Highly Adaptive Cybersecurity Services

About HACS

MAS Solicitation: IT Services — SIN 54151HACS

NAICS: 541519 — Other Computer Related Services

PSC: DJ01 — IT and Telecom — Security and Compliance Support Services (Labor)

Eligible users: Federal, state, local, and tribal governments

With Highly Adaptive Cybersecurity Services, or HACS, your agency can:

Expand capacity to test high-priority IT systems.
Quickly order and implement services from technically evaluated vendors.
Stop adversaries before they impact networks and rapidly address potential vulnerabilities.

HACS includes proactive and reactive cybersecurity services and supports government-wide priorities like Application Security Testing and Zero Trust Architecture.

HACS subgroups

HACS vendors are categorized under five subgroups for market research purposes:

Always check a contractor's GSA price list to verify and confirm availability of awarded products and services.

How do I buy HACS?

Agencies can order through eBuy and GSA Advantage and issue an RFI or RFQ to vendors using Special Item Number 54151HACS.

Combine SINs to meet your requirements or try a blanket purchase agreement to easily fill recurring needs. You can also set aside the requirement for one or more socio-economic categories including but not limited to small businesses, veteran-owned businesses, and women-owned businesses.

Need support or subject matter expertise? Reach our team at ITSecurityCM@gsa.gov.

HACS buying guide [DOCX - 79 KB] to aid in your acquisition
Market Research as a Service to research your options

Assisted Acquisition Services for cradle to grave support
Cooperative Purchasing for state, local, and tribal governments

HACS templates provide typical language for a cybersecurity solicitation, and material from these examples can be copied and pasted directly into sections 3.0 and 4.0 of the RFQ template.

How do I sell HACS?

MAS contract holder

Submit a modification to add a SIN in the eOffer/eMod portal.

Without a MAS contract

Follow the MAS Roadmap to prepare and send an offer.

Oral technical evaluation

Some vendors may require a HACS self-attestation [PDF - 103 KB] to apply for the HACS High Value Assessments subcategory.

All vendors must pass an oral technical evaluation before they can be awarded the HACS SIN:

Evaluation questions are not provided before the evaluation but we recommend that you (the offeror) review the MAS Solicitation IT Category Attachment, especially the Subcategory Instructions and Regulations, F03. IT Services Subcategory, SIN 54151HACS Highly Adaptive Cybersecurity Services, and Instructions sections.
When submitting your offer or mod, you'll need to name up to five key personnel (and their roles in your company) to field questions during your evaluation. Consultants are not allowed to participate.
A GSA MAS Contracting Officer must request oral technical evaluations for SIN 54151HACS from the HACS Program Management Office. The HACS PMO will contact the you to coordinate a date for the oral technical evaluation your requests is approved. GSA reserves the right to reschedule this date at the convenience of the Government; the offeror may also reschedule with reasonable notice.
You'll have 1 hour and 40 minutes for the base oral technical evaluation consisting of questions related to High Value Asset Assessments, Risk and Vulnerability Assessment, and Penetration Testing. You'll have 10 minutes for each additional subcategory (Incident Response and/or Cyber Hunt) you elect for consideration.
You'll be evaluated by our Technical Evaluation Board of three GSA IT Specialists. Within two business days after the evaluation, the TEB will send their results to the GSA CO, and the CO will send results to the offeror within one week.

You may not be subject to HACS oral technical evaluation if:

Your company was previously awarded all of the former SINS 132-45A Penetration Testing, 132-45B Incident Response, 132-45C, Cyber Hunt, 132-45D Risk and Vulnerability Assessment, and;
You provide a HACS self-attestation [PDF - 103 KB] acknowledging your ability to perform Security Architecture Review and Systems Security Engineering services in their entirety.