and both firms hold a seat on the new vehicle. The reported award doesn’t say whether either predecessor contract closed out or transitioned. Alpha Omega’s award runs to roughly 2028, past the BPA’s own start date.

What are the three functional areas this BPA covers?

The reported award confirms three exist but doesn’t name them. CPOC’s mission spans cybersecurity engineering, RMF and authorization-to-operate support, security operations, continuous monitoring, threat analytics, privacy operations, and supply-chain risk management. That scope is broad enough to plausibly sort into three areas. USDA hasn’t disclosed the exact grouping.