CIO-SP4: Complete Guide to NIH's IT Services GWAC

CIO-SP4 (Chief Information Officer-Solutions and Partners 4) is a Government-Wide Acquisition Contract (GWAC) managed by the National Institutes of Health (NIH) Information Technology Acquisition and Assessment Center (NITAAC). CIO-SP4 provides federal agencies with access to comprehensive IT services ranging from software development and cloud computing to cybersecurity and emerging technologies.

CIO-SP4 was awarded in November 2022 and is the fourth generation of NIH's CIO-SP contract series. It replaced CIO-SP3 and CIO-SP3 Small Business (SB) as NITAAC's premier IT services vehicle. CIO-SP4 represents one of the largest IT GWACs in the federal government, with sophisticated scope and strong small business participation.

Key facts about CIO-SP4:

• $40 billion program ceiling. CIO-SP4 has an estimated ceiling of $40 billion across all contractors and task orders over the life of the contract.
• 10-year ordering period. Agencies can place task orders through CIO-SP4 until November 2032, with individual task orders extending up to five years beyond the ordering period (potential work through 2037).
• 147 prime contractors. NITAAC awarded CIO-SP4 to 147 contractors across multiple pools, including dedicated small business pools and an unrestricted pool.
• Government-wide access. All federal agencies can use CIO-SP4 — civilian agencies, Department of Defense, intelligence community, and legislative/judicial branches.
• Four distinct pools. CIO-SP4 is organized into four pools based on business size and socioeconomic status, allowing agencies to target procurements to meet small business goals.

CIO-SP4 competes with other IT services GWACs like Alliant 2 (managed by GSA), OASIS+, and NASA SEWP. Agencies choose CIO-SP4 when they want comprehensive IT services with strong small business participation and NITAAC's reputation for rigorous contractor vetting and program management.

CIO-SP4 covers comprehensive IT services organized into Technology Areas of Expertise (TAEs). Unlike product-focused contracts, CIO-SP4 is designed for IT professional services, systems integration, and technology implementation projects. The scope includes:

• Software Development and Engineering. Custom software development, application modernization, agile/DevSecOps, full-stack development, mobile app development, and software quality assurance.
• Cloud Computing. Cloud migration, cloud-native development, multi-cloud strategy, cloud security, infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS), and cloud cost optimization.
• Cybersecurity. Security assessments, penetration testing, security operations (SOC), incident response, zero-trust architecture, continuous monitoring, and compliance (FedRAMP, FISMA, NIST 800-53).
• Data Management and Analytics. Data warehousing, big data platforms, business intelligence, data visualization, data governance, data science, and predictive analytics.
• Artificial Intelligence and Machine Learning. AI/ML model development, natural language processing (NLP), computer vision, intelligent automation, AI governance, and emerging AI technologies.
• Enterprise IT Solutions. Enterprise resource planning (ERP), customer relationship management (CRM), electronic health records (EHR), financial management systems, and enterprise architecture.
• Network and Infrastructure Services. Network architecture, software-defined networking (SDN), network security, infrastructure modernization, and telecommunications.
• IT Operations and Maintenance. IT service management (ITSM), service desk operations, IT asset management, IT infrastructure support, and operational support services.
• Emerging Technologies. Blockchain, Internet of Things (IoT), quantum computing, edge computing, 5G/6G, extended reality (XR), and other cutting-edge technologies.
• IT Program Management. IT project management, portfolio management, IT strategic planning, IT transformation, and program management office (PMO) services.

What CIO-SP4 does NOT cover: CIO-SP4 is strictly for IT services. It does not include IT products or hardware (use NASA SEWP or GSA MAS for products), non-IT professional services, or construction and facilities work.

CIO-SP4 is ideal for agencies undertaking IT modernization, digital transformation, cybersecurity initiatives, cloud migrations, or enterprise-wide IT projects requiring multi-year professional services contracts.

CIO-SP4 uses a four-pool structure to organize contractors by business size and socioeconomic category. This allows agencies to strategically target task order competitions to meet small business subcontracting goals and socioeconomic participation requirements.

