GSA's draft MAS Refresh 34 phases out the voluntary Incident Response subgroup under Highly Adaptive Cybersecurity Services (HACS) SIN 54151HACS at the end of fiscal year 2027, which is September 30, 2027. If you already hold the Incident Handling and Event Management (IHEM) subgroup, nothing changes for you. If you hold Incident Response alone, you need to pass the IHEM oral technical evaluation and add the subgroup through eMod before that date.
I spent eighteen years in federal acquisition as a Contracting Specialist and Contracting Officer at GSA, IRS, DoD, DOI, HHS, FTC, and Energy. I hold a FAC-C Level III certification and a Master of Liberal Arts from Harvard University. Subgroup transitions like this one look administrative on paper. In practice, the contractors who wait until the final quarter end up competing for oral evaluation slots while their agency customers quietly filter them out of eLibrary searches.
What exactly is changing for HACS Incident Response in Refresh 34?
GSA's Refresh 34 notice, posted for industry comment in October 2026, states that the voluntary Incident Response subgroup under SIN 54151HACS will be phased out at the end of FY2027. Contractors in the IHEM subgroup are unaffected. GSA has said the refresh is in draft form and subject to change before issuance, targeted for November 2026.
- What is retiring: the Incident Response (IR) subgroup, one of the original HACS subgroups.
- What replaces it: the Incident Handling and Event Management (IHEM) subgroup, added to 54151HACS in MAS Refresh 26 in 2025.
- Deadline: end of FY2027, September 30, 2027.
- Who is untouched: contractors already listed under IHEM, and HACS holders who never carried Incident Response.
- Mass modification: GSA's MAS activity feed says the Refresh 34 mass mod must be accepted within 90 days of issuance. Accepting the mass mod does not add IHEM for you.
Refresh 34 also carries the GSAR Part 538 clause consolidation, the AI clause at GSAR 552.239-7001, and the removal of the 20-year MAS limit. Those get the headlines. The HACS change is narrower, but for a cyber firm whose federal revenue runs through incident response task orders, it is the item that matters most.
What are the six HACS subgroups, and where does IHEM fit?
SIN 54151HACS currently has six subgroups. Each one requires a separate pass of a technical evaluation, and agencies are told to confirm a vendor appears under the correct subgroup in GSA eLibrary before ordering. After FY2027, IHEM becomes the only incident-focused subgroup.
| HACS subgroup | Core work | Status after FY2027 |
|---|---|---|
| High Value Asset (HVA) Assessments | Risk and vulnerability assessments and security architecture reviews of designated HVAs | Continues |
| Risk and Vulnerability Assessment (RVA) | Network mapping, vulnerability scanning, phishing assessments, web application and database testing | Continues |
| Penetration Testing | Authorized simulated attacks to identify exploitable weaknesses | Continues |
| Cyber Hunt | Proactive and reactive searches for threats that evaded existing controls | Continues |
| Incident Response | Responding to and recovering from detected incidents | Phased out |
| Incident Handling and Event Management (IHEM) | Response activities when incidents and events are detected, aligned to NIST and industry sources, covering the full event lifecycle | Continues; absorbs incident work |
GSA's HACS program page describes the subgroup structure and the oral evaluation requirement. The practical point: IHEM is broader than Incident Response. It reaches event management, which means logging, triage and escalation, not only the response after an incident is declared.
How do you get into the IHEM subgroup?
You must complete and pass the IHEM Oral Technical Evaluation, then submit a modification in eMod to add the subgroup. GSA's Refresh 26 Q&A states that the self-attestation route does not apply to IHEM, so holding Incident Response today does not carry you over automatically.
- Confirm in eLibrary exactly which HACS subgroups your contract lists today.
- Read the current IHEM subgroup description in the MAS IT Large Category attachment and map your past incident work to it.
- Identify the key personnel who will answer questions in the oral evaluation. They must be the people who actually perform the work.
- Request and schedule the IHEM oral technical evaluation with the HACS program office.
- After a pass, submit the add-subgroup modification in eMod with any updated labor categories and pricing.
- Once the mod is executed, update your GSA Advantage catalog, capability statement and SAM.gov narrative so buyers see IHEM, not the retiring subgroup.
GSA's Refresh 26 Q&A is the document that confirms the oral evaluation requirement for IHEM. GSA does not share evaluation questions in advance.
What does a HACS oral technical evaluation actually test?
The oral evaluation tests whether your named personnel can explain, in their own words and under time pressure, how they perform the subgroup's work. A Technical Evaluation Board asks scenario questions that are not released in advance. Marketing language and slide decks do not score.
When I sat on the other side of the desk as a Contracting Officer, the oral presentations that went badly almost always shared one pattern. The company sent its business development lead and a proposal manager instead of the engineer who ran the last incident. The board asks how you scoped a containment decision, what logs you pulled first, and how you handed evidence to the agency. A salesperson cannot answer that.
- Lifecycle coverage: preparation, detection and analysis, containment, eradication, recovery and post-incident activity, the structure in NIST SP 800-61 Revision 3.
- Event management: how you collect, correlate and triage events before they become incidents, including log retention expectations agencies face under OMB M-21-31.
- Federal reporting: how you support the agency's reporting obligations to CISA and coordinate with the agency's Security Operations Center.
