Jane Edwards 
- The effort will back CISA’s vulnerability analysis and disclosure work
- The agency targets a May 2027 solicitation release
- CISA’s Bobby Thompson will keynote the 2026 Homeland Security Summit
The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency has unveiled plans to award a follow-on contract for subject matter expert support to its Coordinated Vulnerability Disclosure, or CVD, program.
Vulnerability disclosure plays a key role in CISA’s mission to safeguard critical infrastructure and strengthen national cybersecurity. Bobby Thompson, acting associate director for threat hunting at CISA, will deliver a keynote address at the Potomac Officers Club’s 2026 Homeland Security Summit on Nov. 10, where DHS decision-makers and industry innovators will discuss artificial intelligence for investigative intelligence, edge capabilities for border defense, federated data fabrics and counter-unmanned aircraft systems. Book your spot now!
According to a notice published Friday on the Acquisition Planning Forecast System, the contract has an estimated value of $20 million to $50 million.
What Is the CVD Program?
The CVD program is a CISA effort that coordinates the identification, remediation and disclosure of cybersecurity vulnerabilities that pose risks to critical infrastructure. The program covers operational technology and industrial control systems, Internet of Things devices, medical devices, open source software, AI and IT systems.
Through the program, CISA aims to have the agency, affected vendors and the reporting party disclose simultaneously so that users and administrators receive clear and actionable information in a timely manner.
What Is the Scope of the Proposed Follow-On CVD Contract?
CISA plans to award the firm-fixed-price contract through the GSA Schedule as a small business set-aside. Tharros is the incumbent contractor. Work will take place in Arlington, Virginia.
The contractor will supply analytic and operational staff to help vulnerability management within CISA’s cybersecurity division expand expert coverage across its vulnerability analysis portfolio, working alongside personnel from the disclosure branch. The contractor will also support secure by design and secure by default activities that advance CISA’s goal of reducing risk across the cyber supply chain.
In addition, the agency is seeking new and enhanced capabilities to help the disclosure branch meet its vulnerability response and disclosure objectives.
What Is the Timeline for the Planned Procurement?
CISA expects to release the solicitation on May 30, 2027, and anticipates making the award in the fourth quarter of fiscal 2027.
The forecast lists Sept. 27, 2028, as the contract completion date.
What Other Vulnerability Management Efforts Is CISA Pursuing?
The planned CVD support contract builds on CISA’s broader work to strengthen vulnerability disclosure. In July, the agency and four international partners released guidance to help software manufacturers and online service providers establish CVD programs and build collaborative relationships with security researchers.
CISA has launched a public nomination form for known exploited vulnerabilities, a reporting capability that aligns with its Vulnerability Disclosure Policy Platform and CVD program. The agency has also ordered federal civilian agencies to prioritize vulnerability patching based on risk, consolidating earlier patching requirements into a single framework.
On the acquisition front, CISA has forecast a follow-on contract worth over $100 million for integrated cybersecurity assessment and hygiene support, which would serve as a single support vehicle for its vulnerability management subdivision. The agency plans to compete a separate follow-on contract for cybersecurity operations support services covering security operations center functions, penetration testing, and cloud and AI security.
CISA has outlined plans for a cyber technology services contract supporting its threat hunting operations as well, along with a follow-on Amazon Web Services cloud hosting contract to support compute, storage and data protection across its cloud environment.
