Doing Business with Capacity Building

CISA manages a unique cybersecurity portfolio requiring a robust acquisition approach. We engage with prospective vendors to identify innovative cybersecurity solutions, share lessons learned, and solicit new opportunities to provide capacity building services to federal, state, local, tribal, and territorial government customers.

CISA is committed to supporting and improving acquisition strategy development, soliciting opportunities, and acquiring information technology tools and services to meet federal cybersecurity and information security goals while helping our stakeholders build cybersecurity capacity.

Industry Partners

Current and potential industry partners are encouraged to engage with CISA’s cybersecurity capacity building mission in a variety of ways, including the following:

Capacity Building Vendor Outreach Program

CISA’s Capacity Building Vendor Outreach Program helps the agency collect and catalog capabilities to define future requirements for cybersecurity programs and collect information on best-in-class solutions. Conducting in-depth market research focused on capacity building programs and initiatives, the program includes coordinated engagements that cultivate staff understanding about current products, best practices, and upcoming trends through vendor-led demonstrations and presentations, and opportunities for future collaboration and discussion. For more information about vendor engagement opportunities, please submit a vendor engagement form.

Continuous Diagnostics and Mitigation (CDM) Program’s Approved Products List (APL)

The CDM APL is the authoritative catalog for approved products that meet CDM technical requirements. Software and hardware manufacturers and resellers can submit products for APL consideration monthly according to the CDM APL product submission calendar. CISA reviews each submission against established CDM Program criteria to validate the vendor’s claim that each product meets the requirements for the capability category for which it was submitted. CISA encourages cybersecurity original equipment manufacturers and others to regularly update and add new and innovative tools to the CDM APL. Please visit CDM APL for more information.

Acquisition Announcements:

No current updates. 

---------------------------------

Watch this space for information about upcoming vendor engagement opportunities, Requests for Information, Requests for Proposal, industry days and solicitations.

For more information, visit SAM.gov

---------------------------------

Federal Customers

CISA works with federal stakeholders to gather requirements and develop, manage, and oversee innovative and complex cybersecurity acquisition strategies to provide commercial offerings to the federal enterprise. Potential federal partners are encouraged to engage with and use CISA’s cybersecurity capacity building program offerings.

Continuous Diagnostics and Mitigation Program

CISA’s Continuous Diagnostics and Mitigation (CDM) Program delivers cybersecurity tools, integration services, and dashboards to help participating agencies improve their security posture. The CDM Program was developed in 2012 to support government-wide and agency-specific efforts to provide risk-based, consistent, and cost-effective cybersecurity solutions to protect federal civilian networks across all organizational tiers.

CISA provides the following acquisition services and processes in support of the CDM Program for federal agencies.

CDM Dynamic and Evolving Federal Enterprise Network Defense (DEFEND)

CDM DEFEND is a series of task orders offering an all-encompassing approach for addressing CDM Program requirements. Each DEFEND task order is a single award Alliant Governmentwide Acquisition Contract (GWAC) executed by the awarded industry partner—the company responsible for installing and deploying CDM capabilities at federal civilian agencies. DEFEND offers a wide array of benefits to federal agencies, including flexibility, a streamlined procurement process, surge support for cybersecurity incidents, and optimal pricing by leveraging the federal government’s buying power.

The Office of Management and Budget (OMB) Memorandum 22-05, Fiscal Year 2021-2022 Guidance on Federal Information Security and Privacy Management Requirements, reinforces the importance of federal agencies using the CDM Program’s acquisition vehicles to procure agency tools and capabilities. Agencies are strongly encouraged to use current and future CDM acquisition vehicles.

Federal agencies interested in utilizing the DEFEND contract vehicle to procure information security continuous monitoring (ISCM) tools and services can contact us at csd_cb.acqbudg@cisa.dhs.gov.

CDM Approved Products List (APL)

CISA manages the CDM APL and has ensured that approved CDM products are easily available for purchase by federal agencies through several options, including the CDM DEFEND contract vehicle, the Multiple Award Schedule (MAS) Information Technology (IT) contract (through GSA Advantage!), and the NASA SEWP CDM Catalog. Note that on GSA Advantage! all CDM APL products have a CDM tag, giving purchasers the confidence that these products are CDM approved. Please visit CDM APL for more information. 

Cybersecurity Quality Services Management Office

CISA’s Cybersecurity Quality Services Management Office (Cyber QSMO) is the single shared service office for managing cybersecurity solutions for the U.S. government and potentially beyond. The program centralizes, standardizes, and offers high-quality cybersecurity services and capabilities to federal agency customers that meet or exceed government standards and requirements, and provides integration and adoption support. Robust acquisition management approaches for each initiative are required to ensure they are vetted and standardized cybersecurity services and vehicles provided with optimal cost savings.

Federal agencies can access these cybersecurity services by utilizing CISA cybersecurity acquisition vehicles. 

More information on available CISA-funded services and vehicles to come.

To learn more about taking advantage of Cyber QSMO services and vehicles, please visit the Cyber QSMO Marketplace or contact QSMO@cisa.dhs.gov.

State, Local, Tribal, and Territorial Entities

State, local, tribal, and territorial (SLTT) entities can currently access and use the CDM APL through the MAS IT contract (via GSA Advantage!).

More information on Capacity Building opportunities for SLTT entities to come.

 

Career Opportunities

We’re hiring! CISA’s Capacity Building Acquisition and Budget team is seeking highly qualified professionals to fill mid- and senior-level positions. Capacity Building Acquisition and Budget staff are responsible for serving as advisors within CISA’s Capacity Building mission area and providing procurement and budget advice, guidance, and assistance to the organization. Acquisition staff develop innovative short- and long-term acquisition strategies and help build shared services programs to support the entire federal enterprise and SLTT entities. 

Additionally, staff are responsible for planning, organizing, and carrying out major, substantive budgets for significant IT program components.

View the CB Acquisition and Budget Hiring Fact Sheet

To apply, please visit CISA Careers. 

To learn more about collaborating with CISA to equip our customers to build their cybersecurity capacity, please email us at csd_cb.vendoroutreach@cisa.dhs.gov.