CISA Plans Follow-On Cybersecurity Operations Support Contract Worth More Than $100M

# What the planned contract is CISA has announced plans to compete a follow-on cybersecurity operations support services contract (COSS) valued at more than $100 million. The agency frames this as a labor-hour award to provide ongoing operations and defensive capabilities for its information systems.

# Timeline and contracting vehicle

• Solicitation release: expected by Oct. 31.
• Anticipated award: second quarter of fiscal year 2027.
• Contract period if awarded as planned: through Jan. 26, 2032.
• Procurement vehicle: GSA Alliant 2 governmentwide acquisition contract.
• Performance location: Arlington, Virginia.

# What the contractor will be asked to provide The contract scope covers monitoring and protecting CISA systems against unauthorized access, misconfiguration, and disruption. Specific tasks and capabilities CISA listed include:

• Security operations center functions and vulnerability management.
• Penetration testing and security engineering.
• Cloud security and AI security.
• Purple team exercises and electronic discovery support.

Work will apply across CISA's Federal Information Security Modernization Act (FISMA) systems, spanning hybrid cloud environments, data centers, end-user support and network infrastructure. The contractor must provide personnel, materials, equipment, facilities and travel necessary to support mission requirements.

# Related DHS and CISA acquisition activity to watch CISA is pursuing several complementary efforts that intersect with its COSS plans:

• A separate follow-on cyber operations contract to support threat hunting, incident response, cybersecurity engineering and security operations capabilities.
• Department-level initiatives such as the Cumulus cloud acquisition strategy to award major cloud provider contracts.
• A forecasted follow-on systems integrator blanket purchase agreement for the OneStream program, with an anticipated award in the second quarter of FY2027.

These procurements suggest CISA and DHS are aligning offensive/defensive operations, cloud modernization and systems integration efforts across overlapping timelines.

# Recent context influencing requirements DHS recently investigated unauthorized activity affecting its Homeland Security Information Network and isolated affected systems while conducting a forensic review. That incident is part of a broader context of federal agencies facing pressure to strengthen network defenses against evolving cyberthreats, which is reflected in CISA's procurement priorities.

# What contractors should consider

• Prepare proposals that demonstrate experience across hybrid cloud environments, FISMA systems, SOC operations, and emerging areas such as AI security.
• Highlight purple team and penetration testing capabilities tied to measurable outcomes.
• Build staffing plans that include travel, equipment and facilities, and clarify how surge or incident response support would be provided.

Aligning proposals with CISA's other acquisitions—for threat hunting, cloud modernization and systems integration—could strengthen offerings for integrated, cross-contract support.

# Bottom line CISA's planned follow-on COSS procurement is a multi-year, multimillion-dollar opportunity emphasizing SOC functions, vulnerability management, cloud and AI security, and exercises that test defensive readiness. Key dates and the Alliant 2 vehicle drive near-term preparations for interested contractors.