FEDERAL CYBER BRIEF

Issue #10 — August 18, 2026

Cleared to Bid

258 notices screened · 49 biddable · 15 worth your week.

Act 1 — What you can win this week

This week's signal

There is a belief in this market that costs small software firms more contracts than any regulation does, and it is not written in any rule. The Department of Veterans Affairs just told its own contracting officers to stop repeating it. Full analysis below.

Top 3 opportunities

The other 12

The three above, in depth. The other twelve, at a glance.

Small Business Set-Aside

8(a) · SDVOSB · WOSB · HUBZone

Full & Open

Closing before the next brief

These missed the fifteen on runway alone. Every one closes before Issue #11.

Recompete pipeline

Contracts in our seven codes with every option exhausted, which means the work has to be re-competed rather than extended. Sorted by how long you have.

Derived from federal contract records retrieved August 10, 2026. Confirm live status before acting; end dates move.

Who won last week

Awards posted in our seven codes during the coverage window. On ordering vehicles the published figure is a ceiling, not money committed — see our note on reading award numbers. Nothing we listed in an earlier issue appeared in this week's awards.

Reply with your primary NAICS and set-aside status. I'll flag what fits you next week.

Act 2 — What changed in the market

Compliance flash

The semiannual regulatory agenda published August 14 confirms that a FAR cybersecurity rulemaking has been closed outright. The reason given is that it was written to implement Office of Management and Budget direction that no longer exists: OMB memorandum M-26-05 of January 23, 2026 rescinded both M-22-18 and M-23-16, the memos that established secure software development attestations for federal software purchases. What this means for you: if you sell software to the government and have been budgeting for a self-attestation regime built on those memos, that specific rulemaking is dead. Do not read it as the end of software supply chain scrutiny. The replacement memo describes a risk-based approach, agencies remain free to impose requirements contractually, and anything already written into a contract you hold still binds you. Check your active awards for attestation clauses before you change anything internally.

Agency intelligence

• The largest week we have processed, by a clear margin. 258 notices screened and 49 clearing all six gates, against 199, 214 and 212 in the three prior weeks. Four weeks under the tightened deadline gate now put the working ratio at roughly one notice in five. DoD accounted for 23 of the 49.
• Physical security keeps crowding out network security. Access control replacements, CCTV maintenance, alarm systems and intrusion detection installations dominated the set-aside pool again. Exactly one notice in the fifteen is cybersecurity in the strict sense, and the genuine cyber work sat where it has sat for a month: in short-deadline notices, now in the closing block above.
• Two requirements from earlier closing blocks came back. The Energy Department's ServiceNow security operations buy and a DoD data and AI modernization requirement both reappeared under fresh notices with later deadlines. A missed short-fuse deadline in this market is frequently not final, which is an argument for keeping a watch list rather than writing off anything you could not reach in time.

One caution on the data itself. Three requirements were posted twice this week under separate notice identifiers — the State Department forensics buy, an NIH datacentre relocation, and a VA clinical information system sustainment. In the NIH case the two copies carry different set-aside status, one restricted to small business and one not. Read the notice you intend to bid, not the one you found first.

Act 3 — Analysis

Deep dive — You do not need FedRAMP certification to bid

Ask a small software company why it does not sell to the federal government and the answer is often a single word. FedRAMP. The belief is that a cloud or SaaS product must already carry a completed authorization before anyone will look at it, that getting one costs hundreds of thousands of dollars, and that no agency will sponsor a company that has no federal customer yet. It is a closed loop, and firms talk themselves out of the market because of it.

The loop is not real. It has never been written into the FAR, and the Department of Veterans Affairs has now told its own workforce so in writing.

What VA actually said

In a memo signed by Zack Schwartz, principal deputy assistant secretary in VA's Office of Information and Technology, the department instructed that acquisition documents — including requests for information, proposals and quotations — should not state or imply that a cloud vendor must have already completed FedRAMP certification in order to compete for or win a VA contract. Cloud providers are instead expected to supply security and privacy documentation after award, so the agency can make an authorization determination for its own environment.

