cybersecurity management support services

Background
The Department of Transportation (DOT) is seeking to extend the cybersecurity management support services provided under the Cyber Security Information & Program Services (CSIPS) Blanket Purchase Agreement (BPA) Order 693JJ320A000013_693JJ322F00228N, awarded to Deloitte.

This extension is necessary while DOT undergoes a restructuring of its information technology workforce to determine if the current support can be reduced or fully transitioned to Federal employees. The current order is set to expire on 04/30/2026, and this request aims to extend it for an additional four months through 08/31/2026.

Work Details
The task order encompasses a wide range of technical and professional services for DOT's infrastructure, applications, and information systems. Key responsibilities include:

- Providing mission-essential cybersecurity services such as operations and oversight;
- Managing risk and vulnerability in alignment with multiple operational directives;
- Ensuring compliance with the Federal Information Security Management Act (FISMA);
- Supporting DOT systems in addressing vulnerabilities and non-compliance with Office of Management and Budget (OMB) directives;
- Operating and maintaining the DOT cybersecurity tool stack, including BigFix and Splunk, to facilitate the Continuous Diagnostic and Mitigation (CDM) program;
- Managing inventory, patching, updates, and vulnerability management using Tenable;
- Ensuring compliance with OMB Memorandum 21-31 and Executive Order 14028 regarding cybersecurity incident management;
- Developing audit recommendations for tactical implementation;
- Enhancing information systems hardening, data protection, and mission resiliency;
- Leveraging artificial intelligence (AI) for risk management modernization.

Place of Performance
The contract will be performed at the Department of Transportation's facilities located at 1200 New Jersey Avenue, SE, Washington, D.C. 20590.

Incumbent Analysis
This opportunity appears to have a confirmed incumbent based on the existing CSIPS BPA task order 693JJ320A000013-693JJ322F00228N awarded to Deloitte Consulting (valued at $13,945,145) covering 09/20/22–08/31/26. The prior award description indicates “cyber management support,” and the current extension continues the same cybersecurity management support activities (e.g., FISMA/OMB compliance, risk and vulnerability management, and operation of DOT cybersecurity toolsets) as a short-term continuation while DOT evaluates workforce transition.