Federal cyber contracting · the vehicles
Federal cyber + IT contracts don't flow through one vehicle — they flow through nine major ones. Every cyber professional working federal (or wanting to) needs to know what GSA Schedule, CIO-SP4, OASIS+, SEWP VI, Alliant 2, CHESS, OTAs, and SBIR actually are. This page is the recognition layer + how-to-navigate framework.
Nine vehicles
01
aka GSA Schedule, Schedule 70 (legacy name)
The granddaddy. Federal agencies use the GSA Schedule to buy IT services and cyber expertise from pre-qualified contractors without running a full procurement. ~$50B+ annual federal spend. Booz Allen, Lockheed, Northrop, Raytheon, SAIC, Leidos all have schedule contracts. Schedule 70 was the IT-specific schedule, now folded into the consolidated MAS.
Where: gsa.gov/buy-through-us/contracting-vehicles
02
aka Chief Information Officer — Solutions and Partners 4 · NIH NITAAC
$50B+ ceiling. The follow-on to CIO-SP3 — the dominant IT services contracting vehicle for federal IT and cyber. Run by NIH's NITAAC (National Institutes of Health IT Acquisition + Assessment Center). Multi-award. Prime holders are roughly the same names as the GSA Schedule. CIO-SP4 awards completed 2024.
Where: nitaac.nih.gov · cio-sp4 contract holders list
03
aka One Acquisition Solution for Integrated Services Plus
$60B+ ceiling. GSA's successor to OASIS. Covers professional services including cyber engineering, intel analysis, program management. Eight pools by service area. OASIS+ awards staged through 2024-2025. The default vehicle for federal cyber services work that doesn't fit cleanly into IT.
Where: gsa.gov/oasisplus
04
aka Solutions for Enterprise-Wide Procurement · NASA
$20B+ ceiling. NASA-managed but used government-wide. Focused on IT products + product-adjacent services. Strong for hardware + software procurement including cyber tools. SEWP V ran 2015-2025, SEWP VI awards 2024+.
Where: sewp.nasa.gov
05
aka Alliant 2 GWAC · GSA
$50B+ ceiling. GSA Government-Wide Acquisition Contract for IT solutions. Used heavily for cybersecurity professional services + IT modernization. Prime holders include most named federal IT contractors. Alliant 3 in pre-award as of mid-2026.
Where: gsa.gov/alliant2
06
aka Army CHESS · DoD IT Enterprise Solutions
Army's CHESS program (Computer Hardware, Enterprise Software and Solutions) is the canonical Army IT vehicle. DoD has parallel ITES-3H, ITES-3S contracts. Used for cyber product purchases + IT services across the Army enterprise. Strong vehicle for cyber product vendors to sell into Army.
Where: chess.army.mil · gsa.gov/dod-ites
07
aka Multiple Award Contracts · per-agency
Most federal agencies maintain their own MAC vehicles for cyber + IT services. DHS EAGLE II, DoD ENCORE III, Treasury TIPSS-4, VA T4NG, etc. These are agency-specific but often serve as the operational vehicle for cyber service delivery once a contractor wins a task order.
Where: Per-agency contracting websites · sam.gov contract searches
08
aka Other Transaction Agreements
Non-FAR contracting authority that DoD has expanded heavily since 2016. Allows DoD to bypass standard Federal Acquisition Regulation processes for prototyping + production with non-traditional contractors. Anduril, Palantir, SpaceX all entered DoD primarily via OTAs. Substantial cyber OTA use through AFWERX, DIU, Army Futures Command, NavalX.
Where: diu.mil · afwerx.com · sam.gov OTA listings
09
aka Small Business Innovation Research · Small Business Technology Transfer
$3B+ annual federal R&D contracts going to small businesses. DoD SBIR runs three phases (feasibility study → R&D → commercialization). Cyber + AI are top SBIR topic areas every year. Many defense-tech startups (Anduril, Shield AI, Saronic) used SBIR as early-stage federal funding before scaling to OTA + program-of-record work.
Where: sbir.gov · doddtic.dtic.mil/contract-vehicles
How to navigate
Read sam.gov early and often. Every federal contract over $25K is required to be posted on sam.gov. Search by NAICS code (541512 IT services, 541513 facilities management, 541519 other IT, 541330 engineering services). The opportunity feed is the source-of-truth on what's actually being bought.
Set NAICS code alerts. SAM.gov alerts on your NAICS codes mean you see new opportunities before they're widely known. Industry pros run alerts on 3-5 NAICS codes that match their service offerings.
Pre-qualify before you bid. Federal agencies will only buy from contractors on the right vehicle. If you want to sell to DoD, you need to be on Alliant 2 or CIO-SP4 or OASIS+ or have an OTA agreement in place. Pre-qualification is months of paperwork — start it before you have the customer.
Cyber + intel work concentrates in specific NAICS. The IT/cyber NAICS codes (541512, 541513, 541519) capture most of it, but cyber-adjacent professional services often code 541330 (engineering) or 541611 (administrative management consulting). Senior practitioners track all five.
Know your prime / sub posture. Most small companies enter federal cyber as subs to large primes. Booz Allen, Leidos, SAIC all have substantial subcontractor programs. Subcontracting in for 2-3 years on a real contract builds the past-performance record you need to bid prime later.