DoD's $18M contract for application security and WAF services awarded to Scientific Research Corporation

Contract Overview

Contract Amount: $18,020,234 ($18.0M)

Contractor: Scientific Research Corporation

Awarding Agency: Department of Defense

Start Date: 2021-06-24

End Date: 2026-06-23

Contract Duration: 1,825 days

Daily Burn Rate: $9.9K/day

Competition Type: FULL AND OPEN COMPETITION

Number of Offers Received: 1

Pricing Type: COST PLUS FIXED FEE

Sector: IT

Official Description: APPLICATION SECURITY MANAGER, WEB APPLICATION FIREWALL AND NETWORKING SUPPORT SERVICES

Place of Performance

Location: QUANTICO, PRINCE WILLIAM County, VIRGINIA, 22134

State: Virginia Government Spending

Plain-Language Summary

Department of Defense obligated $18.0 million to SCIENTIFIC RESEARCH CORPORATION for work described as: APPLICATION SECURITY MANAGER, WEB APPLICATION FIREWALL AND NETWORKING SUPPORT SERVICES Key points: 1. Contract provides critical application security and web application firewall (WAF) services, essential for protecting naval systems. 2. The contract was awarded under full and open competition, suggesting a competitive bidding process. 3. The duration of the contract (5 years) indicates a long-term need for these specialized services. 4. The cost-plus-fixed-fee (CPFF) contract type allows for flexibility but requires careful oversight of costs. 5. The contract's value of approximately $18 million over five years suggests a significant investment in cybersecurity infrastructure. 6. The North American Industry Classification System (NAICS) code 541330 points to engineering services, aligning with the technical nature of the requirement.

Value Assessment

Rating: good

The contract value of $18 million over five years for application security and WAF services appears reasonable given the critical nature of cybersecurity for the Department of the Navy. Benchmarking against similar contracts for specialized cybersecurity support indicates that pricing within this range is typical for comprehensive solutions. The CPFF structure necessitates diligent monitoring to ensure costs remain aligned with the fixed fee and the value delivered.

Cost Per Unit: N/A

Competition Analysis

Competition Level: full-and-open

This contract was awarded under full and open competition, meaning all responsible sources were permitted to submit bids. The specific number of bidders is not provided, but this procurement method generally fosters a competitive environment, which can lead to better pricing and service offerings for the government. The open competition suggests that the Department of the Navy sought the best value from a wide range of potential contractors.

Taxpayer Impact: Full and open competition is beneficial for taxpayers as it maximizes the potential for cost savings through robust bidding and encourages contractors to offer competitive pricing to win the award.

Public Impact

The Department of the Navy benefits from enhanced application security and network protection, safeguarding sensitive data and operational capabilities. Services delivered include web application firewall management and networking support, crucial for maintaining system integrity. The geographic impact is primarily within the Department of the Navy's operational areas, supporting its global mission. Workforce implications may include the need for specialized cybersecurity personnel within the contractor organization and potential training for government personnel interacting with the systems.

Waste & Efficiency Indicators

Waste Risk Score: 50 / 10

Warning Flags

Cost-plus-fixed-fee contracts can sometimes lead to cost overruns if not managed meticulously.
Lack of specific bidder count makes it difficult to fully assess the intensity of competition.
The duration of the contract (5 years) requires ongoing performance monitoring to ensure sustained value.

Positive Signals

Awarded under full and open competition, indicating a broad search for qualified vendors.
Focus on critical application security and WAF services addresses a key defense need.
The contract is with a single entity, potentially allowing for streamlined management and expertise consolidation.

Sector Analysis

The cybersecurity market is a rapidly growing sector within the broader IT services industry, driven by increasing digital threats and the need for robust defense mechanisms. This contract fits within the specialized segment of application security and network protection services. Comparable spending benchmarks in this area are difficult to pinpoint without more specific service details, but government spending on cybersecurity solutions has been consistently high and is projected to increase.

Small Business Impact

The contract was awarded under full and open competition and does not indicate any specific small business set-aside. Therefore, the direct impact on small businesses through this prime contract is likely minimal. However, the prime contractor, Scientific Research Corporation, may engage small businesses for subcontracting opportunities, depending on the specific service requirements and their internal subcontracting plans. Further analysis of subcontracting reports would be needed to assess the extent of small business participation.

Oversight & Accountability

Oversight for this contract will likely be managed by the Department of the Navy's contracting officers and program managers. Accountability measures are inherent in the CPFF structure, requiring the contractor to justify costs against the fixed fee. Transparency is facilitated through contract reporting requirements and potential audits. Inspector General jurisdiction would apply in cases of suspected fraud, waste, or abuse.

Related Government Programs

Department of Defense Cybersecurity Services
Naval Information Warfare Systems Command Contracts
Application Security Solutions
Web Application Firewall Services
IT Engineering Services

Risk Flags

Cost-Plus-Fixed-Fee contract type requires diligent oversight to manage costs.
Long-term contract duration necessitates continuous performance monitoring.
Specific number of bidders not disclosed, limiting full assessment of competition intensity.

Frequently Asked Questions

What is this federal contract paying for?

Department of Defense awarded $18.0 million to SCIENTIFIC RESEARCH CORPORATION. APPLICATION SECURITY MANAGER, WEB APPLICATION FIREWALL AND NETWORKING SUPPORT SERVICES

Who is the contractor on this award?

