This article is based on a report originally published by bgov.com in July 2017. It covers a federal procurement opportunity that has since closed, but the technical context and DevSecOps approach remain relevant to government IT modernization discussions.
Background: USCIS Embraces DevSecOps
In mid-2017, the U.S. Citizenship and Immigration Services (USCIS) Office of Information Technology signaled a significant shift in its technology acquisition strategy by preparing two separate solicitations for Development, Security, and Operations (DevSecOps) services. The move reflected a broader trend in U.S. federal agencies adopting agile, security-first software delivery methodologies.
DevSecOps integrates information security practices directly into the DevOps software delivery lifecycle, rather than treating security as a late-stage gate or afterthought. This approach aims to produce secure applications faster and more reliably—a priority for a high-volume, mission-critical agency like USCIS.
The Two Solicitations: A Staged Approach
USCIS structured its procurement in two complementary phases, with the first solicitation laying the technical groundwork for the more advanced capabilities requested in the second.
Solicitation One: Cloud Infrastructure and System Enhancement
The first Request for Information (RFI) asked vendors to demonstrate their ability to build and enhance systems in the cloud. This foundational layer focused on establishing a modern, scalable infrastructure using DevSecOps principles—specifically emphasizing agile processes, microservices architecture, CI/CD pipelines, and open-source tooling.
Solicitation Two: Data Science, Machine Learning, and AI
The second RFI built on that cloud foundation by seeking more advanced capabilities, including:
- Deep data science and big data analytics
- Machine learning services
- Artificial intelligence applications
Both solicitations requested that vendors provide specific details of their past performance on similar requirements. Responses to both RFIs were due July 26, 2017.
Core Technical Requirements
A July 12, 2017 notice outlined the mandatory technical practices expected of any vendor awarded work under these contracts. Both future contracts required:
- Agile processes — iterative, sprint-based delivery rather than waterfall development
- Microservices architecture — decomposing applications into independently deployable services
- Continuous Integration/Continuous Delivery (CI/CD) pipelines — automating build, test, and deployment workflows
- Open-source tools — leveraging community-maintained toolchains rather than exclusively proprietary software
Services were intended to be delivered across USCIS’s enterprise and within the broader Department of Homeland Security (DHS) environment, indicating an expectation of scale and interoperability.
USCIS’s Prior DevOps Experience
These solicitations were not USCIS’s first foray into DevOps. The agency had already established a track record with related contracts:
- 360 IT Integrated Solutions RLLP—a joint venture of Qbase LLC, Geocent LLC, and the Newberry Group Inc.—won an Enterprise Acquisition Gateway for Leading Edge Solutions II (EAGLE II) task order in August 2016 for a rapid DevOps implementation. The contract was valued at $4.7 million and was set to end in September 2017.
- Infozen Inc. had held a four-year, $15 million Alliant Small Business task order for transformation integration and configuration services, which concluded in June 2017.
The timing of these new solicitations—coming shortly after both prior contracts concluded or neared their end—suggests USCIS was planning a deliberate transition to a more mature, security-integrated DevSecOps model rather than simply renewing existing arrangements.
Why DevSecOps Matters for Federal Agencies
Federal agencies face unique pressures that make DevSecOps particularly well-suited to their needs:
- Compliance by design: Regulations such as FISMA require continuous security assessment. Embedding security into CI/CD pipelines reduces the compliance burden compared to periodic audits.
- Reduced time-to-delivery: Agile and CI/CD practices allow agencies to release working software incrementally rather than in multi-year waterfall cycles.
- Scalability in the cloud: Cloud infrastructure enables USCIS to handle variable workloads—such as immigration application surges—without over-provisioning fixed data center capacity.
- Auditability: Automated pipelines create reproducible, documented build and deployment processes, supporting federal audit requirements.
Key Takeaways for DevOps Practitioners
The USCIS solicitations from 2017 are an early, concrete example of the federal government codifying DevSecOps requirements into procurement language. Several patterns are worth noting for practitioners working in or selling to government environments:
- Agencies are increasingly specifying CI/CD, microservices, and open-source tooling as baseline requirements—not differentiators.
- Procurement is structured in layered stages: establish infrastructure first, layer advanced analytics and AI on top.
- Past performance on similar DevSecOps engagements is a critical evaluation criterion in federal RFIs.
- Security is expected to be built into the delivery pipeline, not bolted on at the end.
As federal modernization continues to accelerate—driven by mandates from OMB and initiatives like the Federal Cloud Computing Strategy—the pattern established by USCIS in 2017 has become a template repeated across dozens of agencies.