DHS Plans Sole-Source ICAM Agreement Worth Up to $100 Million

The Department of Homeland Security (DHS) plans a 12-month blanket purchase agreement (BPA) for identity, credentialing, and access management (ICAM) services, with an estimated value of $50 million to $100 million. The department intends to use a sole-source approach with incumbent Dignari LLC, making this a planned continuation of services rather than an opportunity currently described as open competition. DHS forecasts releasing the solicitation on November 20, 2026, and anticipates completing the work by December 12, 2027. These dates and terms are forecasts; the solicitation will provide the authoritative scope, schedule, and conditions when released.

The planned scope covers core identity and access functions across the department: identity lifecycle automation, credential issuance and revocation, access reviews, and continuous monitoring. Together, these requirements point to demand for integrated processes that support users and credentials from onboarding through changes in access and eventual deactivation. For contractors, the combination of automation, credential administration, periodic access review, and ongoing monitoring may indicate an emphasis on operational continuity and centralized identity controls, although the final solicitation will determine the specific technical requirements and performance measures.

The procurement signal is significant for companies providing federal identity, credential, and access management capabilities, but the stated sole-source approach limits the immediate prospect of competing for the prime award. Prospective suppliers should review the solicitation when DHS releases it and assess whether the final terms allow any participation through the incumbent, subcontracting, or another defined role. The source names Ernst & Young (EY) among vendors, but provides no details establishing EY’s role in this planned BPA; companies should avoid treating that listing as confirmation of a teaming arrangement or contract position.

The procurement has also been discussed in the context of the Icepick data leak, which reportedly involved data on more than 40,000 DHS personnel. However, the available information does not describe the planned ICAM agreement as a response to that exposure and reports no evidence connecting Dignari to the leak. Contractors and industry observers should keep those matters distinct unless DHS or other reliable documentation establishes a direct relationship. For capture planning, the actionable near-term milestone is the forecast November 20 solicitation release, followed by close review of the finalized scope, acquisition terms, period of performance, and any participation provisions.

• Agency: DHS plans the ICAM BPA for department identity, credentialing, and access management services.
• Estimated value: The planned agreement is valued at $50 million to $100 million.
• Acquisition approach: DHS plans a 12-month sole-source BPA with incumbent Dignari LLC; it is not currently presented as an open competition.
• Forecast solicitation date: DHS anticipates releasing the solicitation on November 20, 2026.
• Anticipated completion: The planned effort is expected to conclude by December 12, 2027.
• Scope: Requirements include identity lifecycle automation, credential issuance and revocation, access reviews, and continuous monitoring.
• Industry action: Review the solicitation for final requirements and determine whether any role is available through the incumbent or under the finalized terms.
• Icepick context: The source references a leak involving data on more than 40,000 DHS personnel, but does not establish that the BPA responds to the exposure or that Dignari was linked to it.