Sample proposal · built with ContractForge

Enterprise Cybersecurity Operations Support (ECOS)

Department of Homeland Security — CISA70RDAD-26-R-DEMO01NAICS 541512Total Small BusinessDue Nov 13, 2026
Open your dashboard

Everything here is fictitious sample data for Meridian Federal Solutions, a made-up small business. It was produced by the same Agent Q workflow every customer uses; nothing was hand-written for the demo.

Step 1 of 8

Assess

Score the opportunity and make the bid / no-bid call.

78

Opportunity score

Bid Solo

Why Agent Q recommends this

Direct-mission match to Meridian's active DHS CISA cyber ops/RMF prime contract, small-business set-aside under a NAICS we hold, and a best-value tradeoff structure where our CISA past performance and mission fluency are decisive. Primary execution risk is TS-cleared NCR staffing and the 60-day transition-in — manageable with a cleared-staffing teaming partner and a disciplined transition plan.

Strengths

Direct incumbent-adjacent past performance at CISA (Cybersecurity Operations & RMF Support, $6.8M prime, Arlington, Secret) that mirrors PWS scope. Small business qualified under NAICS 541512 with Total Small Business set-aside eligibility. CMMI-DEV Level 3 and ISO 9001:2015 appraisals support the quality-control and Section 508/RMF process narrative. HQ in Reston, VA is inside the NCR, near the CISA SOC in Arlington. Additional relevant primes at VA (ITSM), USACE (network O&M at scale), and USDA (cloud/DevSecOps) demonstrate multi-domain federal delivery.

Weaknesses

No verified Facility Clearance level on file — Secret FCL is a hard gate and must be confirmed. Company size (25–50) means the 22–26 FTE base-year footprint plus surge is a significant fraction of the workforce; bench depth for four TS-cleared Key Personnel and TS-cleared Tier 2/3 SOC and hunt staff is not yet substantiated. No prior work explicitly cites 24x7 SOC operations or Splunk ES/SOAR + CrowdStrike + Tenable + Xacta toolchain experience. No demonstrated SOAR automation metrics history to anchor the 30% manual-effort-reduction commitment.

Opportunities

Same-customer recompete dynamic: mission fluency, evaluator familiarity, and a Substantial Confidence past-performance ceiling. Tradeoff evaluation with non-price factors significantly more important than price rewards strong technical differentiation over lowest bid. Clear, measurable government objectives (MTTD ≤ 1 hr, MTTC ≤ 4 hr, zero ATO lapses, 30% automation gain) let us build quantitative win themes. 40% remote allowance on non-SOC tasks reduces NCR labor cost pressure. Only three PP references allowed — we can choose our three strongest and control the narrative.

Threats

TS-cleared NCR analyst market is tight; incumbent likely to lock in retention offers before transition. A 60-day transition-in with FOC including 24x7 TS-cleared coverage is aggressive — miss it and the CO can issue a cure notice. FAR 52.219-14 (50% self-performance) constrains how much we can lean on a staffing sub. Incumbent has embedded knowledge of 38 authorizations and SOAR content; they will bid Substantial Confidence PP too. Unrealistically low price can be scored down or found unrealistic under FAR 15.404-1, but non-price still dominates, so a pure low-price play by others is unlikely to win — the threat is a strong incumbent, not a low bidder.

Best-matched past performance

  • Cybersecurity Operations & RMF Support56% match
  • Network Infrastructure Operations & Maintenance49% match
  • Enterprise ITSM Modernization45% match

Assessment narrative

ECOS is a $14.5–17.5M, 5-year FFP recompete of DHS CISA OCIO's enterprise cyber operations — 24x7 SOC, incident response, threat hunting, vulnerability management, RMF/ISSO support for 38 authorized systems, and SOAR automation — on-site at Arlington, VA. It is a 100% small-business set-aside under NAICS 541512 ($34M size standard), which Meridian holds as a small business. The evaluation is a FAR 15.101-1 tradeoff with Technical > Management > Past Performance, and non-price combined significantly more important than price. Meridian's active $6.8M CISA Cybersecurity Operations & RMF Support prime contract is a near-mirror of this scope with the same customer, giving us Substantial Confidence potential in Factor 3 and credible mission fluency in Factors 1 and 2. Key gates are a Secret facility clearance, four Key Personnel with PMP/CISSP/GCIH/CAP credentials at Secret–TS levels, TS-cleared SOC Tier 2/3 and hunt staff, and full operational capability within 60 days of award. Recommend a solo prime bid, with a TS-cleared staffing subcontractor identified for surge and clearance depth.