Veteran-owned software consulting for agencies that need it shipped, not slide-decked.

We hold an active SDVOSB certification through the SBA's Veteran Small Business Certification (VetCert) program — the unified certification that replaced VA CVE Vets First in 2023. That means we're eligible for SDVOSB sole-source and set-aside awards across all federal agencies, not just VA. Verification is public via SAM.gov and the SBA certification database. Happy to send the cert letter and our UEI on request.

Directly, we hold GSA MAS under IT Professional Services (formerly 54151S) and pursue SDVOSB set-asides. As a sub, we partner with primes on SEWP V/VI, CIO-SP3 Small Business, GSA Alliant 2 SB, 8(a) STARS III, and agency BPAs. We're a clean teaming partner because we're small enough to move fast but mature enough to handle DCAA-compliant timekeeping, CPSR-ready subcontracts, and FAR 52.204-21 cyber baselines.

Our standard pattern is to inherit controls from a FedRAMP-authorized platform — typically AWS GovCloud, Azure Government, or Google Assured Workloads — which collapses the agency-side ATO scope significantly. We've shipped systems through FISMA Moderate ATO using NIST 800-53 Rev. 5 control sets, with continuous monitoring via the agency's eMASS or Xacta instance. We don't sell our own FedRAMP package; we build on top of one.

For CUI-handling systems we architect to CMMC 2.0 Level 2 (the 110 controls from NIST SP 800-171 Rev. 2). That means GCC High or AWS GovCloud for storage, FIPS 140-2/3 validated crypto, documented SSP and POA&M, and a clear flow-down for any subcontractors. We don't claim to be a C3PAO — we build the system and the artifacts, then your assessor validates. We've supported clients through Joint Surveillance Voluntary Assessments.

For prime work, our sweet spot is task orders in the $250K–$5M range where senior engineering matters more than headcount. For larger programs we sub to established primes and bring the SDVOSB credit plus the technical delivery. The Rule of Two (FAR 19.502-2) makes us a viable prime for set-aside work that primes can't touch directly. We're transparent about what we can and can't carry alone.

Three patterns repeat: (1) primes staffing junior engineers at senior bill rates because the LCAT label allows it; (2) ATO treated as a paperwork phase at month 10 instead of a design constraint at month 1, leading to re-architecture; (3) deliverables structured to require the incumbent's continued presence — proprietary build tooling, undocumented infra, knowledge silos. We design out all three from the SOW stage.

Yes. State and local — particularly state CIO offices, DMVs, health and human services, and municipal IT — have similar compliance pressures (StateRAMP, IRS Pub 1075 for tax data, CJIS for law enforcement, HIPAA for HHS) but faster procurement. We work under state master contracts, NASPO ValuePoint, and cooperative purchasing agreements. The veteran-owned status often qualifies us for state-level small business preferences as well.

Depends on the scope clarity. For well-defined modernization or integration work we prefer Firm Fixed Price with milestone-based invoicing — the government likes the cost certainty and we like the margin discipline. For discovery, R&D, or staff augmentation we run Time & Materials or Labor Hour against published GSA rates. We do not do Cost Plus; we're not staffed for the DCAA accounting overhead it requires.

For a greenfield FISMA Moderate system on an inherited FedRAMP platform: 30 days to provisional architecture and SSP draft, 60-90 days to a working system in a dev/test enclave, 4-9 months to ATO depending on agency AO responsiveness. For modernization of an existing authorized system, we can often ship inside the existing ATO boundary within 6-12 weeks via a significant change request rather than a full re-authorization.