The obligated recipient is SCIENTIFIC RESEARCH CORPORATION.

Which agency awarded this contract?

Awarding agency: Department of Defense (Department of the Navy).

What is the total obligated amount?

The obligated amount is $18.0 million.

What is the period of performance?

Start: 2021-06-24. End: 2026-06-23.

What is the track record of Scientific Research Corporation in delivering similar application security and networking support services to the federal government?

Scientific Research Corporation (SRC) has a history of performing complex technical services for the U.S. government, including within the Department of Defense. While specific details on their past performance for application security and WAF services under similar contract vehicles are not detailed in the provided data, SRC's general profile suggests experience in areas like systems engineering, software development, and command and control systems. To fully assess their track record for this specific requirement, a review of their past performance evaluations, contract awards in related cybersecurity domains, and any reported issues or successes on previous DoD contracts would be necessary. Their ability to secure and maintain this significant contract indicates a level of trust and demonstrated capability by the Department of the Navy.

How does the estimated value of this contract compare to similar cybersecurity support contracts awarded by the Department of the Navy or other federal agencies?

The estimated value of approximately $18 million over five years for application security and WAF services places this contract in the mid-range for specialized IT support within the federal government. Similar contracts for comprehensive cybersecurity solutions, including network defense, application security testing, and managed firewall services, can range from a few million to tens of millions of dollars annually, depending on the scope, duration, and complexity. For instance, larger enterprise-wide cybersecurity contracts might exceed hundreds of millions. Given the specific focus on application security and WAF for a particular agency (Department of the Navy), this $18M figure appears to be a reasonable investment for dedicated, long-term support, reflecting market rates for such critical services.

What are the primary risks associated with a Cost Plus Fixed Fee (CPFF) contract for cybersecurity services, and how might they be mitigated?

The primary risk with a CPFF contract for cybersecurity services is the potential for cost overruns if the contractor's actual costs exceed initial estimates, although the fixed fee provides a ceiling on the profit. This structure can incentivize contractors to incur costs to maximize their return, especially if the 'cost' component is not rigorously monitored. Mitigation strategies include robust government oversight, detailed cost tracking and auditing, clear definition of work requirements, and strong performance metrics. The government must actively manage the contract, ensuring that all incurred costs are reasonable, allocable, and necessary for performing the work defined in the contract. Regular reviews and milestone-based payments can also help manage risk.

What is the expected effectiveness of the application security and WAF services in enhancing the Department of the Navy's overall cybersecurity posture?

Application security and Web Application Firewall (WAF) services are fundamental components of a robust cybersecurity posture. Application security focuses on identifying and mitigating vulnerabilities within software before and during deployment, preventing exploits targeting application logic. WAFs act as a shield, filtering, monitoring, and blocking malicious HTTP/S traffic to and from a web application, protecting against common attacks like SQL injection and cross-site scripting. When effectively implemented and managed, these services significantly reduce the attack surface, prevent data breaches, and ensure the availability and integrity of critical naval systems and data. The effectiveness hinges on the quality of implementation, ongoing tuning, and integration with broader security operations.

How has federal spending on application security and network defense services evolved over the past five years, and what trends does this contract reflect?

Federal spending on application security and network defense services has seen a significant and consistent upward trend over the past five years, driven by escalating cyber threats, modernization efforts, and increased reliance on digital infrastructure. Agencies across the DoD, intelligence community, and civilian sectors are prioritizing investments in advanced security solutions. This contract for $18 million reflects this trend by addressing critical needs within the Department of the Navy for specialized application security and WAF support. It aligns with the government's broader strategy to bolster cyber defenses, protect sensitive information, and ensure operational resilience in an increasingly complex threat landscape. The multi-year nature of the award also suggests a strategic, long-term commitment to maintaining these capabilities.

Industry Classification

NAICS: Professional, Scientific, and Technical Services › Architectural, Engineering, and Related Services › Engineering Services

Product/Service Code: IT AND TELECOM - INFORMATION TECHNOLOGY AND TELECOMMUNICATIONS › IT AND TELECOM - APLLICATIONS

Competition & Pricing

Extent Competed: FULL AND OPEN COMPETITION

Solicitation Procedures: SUBJECT TO MULTIPLE AWARD FAIR OPPORTUNITY

Solicitation ID: N6600118R0001

Offers Received: 1

Pricing Type: COST PLUS FIXED FEE (U)

Evaluated Preference: NONE

Contractor Details

Address: 2300 WINDY RIDGE PKWY STE 400S, ATLANTA, GA, 30339

Business Categories: Category Business, Corporate Entity Not Tax Exempt, Manufacturer of Goods, Not Designated a Small Business, Special Designations, Subchapter S Corporation, U.S.-Owned Business

Financial Breakdown

Contract Ceiling: $20,180,253

Exercised Options: $20,180,253

Current Obligation: $18,020,234

Subaward Activity

Number of Subawards: 6

Total Subaward Amount: $4,572,927

Contract Characteristics

Commercial Item: COMMERCIAL PRODUCTS/SERVICES PROCEDURES NOT USED

Cost or Pricing Data: NO

Parent Contract

Parent Award PIID: N6600119D3414

IDV Type: IDC

Timeline