CISA Coordinated Vulnerability Disclosure Support Contract Drops 8(a) for a Full Small-Business Set-Aside, With a May 2027 Solicitation Target

The CISA Coordinated Vulnerability Disclosure Support Contract Opened to Non-8(a) Small Firms on Oct. 20

The CISA coordinated vulnerability disclosure support contract is a follow-on that CISA estimates at $20 million to $50 million. As of Oct. 20, 2026, CISA lists it as a full small-business set-aside on a GSA Schedule instead of an 8(a) buy. For a small firm outside the 8(a) STARS III pool, the current listing moves the requirement from closed to open. A narrower program designation in the “to be determined” field would close it again. Under that listing, only GSA Schedule holders can receive the order. CISA’s target for releasing the solicitation is May 30, 2027. This is new-business capture, and the lead time to get onto a Schedule is the constraint. The dollar range is an estimate. It is neither an obligation nor a ceiling.

• The follow-on is competed, firm-fixed-price, and designated a follow-on to an existing order.
• The work is analyst and operational staffing, performed in Arlington, Virginia.
• This is a forecast. A presolicitation notice, request for information, or draft requirement would come later, nearer the May 30, 2027 target.

CISA’s Forecast Changed Vehicle and Program on Oct. 20 and Now Targets Solicitation Two Months Later

CISA changed the forecast entry’s contract vehicle and small-business program on Oct. 20, then updated the entry again on Oct. 23. A forecast is CISA’s planning statement and comes before any solicitation. The entry gives no reason for the changes. The earlier listing limited the requirement to 8(a) STARS III contract holders, all of which entered through the 8(a) program. The current listing has no such limit. The vehicle change may only bring the entry in line with the incumbent’s existing vehicle. The incumbent order is reported to sit under a GSA Multiple Award Schedule contract, while the entry first listed STARS III. If so, the program field moving off 8(a) is the change that opens the field. The entry does not say when the solicitation target changed.

Under the current forecast, the Schedule is the acquisition vehicle, so it decides who CISA can offer the order to. Eligible bidders are Schedule holders that are small under the NAICS 541519 size standard on the day they submit an offer. CISA cannot consider a small firm without a Schedule unless the vehicle changes again. Large integrators cannot prime a full small-business set-aside.

The Incumbent’s 8(a) Graduation Does Not Bar It From the Recompete as Currently Listed

Under the current listing, Tharros’s 8(a) graduation does not lock it out. Whether it can prime depends on its size under NAICS 541519 at offer. The existing order is reported to have been awarded under 8(a) and to sit under a GSA Multiple Award Schedule contract. That would mean Tharros already holds a Schedule. Tharros is also reported to have left the 8(a) program in October 2024. Its size representation under NAICS 541519 sits on its federal registration record.

Plan on Tharros bidding. It holds past performance on this same work, and the evaluation will probably weigh it. The timing also favors continuity. The order’s potential end date is reported as Sept. 27, 2027. CISA expects an award between July and September 2027. The order’s remaining life is uncertain, because its reported obligations and current end date conflict. The entry lists contract completion on Sept. 27, 2028 with no start date. A 12-month base period would fit that gap, but the entry does not say so.

That schedule leaves almost no slack. If the solicitation slips again, I’d expect a bridge extension to the incumbent rather than a gap in service. No public notice signals a bridge today. I’d treat the incumbent’s bid as likely and a bridge as possible. A bridge would delay the competition but might not cancel it.

Tharros Is the Only Named Competitor, and Neighboring CISA Buys Are Separate Markets

Tharros is the only firm tied to this requirement. No bidder or teaming arrangement has surfaced publicly. Treat neighboring CISA buys as separate markets, because each has its own scope, incumbent base, and timing.

• Incumbent: Tharros, under order 70RCSJ23FR0000070. Its potential value is reported near $23.9 million, up about 5% from roughly $22.7 million at award. The order is reported to sit under a GSA Multiple Award Schedule contract.
• Contracting office: The entry does not name the office that will place the order, so the competition manager is unknown.
• Likely bidder categories: Small firms with vulnerability analysis, coordination, or secure-by-design experience, plus small MSSP and GRC firms with vulnerability management practice lines. This is a category inference from the scope.

