CISA to Award New Vulnerability Management Contract
The agency will release a small business solicitation on May 30, 2027, to support critical infrastructure security.
Updated on Oct. 27, 2026 in Cybersecurity
Live Poll
Should federal government agencies outsource essential cybersecurity support to private contractors?
CISA plans to issue a solicitation on May 30, 2027, for a follow-on contract to support its Coordinated Vulnerability Disclosure program. The agency will award the firm-fixed-price small business set-aside contract to provide operational and analytic support for critical infrastructure security.
Why it matters
This contract will accelerate the identification and remediation of cybersecurity vulnerabilities by providing dedicated personnel for secure by design and secure by default initiatives. The effort is essential to managing systemic risk in critical national infrastructure.
The upcoming contract is valued between $20 million and $50 million, significantly smaller than a separate $100 million cybersecurity assessment contract managed by the agency. It will be awarded through the GSA Schedule as a firm-fixed-price small business set-aside.
The players
CISA
The Cybersecurity and Infrastructure Security Agency is the primary federal body responsible for securing critical physical and cyber infrastructure in the United States.
Tharros
Tharros is an incumbent government contractor currently providing technical services for CISA's vulnerability management programs.
The details
The successful contractor will provide analytic and operational staff to work directly with CISA’s disclosure branch. This team will focus on secure by design and secure by default initiatives, which involve integrating security features into software development lifecycles and product configurations from the outset. By supporting the Coordinated Vulnerability Disclosure program, these personnel will help identify and mitigate software flaws in critical infrastructure before they can be exploited.
Timeline
May 30, 2027: Solicitation release
Q4 fiscal 2027: Planned contract award
September 27, 2028: Contract completion
The Tech Race
This contract maintains the operational backbone for CISA's Coordinated Vulnerability Disclosure program. It follows a multi-year effort to modernize how critical infrastructure operators identify and remediate security flaws.
Organizations relying on critical infrastructure will see improved security posture as the agency expands its capacity for vulnerability remediation. The contract will run through September 27, 2028, ensuring continuous operational support for these security mandates.
The takeaway
The agency is doubling down on professional staffing to manage the volume of incoming vulnerability reports. Observers should track the release of the solicitation on May 30, 2027, to identify which small business vendors are selected to lead this infrastructure-critical work.
What happens next
CISA is scheduled to release the formal solicitation on May 30, 2027, followed by a contract award anticipated in the fourth quarter of fiscal 2027.
Further reading
Learn more about federal security initiatives at Cybersecurity.
Source note: This article includes information reported by ExecutiveBiz.
Live Poll
Should federal government agencies outsource essential cybersecurity support to private contractors?