The four CIO-SP4 pools are:

• Pool 1: Unrestricted (Large Business). Contains large business contractors and small businesses competing in the unrestricted category. Pool 1 contractors can compete for any CIO-SP4 task order with no restrictions. This pool is used for large-scale, complex IT projects where agencies are not pursuing small business set-asides.
• Pool 2: Small Business Set-Aside. Contains small business contractors that do not qualify for 8(a), HUBZone, or SDVOSB status but meet SBA small business size standards. Pool 2 is used when agencies want to meet small business subcontracting goals but are not targeting a specific socioeconomic category.
• Pool 3: 8(a) and HUBZone Set-Aside. Contains contractors certified as either 8(a) Program participants or HUBZone-certified small businesses. Pool 3 is used when agencies want to meet 8(a) or HUBZone subcontracting goals. Learn more about these certifications in our 8(a) Certification Guide and HUBZone Guide.
• Pool 4: Service-Disabled Veteran-Owned Small Business (SDVOSB) Set-Aside. Contains SDVOSB-certified contractors. Pool 4 is used when agencies want to meet SDVOSB subcontracting goals. Learn more in our SDVOSB Certification Guide.

All four pools cover the same scope of IT services — the difference is business size and socioeconomic status, not technical capability. Agencies select the pool based on procurement strategy, small business goals, and the complexity/size of the requirement.

Key consideration for small businesses: If you hold a CIO-SP4 contract in Pool 2, 3, or 4, you must maintain your small business or socioeconomic certification status to remain eligible for set-aside task orders in that pool. If you lose your certification (e.g., you grow beyond SBA size standards), you lose eligibility for future set-aside awards in that pool, though existing task orders continue.

CIO-SP4 uses a competitive task order process. Agencies must compete requirements among CIO-SP4 contractors in the selected pool(s). Here's the typical process:

1. Agency defines requirements. The agency develops a statement of work (SOW) or performance work statement (PWS) defining the IT services needed, deliverables, outcomes, and evaluation criteria. Learn more in our Performance Work Statement Guide.
2. Agency issues Request for Proposal (RFP). The RFP is posted to all CIO-SP4 contractors in the selected pool(s). The RFP includes the SOW/PWS, evaluation criteria, contract type (typically time-and-materials, firm-fixed-price, or cost-plus), and proposal requirements.
3. Contractors submit proposals. CIO-SP4 contractors prepare technical proposals, management plans, past performance documentation, and pricing. Proposals vary in complexity based on the task order size and requirements.
4. Agency evaluates proposals. The contracting officer evaluates proposals based on stated criteria — typically technical approach, past performance, key personnel qualifications, and price. CIO-SP4 task orders are usually best-value awards, not lowest-price-technically-acceptable (LPTA).
5. Task order award. The agency awards the task order to the contractor offering the best overall value. Task orders can range from hundreds of thousands to hundreds of millions of dollars, with base periods plus option years extending up to five years beyond the CIO-SP4 ordering period.

Fair opportunity requirements: Federal acquisition regulations require agencies to provide all CIO-SP4 contractors in the selected pool a "fair opportunity" to compete for task orders. For orders over $10 million, this means all contractors must receive the RFP. For orders under $10 million, agencies have flexibility to compete among a subset of contractors or even sole-source to a single contractor if justified.

Blanket Purchase Agreements (BPAs): Agencies can establish BPAs under CIO-SP4 for recurring IT services. A BPA sets pre-negotiated rates, terms, and ordering procedures for specific types of services. Once established, the agency can issue task orders under the BPA with reduced competition, creating more predictable revenue for contractors. Learn more in our BPA Agreements Guide.

CIO-SP4 was awarded in November 2022 through a competitive solicitation, and the contractor pool is now closed. You cannot apply for CIO-SP4 today. However, NITAAC periodically opens on-ramp opportunities to add new contractors to existing GWACs or launches new contract generations.

