# Vulnerability Disclosure Program Enterprise Management System (VDP EMS)

Canonical: https://abierto.us/opportunities/fa701425x000x

- Solicitation number: FA701425X000X
- Notice type: Sources sought
- Status: Closed. Deadline was July 18, 2025 at 2:00 PM EDT
- Department: Department of the Air Force
- Agency: Department of the Air Force
- Contracting office: FA7014 Afdw PK (FA7014)
- NAICS: 541519 Other Computer Related Services
- Product or service code: 7A21 Business Application off-the-shelf software delivered by perpetual license, which also encompasses enterprise level software enabling mission capability and business operational support.
- Place of performance: Linthicum Heights, Maryland
- First posted: July 3, 2025
- Last posted: July 24, 2025
- SAM.gov: https://sam.gov/workspace/contract/opp/371b62b8f6d44b3ea84ad642a77616cb/view

## Description

During the RFI phase of this requirement, two questions were received. The questions and answers are provided below. Please review the Q&A and keep them in mind when the official solicitation is published. This RFI has NOT been extended further.

**Question 1:** Is the Government specifically seeking vendors who can provide a proprietary, crowdsourced VDP platform license (e.g., HackerOne, Bugcrowd), or will you also consider integrators who can deliver compliance, security automation, and Microsoft Sentinel-based triage/reporting workflows in partnership with a platform provider? DC3 is directly seeking a proprietary, crowdsourced VDP platform license; Hackerone, BugCrowd, SynAck. Anything outside of this would impact mission success.

**Question 2:** Can you clarify the “250 crowdsourced vulnerability - bug tag and annual mailings”? Understand the concept here is that we would be responsible for the logistics and shipping of any DC3 provided items used to recognize researchers. This would be in regard to delivering “swag” (inexpensive tangible goods like stickers, coins, t-shirts) to the researcher community. Specifically, DC3 disseminates “swag” for things such as “hacker of the month” or “hacker of the year.” The vendor will be responsible for distributing the “swag” on DC3’s behalf (verifying mailing addresses, packaging swag, paying for the shipping, getting the swag to the shipper, etc). End Questions and Answers

The Department of Defense Cyber Crime Center (DC3) is conducting market research for an enterprise management system to support its Vulnerability Disclosure Program (VDP) and Defense Industrial Base (DIB) VDP. The system shall facilitate collaboration, compliance, and management of the VDPs. Key requirements include:

Enterprise-grade VDP platform license/subscription for two instances (DoD VDP and DIB VDP). Vulnerability submission and management workflows. Integration, via API, with DC3's Atlassian Jira-based Vulnerability Report Management Network (VRMN) systems. Mediation support for researcher inquiries. Tools and processes for effective vulnerability triage and resolution (e.g., CVSS scoring). Advanced analytics and custom reporting capabilities. Dedicated account team with customer support and customer success functions.

Interested vendors are encouraged to review the attached draft Performance Work Statement (PWS) for detailed requirements and provide feedback on the PWS. 7/14/2025 - Amended solicitation to extend response due date to 18 Jul 2025.

## Publications

- July 3, 2025: Sources sought, due July 10, 2025 at 2:00 PM EDT. Notice 4b284fa106f04cb4840675eb4d3cd9bd. https://sam.gov/workspace/contract/opp/4b284fa106f04cb4840675eb4d3cd9bd/view
- July 15, 2025: Sources sought, due July 18, 2025 at 2:00 PM EDT. Notice 21a7e7c038e141d692078b4ea945d78e. https://sam.gov/workspace/contract/opp/21a7e7c038e141d692078b4ea945d78e/view
- July 24, 2025: Sources sought, due July 18, 2025 at 2:00 PM EDT. Notice 371b62b8f6d44b3ea84ad642a77616cb. https://sam.gov/workspace/contract/opp/371b62b8f6d44b3ea84ad642a77616cb/view

## Points of contact

- Phelicha Silva, phelicha.silva@us.af.mil
- Ryan Amos, ryan.amos.5.ctr@us.af.mil

---
Source: SAM.gov Contract Opportunities bulk extract. Confirm deadlines on SAM.gov before responding. Cite https://abierto.us/opportunities/fa701425x000x.