Cybersecurity Procurement Updates

Cybersec Investments has appointed Stacy Bostjanick, former Pentagon CMMC program director, as Vice President of Government Services Strategy to lead a new division focused on delivering cybersecurity services to federal customers. This strategic hire aligns with the ongoing phased implementation of the Cybersecurity Maturity Model Certification (CMMC) 2.0 program, which mandates enhanced cybersecurity compliance for defense contractors over the next three years. Procurement professionals and contractors in the defense industrial base should note the growing demand for cybersecurity services driven by these regulatory requirements, creating significant contracting opportunities.

• Why this matters: The CMMC 2.0 program requires defense contractors to meet specific cybersecurity standards, increasing the need for specialized cybersecurity service providers.
• Cybersec Investments’ leadership expansion signals intensified competition and investment in federal cybersecurity contracting.
• Contractors should evaluate their compliance status and consider partnerships or services that support CMMC 2.0 adherence.
• Agencies and contractors in Maryland, including locations like White Oak, may see increased cybersecurity service procurements tied to defense and intelligence activities.

Federal agencies are intensifying efforts to modernize cybersecurity operations and integrate artificial intelligence (AI) as core competencies across the federal workforce. Federal CIO Greg Barbaccia has emphasized the government's unified approach to AI adoption, aiming to enhance mission effectiveness, reduce duplication, and improve operational security. Key government and industry leaders, including representatives from DISA, US Marine Corps, and Optiv + ClearShark, highlighted priorities such as real-time cyber defense, identity management, and workforce technical skill development during recent federal cybersecurity summits and forums.

• Federal procurement professionals should anticipate increased demand for AI-enabled cybersecurity solutions, identity and access management technologies, and workforce training services.
• Vendors specializing in AI integration, cyber risk detection, and managed security services have opportunities to support agencies aligning with the Federal Cybersecurity Strategy and Chief AI Council initiatives.
• Agencies are prioritizing platforms that enable unified visibility and rapid response to cyber threats, indicating a shift toward flexible, standardized cybersecurity architectures.
• Contractors offering technical training and AI competency development can expect growing federal requirements as AI and tech skills become mandatory for federal employees.

The U.S. Army has awarded multiple contracts under the Next-Gen Commercial Operations in Defended Enclaves (NCODE) Indefinite Delivery, Indefinite Quantity (IDIQ) vehicle to eight companies, including Exostar and Summit 7, to support a five-year, $49 million pilot program starting May 15, 2026. This initiative aims to enhance cybersecurity compliance for small businesses within the Defense Industrial Base by helping them meet NIST SP 800-171 and CMMC requirements. The program pairs small suppliers with Verified External Service Providers (VESPs) to facilitate secure cloud-based environments and cybersecurity controls, thereby improving their eligibility for Department of Defense contracts and strengthening mission readiness across multiple military branches.

• The NCODE program focuses on small businesses with 2-10 employees in the Defense Industrial Base, supporting up to 1,000 organizations initially with plans to expand to thousands more.
• Procurement professionals should note the involvement of the U.S. Army Contracting Command at Aberdeen Proving Ground as the managing authority for this IDIQ contract vehicle.
• Vendors specializing in cybersecurity compliance solutions and secure enclave technologies have new opportunities to engage as prime contractors or service providers under this program.
• The $49 million budget over five years signals sustained investment in cybersecurity support for defense suppliers, emphasizing the importance of compliance with NIST and CMMC standards for DoD contract eligibility.

Federal agencies are accelerating efforts to modernize legacy IT systems and cybersecurity operations to support AI-driven missions and counter evolving cyber threats. Industry leaders from Lumen, Cisco Systems, and NinjaOne emphasize the need for faster, more secure, and resilient infrastructure that integrates AI-ready connectivity and continuous cyber risk visibility. Procurement professionals should prioritize investments in AI-capable infrastructure, advanced cybersecurity tools, and process modernization to meet federal mission demands and compliance requirements.

• Federal agencies require modernization strategies addressing technical debt, cybersecurity vulnerabilities, and scalable AI infrastructure to enable next-generation federal AI innovation.
• Cybersecurity modernization focuses on unified visibility, rapid risk detection, and operational process re-engineering to enhance resilience against sophisticated threats.
• Procurement must consider evolving SaaS licensing models influenced by AI workloads and urgent patching needs for software vulnerabilities such as cPanel.
• Strategic partnerships with technology providers like Carahsoft, Lumen, and Cisco are critical for delivering integrated solutions supporting federal IT modernization and AI adoption.

Recent cybersecurity incidents involving insider threats at federal contractor Opexus and active exploitation of U.S. internet infrastructure by foreign intelligence highlight critical vulnerabilities in government and civilian networks. These developments underscore the urgent need for federal agencies and contractors to enhance cybersecurity measures, particularly around privileged access management, cloud infrastructure protection, and AI-driven threat mitigation. Procurement professionals should prioritize sourcing advanced cybersecurity solutions that address insider risks, credential theft, and hardware vulnerabilities to safeguard national security and critical infrastructure.

