# CISA Plans Arlington CVD Support Contract

CISA is planning a **$20 million–$50 million** follow-on contract for analytic and operational support to its Coordinated Vulnerability Disclosure program, with work planned in Arlington, Virginia. The opportunity is expected to be a small-business set-aside competed through the GSA Schedule; the solicitation is expected May 30, 2027, and award is anticipated in Q4 FY2027. Tharros is the incumbent. Interested firms should assess GSA Schedule eligibility and their ability to support vulnerability analysis, disclosure, and secure-by-design activities.

- The planned set-aside and GSA Schedule competition make schedule eligibility and small-business status central considerations for prospective bidders.
- Companies can use the lead time before the expected solicitation to evaluate their capabilities across the stated technical and operational work areas.
- Tharros’s incumbent position provides market context for firms assessing the follow-on opportunity and potential teaming or competitive strategies.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity, Contracting Vehicles
**Published:** October 27, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)
- General Services Administration (GSA)
- Department of Homeland Security (DHS)

### Vendors
- Tharros (incumbent)

### Sources
- [CISA Eyes Follow-On Vulnerability Disclosure Contract](https://www.executivebiz.com/articles/cisa-follow-on-cvd-vulnerability-disclosure-contract) - ExecutiveBiz