Which GSA SIN is for cybersecurity services?

Cybersecurity services go on SIN 54151HACS, Highly Adaptive Cybersecurity Services. It is also eligible for GSA Cooperative Purchasing, so state and local governments can use it.

Is there federal grant money for local government cybersecurity?

Yes. For FY2025, DHS made $91.7 million available through the State and Local Cybersecurity Grant Program and $12.1 million through the Tribal Cybersecurity Grant Program.

When did CMMC start showing up in DoD contracts?

The DFARS rule that adds CMMC requirements to DoD contracts took effect November 10, 2025, starting a phased rollout.

How do I get my product on the CDM Approved Products List?

Submit during CISA's monthly open window (the first week of each month) with the required forms, a supply chain risk management plan, a VPAT and your license agreement; CISA then reviews it against CDM technical requirements.

How long does it take to sell cybersecurity to government?

It depends on the size of the purchase and how it's bought. Small purchases under an agency's threshold, or buys through an existing cooperative contract, can move quickly. Purchases that need a formal bid or a new budget line usually take longer, often a full budget cycle.

Can KSG help us sell cybersecurity to government?

Yes. Kensington Sales Group provides outsourced SDRs who research target agencies, reach the right program owners and purchasing contacts, and book qualified meetings for your sales team. Book a 30-minute call to talk it through.

Selling Cybersecurity to Government: A Vendor's Guide

Key takeaways

DHS made $91.7 million available through the FY2025 State and Local Cybersecurity Grant Program and $12.1 million through the FY2025 Tribal Cybersecurity Grant Program.
Common ways agencies buy cybersecurity: GSA MAS SIN 54151HACS, GSA MAS SIN 541519ICAM, CISA CDM Approved Products List (APL).
Rules to plan for: CMMC (Cybersecurity Maturity Model Certification), FedRAMP (for cloud-delivered security tools), CISA Secure Software Development Attestation.
A contract vehicle or vendor registration makes buying easier, but it doesn't create demand. The vendors that win reach program owners before budgets and bids are set.

Who buys cybersecurity in government

Purchases of cybersecurity happen across federal agencies, states, counties, cities, school districts and colleges, hospitals, tribal governments, special districts and public utilities. The people you'll deal with usually include:

Federal agency CISOs, CIOs and security operations teams
State chief information security officers and state cybersecurity offices
State administrative agencies that manage cybersecurity grant funds, and local governments that receive sub-awards
County and city IT directors and IT security managers
K-12 district technology directors and higher ed information security offices
Utility and water system IT/OT security managers
Defense contractors and their compliance leads (for CMMC-related services)
Purchasing agents and contracting officers

The purchasing office runs the process, but the program owner who has the problem usually decides what gets bought. Reach both. See government buyer roles for how they work together.

The government cybersecurity market

DHS made $91.7 million available through the FY2025 State and Local Cybersecurity Grant Program and $12.1 million through the FY2025 Tribal Cybersecurity Grant Program. (CISA press release, 'DHS launches over $100 million in funding to strengthen communities' cyber defenses' (FY2025))
The federal government invests more than $100 billion in IT each year, and GAO lists IT acquisition and management as a high-risk area (2025 update). (GAO press release on GAO-25-107852 (January 23, 2025))

How agencies buy cybersecurity

Small purchases under an agency's threshold can often be made with a quote or a purchase card. Larger purchases need a formal bid or an existing contract. These are the contract vehicles agencies commonly use for cybersecurity:

Contract vehicle	What it is
GSA MAS SIN 54151HACS - Highly Adaptive Cybersecurity Services (HACS)	GSA Schedule SIN for cybersecurity services such as assessments, testing, incident response and monitoring. Eligible for state and local cooperative purchasing.
GSA MAS SIN 541519ICAM - Identity, Credentialing and Access Management	GSA Schedule SIN for identity and access management products and services. Eligible for cooperative purchasing.
CISA CDM Approved Products List (APL)	Catalog of tools approved for the federal Continuous Diagnostics and Mitigation program; listed products are bought through GSA MAS IT, GSA Alliant CDM DEFEND task orders, or the NASA SEWP CDM catalog.
NASA SEWP VI	Government-wide contract for IT and communications products and services, including a CDM catalog; open to all federal agencies.
GSA MAS SIN 518210C - Cloud Computing and Cloud Related IT Professional Services	Used for cloud-delivered security tools (security SaaS).

Thresholds differ by state and agency; see our state procurement thresholds. For which cooperatives cover which categories, see cooperative contracts by category.

Rules and requirements for selling cybersecurity

Requirement	What it means for you
CMMC (Cybersecurity Maturity Model Certification)	Defense contractors that handle federal contract information or controlled unclassified information must meet a CMMC level; the DFARS rule that puts CMMC into DoD contracts was published September 10, 2025 and took effect November 10, 2025.
FedRAMP (for cloud-delivered security tools)	If your security product runs as a cloud service, federal agencies must complete the FedRAMP process before using it in production.
CISA Secure Software Development Attestation	Software makers selling to federal agencies must attest to secure development practices on CISA's common form.
CDM APL submission requirements	To get on the CDM list, you submit during CISA's monthly open window with a supply chain risk management plan, a Section 508 VPAT and your license agreement.
GovRAMP (formerly StateRAMP)	State, local, tribal and education buyers often require GovRAMP status for cloud-based security products.
CJIS Security Policy	Security vendors with access to criminal justice information at police and public safety agencies must meet the FBI CJIS Security Policy and sign the CJIS Security Addendum.

Requirements vary by agency and contract. Read each solicitation's terms, and check with the buyer when in doubt. This isn't legal advice.

Buying signals to watch

These events often mean an agency will buy cybersecurity soon:

A ransomware attack or breach hits the agency or a nearby government
A state announces cybersecurity grant awards or opens a sub-grant round for local governments
An audit, inspector general report or risk assessment finds security gaps
A new CISO is hired or a state creates a new cybersecurity office
A new mandate takes effect, such as CMMC clauses showing up in DoD contracts or insurance carriers requiring MFA

For more, see our guide to government buying signals and the contract expirations guide.

A sales process for selling cybersecurity

Register. Get into SAM.gov for federal work and each state or local vendor portal you'll sell into. Use our vendor registration checklist.
Pick your path to purchase. Decide which contract vehicles above fit your target buyers, and whether a reseller or partner already holds one.
Build the target list. Identify the agencies with the need, the budget and the buying authority, and the people who own the problem.
Start conversations early. Reach program owners while budgets and requirements are still being written, not after an RFP is posted.
Follow through to purchase. Help the buyer pick the method, whether a cooperative purchase, quote or formal bid. When a bid comes, use our RFP response guide.

How KSG helps you sell cybersecurity

Kensington Sales Group runs outbound sales development for companies selling to the public sector. Our SDRs research your target agencies, find the program owners and purchasing contacts, and book meetings for your sales team across Federal, SLED, K-12 and higher ed, healthcare, tribal, special district and utility markets. We also run bilingual English and Spanish outreach across the Western Hemisphere.

See how our outsourced SDR service works.

Sources

Checked November 2, 2026.

Selling cybersecurity to government.