• Federal contractors must evaluate and strengthen controls against insider threats, including monitoring privileged user activities and implementing zero-trust architectures.
• Agencies should consider investments in AI-enabled cybersecurity tools to detect and respond to emerging threats, including ransomware and espionage targeting civilian infrastructure.
• Procurement strategies should incorporate requirements for hardware security upgrades, especially for network devices vulnerable to foreign intelligence exploitation.
• Organizations supporting federal cybersecurity efforts may find increased demand for comprehensive risk assessments, incident response services, and secure cloud migration solutions.

The Environmental Protection Agency's Office of Inspector General (EPA OIG) has reported significant cybersecurity vulnerabilities and data management challenges affecting critical systems, including the Central Data Exchange portal and the management of over 41,500 terabytes of environmental data. These findings underscore the need for enhanced data governance, improved contract and grant oversight, and the development of AI governance frameworks to safeguard data integrity amid ongoing modernization efforts and workforce reductions.

• EPA's identification of cybersecurity and data risks signals upcoming procurement opportunities for contractors specializing in cybersecurity, data management, and IT modernization services.
• Procurement professionals should prepare for potential solicitations focused on strengthening EPA's data security infrastructure and governance capabilities.
• Contractors with expertise in AI governance and environmental data systems may find strategic opportunities to support EPA's modernization initiatives.
• This situation highlights the importance of robust contract oversight and compliance monitoring to address identified vulnerabilities effectively.

The General Services Administration (GSA) has established two new OneGov agreements with Broadcom and Cohesity to provide federal agencies with substantial discounts on advanced AI platforms, VMware enterprise software, and cybersecurity data protection tools. These agreements, effective through 2027, support federal IT modernization and cybersecurity resilience by streamlining procurement under the GSA Multiple Award Schedule (MAS) and offering discounts up to 72.25%. This initiative aligns with GSA's strategy to reduce government costs and simplify acquisition processes while equipping agencies with cutting-edge technology solutions.

• The Broadcom agreement offers up to 64% discounts on VMware enterprise software, including AI and cybersecurity tools, available through May 2027.
• The Cohesity agreement provides significant discounts on data protection and replication software, with savings up to 72.25%, available through September 30, 2027.
• Procurement professionals should leverage these agreements to access commercial-grade AI and cybersecurity capabilities at reduced costs, supporting federal IT modernization and cyber resilience goals.
• These streamlined OneGov contracts reduce acquisition complexity and promote taxpayer savings, making them critical vehicles for agencies seeking advanced software solutions.
• Vendors and contractors should consider these agreements when planning federal market strategies, as they represent prioritized pathways for delivering innovative IT and cybersecurity products to government customers.

NIST has issued a draft revision of NISTIR 8323 Rev. 2 to update its Positioning, Navigation, and Timing (PNT) cybersecurity profile in alignment with the NIST Cybersecurity Framework 2.0. This update addresses emerging risks including GPS disruptions, AI-related threats, and supply chain vulnerabilities affecting PNT services critical to infrastructure and government operations. The public comment period is open until July 6, 2026, providing an opportunity for stakeholders to influence the final guidance.

• Why this matters: Federal agencies and contractors relying on PNT services must consider these updated cybersecurity risk management practices to enhance operational resilience.
• Organizations involved in critical infrastructure procurement should evaluate their compliance with the revised profile to mitigate GPS and AI-driven threats.
• The revision signals increased emphasis on governance and supply chain security, impacting vendor selection and contract requirements.
• Procurement professionals can leverage this guidance to update cybersecurity clauses and risk assessments in upcoming solicitations and contracts.

Government agencies recognize that investing solely in advanced cybersecurity tools is insufficient to achieve comprehensive protection. Recent insights emphasize the critical role of behavioral science in addressing human factors, encouraging procurement professionals to consider solutions that foster a culture of trust and employee engagement. This approach moves beyond traditional compliance training to create environments where secure practices are naturally adopted, highlighting a strategic shift in cybersecurity procurement priorities.

• Procurement teams should evaluate cybersecurity offerings that incorporate behavioral analytics and user-centric design to enhance effectiveness.
• Vendors providing integrated solutions combining technology with behavioral insights may find increased demand.
• Agencies may revise cybersecurity requirements to include cultural and behavioral components, impacting contract scopes and evaluation criteria.
• Organizations should consider training and change management services that support secure user behavior as complementary to technical controls.

The Nuclear Regulatory Commission (NRC) has issued a solicitation for a small business contractor to develop a cybersecurity framework focused on artificial intelligence (AI) and machine learning (ML) applications in operating and advanced nuclear reactors. This contract, valued at up to $250,000, aims to evaluate AI-related cybersecurity risks and identify regulatory gaps to support NRC's development of updated guidance for nuclear plant safety and security.

• Why this matters: This contract signals NRC's proactive approach to addressing emerging cybersecurity challenges posed by AI/ML technologies in nuclear energy operations.
• Procurement professionals should note the focus on small business participation and the specialized nature of cybersecurity research in the nuclear sector.
• Contractors with expertise in AI cybersecurity, nuclear regulatory environments, and risk assessment may find strategic opportunities to engage with NRC's evolving regulatory framework.
• This initiative reflects broader government interest in securing critical infrastructure against AI-driven vulnerabilities, influencing future procurement priorities in energy and cybersecurity domains.