Literacy — Agencies: The Department of Homeland Security

The department assembled from more than twenty predecessor agencies after the attacks of September 11, 2001. Its mission — protect the homeland — makes it a security culture first and a buyer second, and its component structure means "DHS" is really a portfolio of distinct buyers sharing one name. This profile maps the homeland-security market: the components, the research arm, the vehicles, and the IT-security posture that shapes most of its buying.

Culture: a component-driven security department

DHS is the newest of the cabinet departments and the most visibly a portfolio. Congress created it by folding dozens of agencies into one department with one mission — but the components kept their identities, their cultures, and their buying:

• CBP — Customs and Border Protection (the border, ports of entry, trade).
• ICE — Immigration and Customs Enforcement (enforcement and investigations).
• TSA — Transportation Security Administration (aviation and transit security).
• USCG — the Coast Guard (maritime safety, security, and response).
• FEMA — Federal Emergency Management Agency (disaster preparedness, response, recovery).
• USSS — the Secret Service (protective and investigative missions).
• CISA — the Cybersecurity and Infrastructure Security Agency (cybersecurity and the defense of critical infrastructure).
• And more — USCIS, the Federal Law Enforcement Training Center, the Science and Technology Directorate.

The strategic fact: you do not "sell to DHS," you sell to a component. Each runs its own offices, its own contracts, and often its own vehicles, under the department-wide rulebook. The first capture question in this market is always which component needs what we do — and the second is which vehicle connects us to it.

The research arm: HSARPA and the BAA landscape

DHS's research and development lives in the Science and Technology Directorate (S&T) — and within it, the Homeland Security Advanced Research Projects Agency (HSARPA), the department's DARPA-flavored research engine. The name HSARPA appears less prominently in the current organization than it did at founding, but the function endures: a research arm that funds high-risk, high-payoff homeland-security technology.

The solicitation shape that dominates here is the Broad Agency Announcement (BAA) — the "we have an area of interest, not a specification; send us your ideas" document from doctrine/02. S&T runs BAAs and other research solicitations (including DHS's SBIR program) inviting ideas across mission areas: explosives detection, chemical and biological defense, maritime security, cyber, and the rest. For a research-minded small firm, the DHS S&T lane is where the innovation money sits — and the proposal is an ideas document, not a bid on a specification.

Solicitation shapes

DHS uses the full federal toolbox, with a security texture:

• RFP/RFQ for operational buys across the components.
• BAA and research announcements from S&T for the innovation lane.
• SBIR solicitations for small-business R&D (DHS participates in the SBIR program).
• Task orders against the department-wide vehicles for IT, services, and commodities — see below.

Evaluation emphasis

Three durable emphases in DHS source selection:

1. Security mission first. The evaluation language leans on mission effectiveness — does this keep the homeland safer? Proposals that connect the work to a concrete security outcome tend to read as more credible.
2. Past performance is weighted heavily. DHS is a mission-critical, consequence-averse department; it leans on proven suppliers. A clean, relevant CPARS record and a strong past-performance volume matter a lot, and the department's vehicles routinely check the record (see the DoD profile for the CPARS/SPRS mechanics that DHS also uses).
3. IT security posture is baked into the buy. DHS is both the nation's cyber-defense agency and a consumer of IT. Two programs shape its IT purchases: CDM (Continuous Diagnostics and Mitigation), the CISA-run program that equips federal civilian agencies with cybersecurity tools and dashboards, and TIC (Trusted Internet Connections), the architecture standard for how agencies connect to the internet securely. If you sell IT or security services to DHS, these two acronyms tell you the compliance and architecture your work must fit — the environment your product has to live in, not just the box you deliver.

Vehicles: EAGLE, First Source, and the DHS-wide landscape

DHS has a small family of department-wide strategic-sourcing vehicles that a services or IT firm needs to know — the "standing competition you win once, then chase orders" model from doctrine/02:

• EAGLE — the Enterprise Acquisition Gateway for Leading-Edge Solutions, the department's preferred vehicle for IT services. EAGLE II organized the market into functional categories — service delivery (integration, software development, operations), IT program-support services, and independent verification and validation. The portfolio has been evolving toward EAGLE Next Gen, a newer approach to the same IT-services function. The function — a multiple-award IDIQ for IT services across the department — is the durable part; the exact name is the current address.
• First Source — the companion vehicle for IT commodities and products: hardware, software, and value-added reseller services. FirstSource II was a department-wide, 100 percent small business multiple-award vehicle with awards across the small-business categories — HUBZone, 8(a), SDVOSB, WOSB, and small business. For a small IT reseller or distributor, this lane is the doorway to DHS spend.
• PACTS II and similar vehicles cover program-management, administrative, and technical services across components.
• The components also buy through GSA schedules and GWACs (see the GSA profile); DHS is a heavy user of the shared procurement infrastructure.

The pattern to internalize: EAGLE for services, First Source for products, and GSA for everything the department can route through shared vehicles. Each is a doorway; the orders are the work.

Set-aside landscape

DHS carries the standard federal set-aside pool — small business, 8(a), HUBZone, SDVOSB/VOSB, WOSB — and its flagship small-business vehicle, FirstSource II, was set aside entirely for small business. For a small firm the practical upshot: the IT-products lane in this department is a small-business lane by design, and the security-services lanes carry meaningful set-aside and subcontracting goals. The certification lessons from the DoD profile apply unchanged (SBA certification for 8(a)/HUBZone/SDVOSB; VA's separate verification only for VA's own program — see the VA profile).

Learning pointers

Learning pointers. The DHS profile teaches the security-component variant of doctrine/01 (where the money lives).

• Doctrine — doctrine/02 (the BAA shape), doctrine/03 (component-focused capture), doctrine/09 (positioning for a consequence-averse buyer).
• Literacy — acronym-decoder (BAA, IDIQ, SDVOSB), further-reading (SAM.gov for DHS opportunities).
• Case study — Ravonics' data-and-modeling capabilities and HUBZone status fit the DHS S&T research lane and the FirstSource II small-business product lane.
• Course — the competitive-intelligence elective (graduate-elective-competitive-market-intelligence) is where a component-map of DHS gets built.
• Verify — DHS vehicles churn (EAGLE II → EAGLE Next Gen), CDM/TIC requirements evolve, and component organizations change; check the live solicitation and DHS's strategic-sourcing pages before committing.