U.S. Secret Service Enterprise Cybersecurity Services (ECS)
Department of Homeland Security, U.S. Secret Service, Office of the Chief Information Officer. A protected, mission-critical cybersecurity support requirement whose incumbent has changed shape since award and whose acquisition route was reset in 2026. Prepared for a small business cybersecurity services firm evaluating a prime or subcontract role.
Brief date: 6 September 2026Opportunity ID 246883 · SAM RFI1821352
Sample brief
Prepare now. Pursue as prime if the set-aside holds; otherwise team to a GSA HACS prime.
This is a real follow-on competition with a real opening. The 2021 award was an SDVOSB set-aside won by Favor TechConsulting, a firm that was acquired by a private-equity-backed platform three months after award and now operates as Tria Federal, a mid-market company. If the U.S. Secret Service repeats a small business or SDVOSB set-aside on the GSA Schedule, the incumbent's ability to prime depends on how it represents size on its MAS contract, and that is a question worth resolving before any other capture investment.
The agency has told industry the essentials: the work is critical, the competition is in process, award is planned for Q2 FY27, and the justification describes bridge options through August 2027. Those options do not establish that both were exercised. Prepare against the estimated December release while confirming the acquisition schedule.
- Supported findingThe agency justification describes the follow-on competition. See JEFO FY26-70, page 2.
- Watch itemAcquisition strategy was forced to change late when the intended IDIQ sunset. Expect a compressed RFQ cycle once released; the 2021 procurement ran about two months from solicitation to award.
- Open questionWhether the HACS RFQ will be set aside, and under which designation. This single answer changes the pursuit from prime to teaming.
Where the procurement stands, and what is estimate versus record
- Sep 2021Incumbent awardCIO-SP3 SB, SDVOSB set-aside, 3 offers, 2 protests (GAO decision Dec 2021)
- Aug 2025Final option exercisedTask order expiration set for 20 Aug 2026
- 3 to 10 Jul 2026Draft SOW and RFIReleased on GSA eBuy under HACS SIN; seven-day response window
- 27 Aug 2026J&A publishedJustification describes two 6-month bridge options through 20 Aug 2027; exercise status requires confirmation
- Dec 2026 (est.)RFQ releaseAnalyst estimate. Agency has not published a date.
- Jan to Mar 2027AwardAgency states Q2 FY27 in the J&A; transition schedule requires confirmation
What the U.S. Secret Service is buying, in the agency's own terms
The ECS task order provides network operations and security support across the U.S. Secret Service enterprise, including support to the Office of the CISO, which oversees cybersecurity for more than 25 FISMA systems. The J&A lists six service areas and calls the work "critical to maintaining the health and security of the U.S. Secret Service enterprise network." The incumbent duration was one base year plus four options; expect the same shape.
Two details matter for positioning. First, the agency describes a "significant learning curve" and names recruiting, background checks, and knowledge transfer as the reasons a short-notice transition would fail. Any offeror must show a credible transition plan with cleared, available staff. Second, the July RFI went out under the HACS SIN, which means the agency is thinking in HACS subgroups; map your capability to those subgroups before the RFQ tells you to.
- Program management and BPRSupport model across the U.S. Secret Service service portfolio
- Application developmentSecurity-relevant development and sustainment
- Security compliance servicesFISMA, DHS and U.S. Secret Service policy alignment
- Assessment and authorization (A&A)A&A across 25+ FISMA systems
- Security testingMaps to HACS penetration testing and RVA subgroups
- ICAMIdentity, credential and access management
What the record supports on size
- FY21
- $4.1M
- FY22
- $6.3M
- FY23
- $6.6M
- FY24
- $8.4M
- FY25
- $3.4M
- FY26 (partial)
- $2.2M
Reported obligations by fiscal year. Four years of growth to an $8.4M peak in FY24, then a sharp drop in FY25 and FY26. The drop most likely reflects reporting lag and the final option's timing rather than a shrinking requirement, but it is an open question to test with the contracting office.
The supplied opportunity record reports task-order values of $28.8M at award and $33.2M in its August 2026 update. Confirm the current value and modification history before relying on the increase. The analyst follow-on estimate of $33.2M simply mirrors the incumbent; treat the real range as $28M to $40M over five years depending on how far the HACS scope expands.
The incumbent is not the company that won the award
Favor TechConsulting won ECS in September 2021 as a service-disabled veteran-owned small business. In December 2021 it was acquired by Sagewind Capital's Federal Advisory Partners platform, and in March 2023 that platform rebranded as Tria Federal, which now describes itself as a middle-market IT and advisory firm. FTC remains a wholly-owned subsidiary and is still the legal task order holder, which is why the J&A names FavorTech.
The J&A is explicit that market research for the follow-on found capable contractors on multiple DHS strategic sourcing vehicles, and that the sole-source extension exists only because the competition was delayed by two shutdowns and by the sunset of the IDIQ originally chosen. This supports evaluating alternative suppliers for the follow-on; it does not establish how the final competition will be structured.
- Incumbent strengthsFive years on the enterprise, "extensive program knowledge," cleared staff in place, and the agency's stated fear of a bad transition. Expect Tria to compete hard for the follow-on as prime or through a small business affiliate.
- Incumbent exposureSize status. Tria's growth and PE ownership put SDVOSB and small business eligibility in doubt for a new set-aside on MAS. Verify FTC's current SAM and eLibrary representations before assuming either outcome.
- Contracting officeU.S. Secret Service Office of Procurement; Division Chief, Contracting Officer, and Contract Specialist identified. Prior protest history (two protests in 2021) suggests a careful, documented source selection.