- Evidence handling: chain of custody, forensic imaging and preservation.
- Your actual team: who does the work, their roles, and how you surge.
Older HACS price lists describe a rule that a contractor who passes the oral evaluation but does not complete the related offer or modification within six months must retake it. Confirm the current window with the HACS program office before you schedule, and have your eMod package ready before your orals date.
What happens if you miss the FY2027 deadline?
If Incident Response is your only incident subgroup on September 30, 2027, you lose your eLibrary listing for incident work. Agencies that filter by subgroup will not see you, and new task orders for incident services will go to IHEM holders. Existing orders are governed by their own terms.
As a Contracting Specialist at GSA, I watched what happened every time a SIN or subgroup retired. The contractors who planned early lost nothing. The ones who waited spent the last 60 days chasing scheduling, and some missed the cutover entirely. Under FAR 8.405-2, an ordering activity evaluating services must confirm the work is within the scope of the schedule contract and SIN. An agency CO will not take a scope risk for you.
| Your current HACS position | Risk level | Action |
|---|---|---|
| Incident Response and IHEM | None | Accept the Refresh 34 mass mod; clean up marketing references to IR |
| Incident Response only | High | Schedule IHEM orals in the first half of FY2027 |
| Other HACS subgroups, no incident work | Low | Decide whether IHEM is worth adding as a growth move |
| No HACS SIN | Not applicable | Add 54151HACS and IHEM together if incident work is your core offer |
The Short Version
Incident Response retires at the end of FY2027. IHEM is the replacement, it requires a passed oral evaluation, and only an eMod adds it to your contract. Start in the first half of 2027.
Should you change labor categories or pricing when you add IHEM?
Usually yes, at least in description. IHEM covers event management as well as response, so labor categories built only around incident responders may not show the analyst and SOC roles the subgroup reaches. Rates that already passed price analysis can carry over if the work and qualifications are the same.
Across our 70+ GSA contract awards, the add-subgroup modifications that cleared fastest were the ones that kept existing, already-negotiated labor categories and added only what the new scope required. Every new labor category triggers price analysis. Under Transactional Data Reporting, your CO will look at comparable rates on other contracts, so a new SOC analyst rate needs commercial support before you submit.
- Keep: incident responder, forensic analyst and incident manager categories that already passed analysis.
- Consider adding: SOC analyst tiers, threat intelligence analyst and log engineering roles if you perform them.
- Do not: raise rates on existing categories in the same mod. Mixing scope and price increases slows the review.
What should HACS contractors do now?
Treat the FY2027 deadline as a Q2 FY2027 deadline. Confirm your subgroups this month, assign the engineers who will sit for orals, schedule the IHEM evaluation early in 2027, and have the eMod package drafted before your orals date.
- November 2026: confirm subgroups in eLibrary and read the final Refresh 34 language when it issues.
- Within 90 days of issuance: accept the Refresh 34 mass modification.
- December 2026 to January 2027: build your IHEM scenario prep with the personnel who will present.
- First half of 2027: pass IHEM orals and submit the eMod.
- Before September 30, 2027: confirm IHEM appears in eLibrary and GSA Advantage.
What Is the Bottom Line?
- The voluntary Incident Response subgroup under SIN 54151HACS phases out at the end of FY2027 under draft Refresh 34.
- Contractors already in IHEM are not affected.
- IHEM requires passing an oral technical evaluation; self-attestation does not apply.
- Send the engineers who do the work to orals, not your sales team.
- Accepting the Refresh 34 mass mod does not add IHEM. Only an eMod after a passed evaluation does.
- Plan to finish by mid-2027 so a failed attempt still leaves time to retry.
Frequently Asked Questions
When does the HACS Incident Response subgroup go away?
GSA's draft Refresh 34 phases out the voluntary Incident Response subgroup under SIN 54151HACS at the end of FY2027, which is September 30, 2027. The refresh is in draft and subject to change, so confirm the date in the final solicitation.
Do I need to do anything if I already hold IHEM?
No subgroup action is required. GSA has said contractors in the Incident Handling and Event Management subgroup are not affected. You still need to accept the Refresh 34 mass modification within 90 days of issuance.
Can I self-attest into the IHEM subgroup?
No. GSA's Refresh 26 Q&A states that offerors must complete and pass the IHEM Oral Technical Evaluation and that the self-attestation route does not apply to IHEM.
Does accepting the Refresh 34 mass modification move me from Incident Response to IHEM?
No. The mass modification updates solicitation terms. Adding IHEM requires passing the oral evaluation and submitting a separate modification in eMod.
What is the difference between Incident Response and IHEM?
Incident Response focuses on responding to and recovering from incidents. IHEM covers response activities when incidents and events are detected, so it also reaches event management such as triage, correlation and escalation before an incident is declared.
What happens to my existing incident response task orders after FY2027?
Existing orders are governed by their own terms. The phase-out affects your eLibrary listing and eligibility for new incident work, so agencies placing new orders will look for IHEM holders.
If your firm holds HACS Incident Response and you want a clear plan for IHEM orals, the eMod package and labor category updates, talk with Blackfyre about GSA contract maintenance and we will map your path before the FY2027 cutover.