Disclosure Branch Work Is Analyst Staffing, So Vulnerability-Coordination Past Performance Is the Likely Discriminator

The CISA coordinated vulnerability disclosure support contract asks for subject matter expert analytic and operational staff for the Vulnerability Management office. The entry lists three jobs. Staff widen vulnerability analysis coverage and support secure by design and secure by default work across the cyber supply chain. They also add new capabilities for the Disclosure branch’s response and disclosure goals.

CISA describes its process in five steps: collection, analysis, mitigation coordination, application of mitigation, and disclosure. Analysts work across that chain, so reviewers will likely look for experience from triage through disclosure. On fixed-price staffing with no stated technical differentiator, I’d expect the evaluation to turn on past performance, staffing, and price.

The forecast states no evaluation factors. The probable discriminators below come from the scope alone:

• Documented vulnerability triage and analysis work for a federal customer.
• Experience coordinating fixes and disclosure timing with vendors and researchers.
• Staff who can work beside government personnel in Arlington, Virginia.

Seven Months of Lead Time: What Each Kind of Small Firm Does Before May 30, 2027

The target is seven months out. As currently forecast, a firm must hold a Schedule before it can submit an offer. A founder, BD lead, or capture lead at a small business should sequence the work this way:

1. This month: confirm whether you hold a Schedule. If you do not, start the application and record the date.
2. Next: confirm your size status under NAICS 541519, which averages annual receipts over five completed fiscal years.
3. Before the solicitation posts: map your past performance to triage, analysis, and disclosure coordination work.
4. When the solicitation posts: decide whether you prime or sub, and name your partner.

Segment by firm type:

• Small, no Schedule: The Schedule application is the critical path. Everything else can wait for the solicitation.
• Small, with a Schedule: Build the past-performance file and call the Disclosure branch before the target date.
• Mid-market over the size standard: Your role is subcontractor, and the prime’s limits on subcontracting cap your share.
• New entrant: Sub to a small prime first. Past performance with CISA is the missing piece.

• Pull your annual receipts for your last five completed fiscal years and compare the average with the NAICS 541519 size standard.
• Check whether your Schedule carries labor categories that match vulnerability analysis work.
• List every contract where you triaged, analyzed, or coordinated disclosure of a vulnerability, with a customer contact.
• If you plan to sub, calculate what share of the amount paid your prime would have to keep.

I recommend shaping this one, because no solicitation exists. Engage CISA’s Vulnerability Management office and its Disclosure branch now. Ask which Schedule category the order will use. A presolicitation notice naming that category would move this to a team-or-pursue decision. A bridge extension to the incumbent, another slip past fiscal 2027, or a return to 8(a) would move it to watch. DHS has told industry to use its new forecast listing starting Nov. 5, 2026. The next change to this entry should appear there.

FAQ

Which CISA office owns this requirement?

The Vulnerability Management office in CISA’s Cybersecurity Division owns it. The Disclosure branch is the working customer. The forecast does not name the contracting office that will place the order. Ask CISA’s program office which office that is before you invest in capture.

Is $20 million to $50 million a budget or a ceiling?

Neither label fits. The figure is an estimate range in a forecast. The entry gives no period of performance, so you cannot derive an annual run rate. Treat it as a size signal until a solicitation states a ceiling and ordering period.

Can a large integrator participate?

A large integrator can participate only as a subcontractor, because a full small-business set-aside bars large primes. Under the limits on subcontracting in 13 CFR 125.6, subcontractors that are not similarly situated can together receive no more than half of what the government pays a small prime for services.

Could another socio-economic program be added?

A narrower program is possible. Since Oct. 20, the small-business program field has read “to be determined,” which leaves room for one. That would shrink the pool again, so confirm the program designation when the solicitation posts.

What would close or delay this opportunity?

A bridge extension to the incumbent, a merge into another CISA vehicle, or a reversion to 8(a) or a narrower program would each close or delay it. A bridge would show up as a notice or modification that extends the current order with no competitive solicitation behind it. The other two would show up as changes to this forecast entry.