One caveat on sourcing, because it matters for how much weight to put on this. The memo has not been published publicly. It is known through reporting by FedScoop, which obtained it, and through subsequent analysis. Treat the substance as reliable and the exact wording as second-hand until VA posts it.

Why the myth took hold anyway

Nothing about this is a policy change, which is the part worth understanding. Federal News Network described the memo as mythbusting rather than new direction, and that framing is right. The requirement drifted into solicitations through habit rather than regulation, and once it appears in one agency's template it propagates into the next.

The cost of that drift falls in a predictable direction. A government official familiar with the memo put the mechanism plainly to Federal News Network: agencies that expect companies to spend millions on certification before being eligible for award end up selecting from a smaller pool, which leaves the agency itself in a tight spot. Some authorized products also run versions behind their commercial equivalents, so the agency loses capability in exchange for the paperwork.

Readiness is not certification, and the distinction is where you win

None of this means security documentation is optional. It means the sequence is different from what most firms assume. What an agency needs at award is confidence that you can move through its authorization process, not proof that you already have.

Practically, that means having a security assessment report you can hand over, architecture and data flow diagrams that match what you actually run, an asset inventory, recent vulnerability scans, and a clear account of which controls you have implemented and which you have not. A firm with no certification but mature, current documentation is more competitive under this model than a firm that assumes the question can be handled after the contract is signed.

The FedRAMP CR26 rewrite that took effect on July 1 changed the vocabulary here — authorizations became certifications, impact levels became classes — so make sure the labels in your documentation match the current scheme rather than the one you learned two years ago.

Where this does not apply

Be careful about generalising. VA's memo binds VA. Other agencies write their own solicitations, and some will keep asking for existing authorization until someone tells them otherwise. When a solicitation does state a pre-award certification requirement, that is a question for the contracting officer during the question period, not a reason to assume the whole market is closed.

The defense side is a separate matter entirely. If controlled unclassified information touches your system, DFARS 252.204-7012 requires cloud services that store or process it to meet a FedRAMP Moderate equivalent baseline, and that is a contractual obligation rather than a market-entry preference. The same applies to the NIST SP 800-171 control set underneath it.

What to do this week

If you have been filtering federal opportunities out of your pipeline on the assumption that certification is a prerequisite, reopen that filter. Read the actual solicitation language rather than the received wisdom. Where a notice is silent on the point, it is silent, and you are eligible.

Then close the documentation gap, because that is the real one. The firms that benefit from this are not the ones who now bid anything with a cloud component. They are the ones who can answer, on the day of award, exactly what their architecture looks like and where the gaps are.

FAQ

Do I need FedRAMP authorization before bidding on a federal contract?
Not as a general rule. No FAR provision requires existing FedRAMP certification as a condition of competing. VA has explicitly instructed its contracting officers not to state or imply otherwise in solicitations, requests for information, or requests for quotation.

What does an agency expect instead?
Documentation that supports its own authorization decision after award: a security assessment report, architecture and data flow diagrams, an asset inventory, vulnerability scan results, and a clear statement of implemented and unimplemented controls.

Does this apply to every agency?
No. The VA memo binds VA. Other agencies may still include pre-award certification language in solicitations. Where they do, raise it during the question period rather than treating it as settled.

Does this change anything for defense contracts involving CUI?
No. DFARS 252.204-7012 requires cloud services that store, process or transmit covered defense information to meet a FedRAMP Moderate equivalent baseline. That is a contract requirement and is unaffected by how agencies handle pre-award eligibility.

Is FedRAMP certification still worth pursuing?
For a firm with a federal customer base it remains valuable and eventually necessary for many cloud offerings. The point is sequencing: it is not the gate you must pass before you are allowed to compete.

Sources

• Federal Register — Regulatory Agenda (published August 14, 2026)
• FedScoop — VA won't require existing FedRAMP certification for cloud contracts, memo reveals
• Federal News Network — VA's cloud security memo more mythbuster than new policy
• FedRAMP — Program authority and Consolidated Rules for 2026
• SAM.gov — individual opportunity and award notices linked throughout this brief
• USAspending.gov — federal contract records used for the recompete pipeline, retrieved August 10, 2026