SDVOSB firms already performing IT work at the Department of Justice
If the U.S. Secret Service sets the RFQ aside for service-disabled veteran-owned firms, the most credible competitors are SDVOSBs that already run IT and cybersecurity task orders inside a law enforcement department. The Department of Justice ITSS-5 vehicle created exactly that pool, and its final order date of 30 September 2027 means these primes will be looking for their next set-aside home at the same time this RFQ lands.
Contract values and dates are as publicly reported at award; current status, ceilings and size certifications should be verified in SAM, FPDS and SBA VetCert before the Capture Brief is finalized. The incumbent, Tria Federal, is assessed in the previous section.
Non-SDVOSB firms with current IT contracts at the U.S. Secret Service or the Department of Justice
Whether you prime or sub, the partner that closes the transition gap is one that already holds a badge, a clearance pipeline and a working relationship with the customer. The firms below are not service-disabled veteran-owned, so they cannot prime an SDVOSB set-aside, which makes them natural subcontractors to an SDVOSB prime or, if the RFQ is unrestricted, GSA HACS primes worth approaching for workshare.
- Outreach logicOpen with Valiant and Intellect first: both are small, both are inside the agency, and both gain from a set-aside prime they cannot pursue alone. Use ASRC Federal Technology Solutions as the A&A backstop if your own evidence is thin.
- Open questionWhich of these firms already hold the GSA HACS SIN. A partner on HACS can carry you if the RFQ is unrestricted; one without it can only follow you.
Company facts are as publicly reported at award. Size, socio-economic status and HACS SIN status change; verify in SAM and GSA eLibrary before outreach.
The capability evidence this pursuit will test
| Requirement signal | Evidence a competitive offeror needs | Question for your team |
|---|---|---|
| HACS SIN and subgroups | MAS contract with 54151HACS awarded; listed in the subgroups the RFQ names (likely RVA, penetration testing, incident response, and cyber hunt) | Do you hold the required HACS SIN? If not, confirm whether it can be added within the procurement timeline and assess teaming options. |
| Federal A&A at scale | Past performance managing compliance for a portfolio of 20 or more FISMA systems at a federal agency, ideally DHS | Which contract can you cite with system counts, ATO throughput, and a CPARS? |
| Law enforcement or protective mission context | Work inside DHS components, DOJ, or similar environments with sensitive but unclassified and classified enclaves | Do you hold a facility clearance, and can you name staff with active clearances today? |
| Transition under time pressure | A documented 30-to-60-day transition with incumbent capture, background investigation lead times, and knowledge transfer | Have you transitioned a cyber operations contract from an incumbent? What was the retention rate? |
| Size and socio-economic status | Small under $34M / 150 employees for 541519; SDVOSB if the set-aside repeats | Confirm your representation in SAM and on your MAS contract, and any affiliation risk. |
| ICAM and application security | Identity management and secure development experience in a federal enterprise | Is this a gap to fill with a partner, or evidence you already hold? |
Prepare, with a prime path and a teaming path kept open until the set-aside is known
Why this is not a Go/No-Go score. A score would hide the one fact that decides the pursuit. The decision tree is short: set-aside status determines prime versus sub; HACS status determines whether prime is even available; A&A and transition evidence determine whether you can win it. Resolve the first two in September, and the third becomes the capture plan.
The agency has been unusually transparent about its situation. Firms that read the J&A carefully and bring a transition-first story will be speaking the contracting office's language.
What your team does this month
- Ask the contracting office two questionsSet-aside intent for the HACS RFQ, and whether the December estimate is realistic given Q2 FY27 award. Use the RFI as the reason for the call.
- Verify the incumbent's current size representationSAM, GSA eLibrary HACS listing, and any SDVOSB certification record. Record the verification date and the implications for your prime or subcontract position.
- Score yourself against the six evidence rows aboveName the contract, the CPARS, and the person for each. Gaps become teaming criteria, not talking points.
- Open two teaming conversationsOne GSA HACS prime candidate in case the path is subcontract, one testing or DHS-experienced partner in case you prime. Both should be underway before the RFQ.
- Draft the transition narrative nowStaffing, clearances, incumbent capture, and knowledge transfer timeline. Treat transition as a capture priority, and confirm how the final solicitation evaluates it.
Want this analysis applied to your pipeline?
Start with a consultation about your company’s capabilities and one opportunity you are considering.
Request your opportunity brief →What this brief rests on
- U.S. Secret Service JEFO FY26-70, page 2 (PDF, opens in a new tab). Approved 9 Aug 2026, posted 27 Aug 2026. See the scope, continuity rationale, and award target; confirm option exercise separately.
- Opportunity record 246883, last updated 27 Aug 2026: milestones, spending, contracts, interested vendors, analyst updates.
- GSA eBuy RFI and draft SOW under SIN 54151HACS, 3 Jul 2026 (referenced; document not reproduced).
- Tria Federal press and acquisitions page; PR Newswire, 28 Mar 2023; OrangeSlices AI on the FTC acquisition. triafed.com
- GSA HACS program guidance and buyer's guide, Jan 2025. gsa.gov
- GAO decision B-420174 / B-420174.2 (opens in a new tab), December 2021, for the prior competition. Prior solicitation documents are referenced in the opportunity record.
- Contract award records for the SDVOSB competitors and teaming candidates listed, as publicly reported at award (FPDS and USAspending).
- SBA size standard for NAICS 541519.
Estimates are labeled where they appear. Analyst dates and values are estimates, not agency statements.
Pathfinder combines experienced capture practitioners with AI-supported research. This sample brief is an excerpt for illustration on gov-logic.com. A Capture Brief is prepared against the client's own capabilities and evidence and delivers all nine Pathfinder components in full.
bd@gov-logic.com