DHS adjusts experience requirements for CISO cybersecurity IDIQ

The Homeland Security Department announced April 8 that it has revised its corporate experience requirements for an upcoming cybersecurity indefinite-delivery indefinite-quantity contract. Potential bidders told the department it set over-the-top requirements that would disqualify many potential bidders due to the excessive standards.

Companies suggested that DHS remove restrictive wording related to past experience so they could include similar work as evidence of their ability to meet DHS’ needs. For instance, one responder asked that DHS allow companies to use enterprise-level experience instead of specific work for security operations centers (SOCs). The change in wording would allow a company to demonstrate its experience through its past engineering roles with the same level complexity and diversity of tools sets.

“There are very few existing SOCs that meet that volume today and, thus, DHS would significantly restrict potential bidders and their teams from bidding on this program if this remains as a mandatory requirement,” one responder wrote in a question-and-answer document on the IDIQ.

DHS plans to make a single award for the seven-year IDIQ contract for “NextGeneration” (NextGen) SOC services. Task orders would include detecting cyber threats and protecting the department’s information systems, such as wide area networks, Trusted Internet Connections (TIC), policy enforcement points (PEPs), security devices, servers, and workstations.

The IDIQ has six functional areas, such as program management and control, SOC operations services, service delivery management, architecture engineering, operations, and maintenance, cybersecurity communications and coordination, and lastly acquisition support.

The IDIQ will support only the DHS chief information security officer.

DHS anticipates making a contract award in the first half of fiscal 2016.

DHS released the revised standards April 8. It issued a draft solicitation in February.