IT Procurement (Federal)

Federal IT procurement is the regulated process by which U.S. government agencies acquire information technology products, software, and services, subject to a distinct body of legislation, executive orders, security requirements, and policy guidance that does not apply to commercial IT purchasing.

What is Federal IT Procurement?

The federal government is the largest single purchaser of IT goods and services in the United States, spending approximately $100 billion annually on technology across defense and civilian agencies. Unlike commercial IT purchasing, federal IT acquisition is governed by an overlapping set of authorities: the Federal Acquisition Regulation (FAR) and its Defense supplement (DFARS); the Clinger-Cohen Act (which established the Chief Information Officer role and IT investment management requirements); FISMA (Federal Information Security Management Act, which governs cybersecurity requirements); OMB Circular A-130 (which sets IT management policy); and a growing body of executive orders addressing supply chain risk, zero trust architecture, and software security.

The practical effect of these authorities is that federal IT procurement involves requirements that do not appear in commercial technology purchasing. Software products handling federal data need to address FedRAMP authorization if hosted in the cloud, or go through the agency's Authority to Operate (ATO) process if hosted on-premises. Hardware and software must demonstrate supply chain integrity, avoiding components from prohibited vendors (Section 889 of NDAA 2019). Contractors developing custom software must comply with data rights requirements under DFARS 252.227-7014 and related clauses governing technical data and computer software. Personnel performing IT work on federal networks may need security clearances depending on the data classification of the systems they access.

The primary acquisition vehicle for civilian agency IT procurement is the GSA Multiple Award Schedule (MAS), specifically Schedule 70 (IT), now integrated into the unified MAS IT Schedule. DoD has additional IT contracting vehicles including SEWP (NASA's Solutions for Enterprise-Wide Procurement), NITAAC CIO-CS, and agency-specific IDIQs. Large-scale enterprise IT transformation programs are often procured through DoD's ITES (IT Enterprise Solutions) contracts or civilian agency equivalents.

Why Federal IT Procurement matters for technology companies

The federal IT market offers substantial and predictable revenue opportunities for technology companies, but requires navigating security certifications, compliance frameworks, specialized contracting vehicles, and procurement processes that differ materially from commercial technology sales.

Example

A software company with a cybersecurity analytics platform decides to enter the federal market. It begins by registering in SAM.gov and obtaining CAGE and DUNS identifiers. It pursues FedRAMP Moderate authorization for its SaaS platform, which will allow any federal civilian agency to procure it without conducting an individual security assessment. Simultaneously, it obtains a GSA MAS IT Schedule contract, placing its product at the negotiated price for direct agency purchase. Within 18 months of market entry, it has its first three civilian agency customers.

Frequently Asked Questions

What is the Clinger-Cohen Act and why does it matter for IT vendors?

The Clinger-Cohen Act (1996) established the federal Chief Information Officer (CIO) role and required agencies to manage IT investments using a capital planning process. For vendors, Clinger-Cohen means that major IT purchases go through agency IT investment governance processes, technology decisions involve the CIO's office, not just the program office. Understanding an agency's IT investment management process helps vendors position their products appropriately with decision-makers.

Does every federal IT contract require FedRAMP?

No. FedRAMP is required for cloud services (SaaS, PaaS, IaaS) used by federal agencies. On-premises software deployments go through the agency's internal ATO process rather than FedRAMP. Hardware procurement does not involve FedRAMP. The FedRAMP requirement applies specifically to cloud-based systems that will host or process federal data.

What is SEWP and how do vendors get on it?

SEWP (Solutions for Enterprise-Wide Procurement) is a NASA-managed GWAC (Government-Wide Acquisition Contract) that provides agencies government-wide access to IT products and services. Vendors do not sell directly through SEWP; instead, SEWP contract holders (resellers and integrators) purchase products from vendors and resell through the SEWP vehicle. Technology companies seeking federal market access through SEWP typically partner with existing SEWP contract holders rather than obtaining their own SEWP contract.

How does the Section 889 prohibition affect IT procurement?

Section 889 of the FY2019 National Defense Authorization Act prohibits federal agencies from purchasing telecommunications or video surveillance equipment from five named Chinese companies (Huawei, ZTE, Hytera, Hikvision, Dahua) and their subsidiaries. It also prohibits agencies from using contractors whose networks include this equipment. IT vendors must certify compliance with Section 889 in their SAM.gov representations and must ensure their own supply chains do not include prohibited equipment.