CIO-SP4 On-Ramp (if available): NITAAC has historically offered on-ramps for CIO-SP contracts, allowing new contractors to join the vehicle between major re-competitions. Monitor NITAAC's website and SAM.gov for announcements of CIO-SP4 on-ramp solicitations. If an on-ramp is announced, it will be a competitive process similar to the original award, with evaluation of technical capabilities, past performance, and price.

Preparing for CIO-SP4 opportunities: Whether competing in a future on-ramp or the next CIO-SP generation (CIO-SP5), prepare by:

• Building IT services past performance. NITAAC heavily evaluates past performance on similar IT services contracts. Win and execute IT projects with federal agencies through other vehicles like GSA MAS, Alliant 2, or standalone contracts. Ensure strong CPARS ratings. Learn more in our CPARS Guide.
• Developing technical expertise. Demonstrate capabilities in emerging technologies like AI/ML, cloud computing, cybersecurity, and data analytics. Obtain relevant certifications (AWS, Azure, Google Cloud, CISSP, PMP, etc.) and hire technical talent with federal IT experience.
• Strengthening financial stability. NITAAC evaluates financial health and operational capacity. Maintain strong financial statements, adequate bonding capacity, and sufficient cash flow to perform large IT contracts.
• Determining your pool. Decide which pool(s) you'll pursue. If you're a small business, determine whether you qualify for Pool 2 (general small business), Pool 3 (8(a) or HUBZone), or Pool 4 (SDVOSB). Ensure your certifications are current and you meet SBA size standards.
• Monitoring NITAAC announcements. Subscribe to NITAAC updates at nitaac.nih.gov to receive notifications about on-ramps, new solicitations, and industry events.

Subcontracting option: If CIO-SP4 on-ramps are not available, you can participate in CIO-SP4 task orders as a subcontractor. Many CIO-SP4 primes seek subcontractors to access specialized capabilities, meet small business subcontracting goals, or expand capacity. Subcontracting allows you to build past performance on CIO-SP4 work, which strengthens your competitiveness for future NITAAC opportunities.

If you're a CIO-SP4 contractor, the contract alone doesn't guarantee revenue. Task orders are competitively awarded, and you must actively compete to win work. Here's how to succeed:

• Monitor RFPs closely. NITAAC provides a task order notification system for CIO-SP4 contractors. Set up alerts and review every RFP issued in your pool(s). Even if you choose not to bid, staying informed helps you understand agency priorities and evaluation trends.
• Build agency relationships early. Many CIO-SP4 task orders are won by contractors who engaged with the agency before the RFP was released. Attend agency industry days, respond to requests for information (RFIs), and conduct capability briefings with program managers and contracting officers. Agencies prefer working with contractors they know and trust. Learn more in our Customer Relationship Building Guide.
• Invest in formal capture management. Large CIO-SP4 task orders (multi-million dollar programs) require disciplined capture planning. Identify high-value opportunities early, develop win strategies, shape requirements through pre-RFP engagement, and assemble teaming partnerships before the RFP drops. Learn more in our Capture Management Guide.
• Differentiate your technical approach. CIO-SP4 task orders are typically best-value awards, meaning technical merit and past performance matter as much or more than price. Develop innovative solutions, demonstrate deep mission understanding, and show how your approach delivers measurable outcomes while mitigating risk.
• Showcase strong past performance. Agencies heavily weight past performance in CIO-SP4 evaluations. Maintain excellent CPARS ratings, document successful project outcomes with quantifiable results, and highlight similar work performed for other agencies. If you lack federal past performance, emphasize relevant commercial or state/local projects.
• Form strategic teaming arrangements. For complex, large-scale task orders, consider teaming with other CIO-SP4 contractors or specialized subcontractors. Teaming combines complementary capabilities, shares risk, and offers more comprehensive solutions. Learn more in our Teaming Agreements Guide.
• Price competitively but sustainably. While price is important, CIO-SP4 is not a low-price race. Agencies seek value, not just the cheapest option. Price your proposals to be competitive while maintaining healthy margins. Underbidding and losing money during performance damages your reputation and threatens contract execution.
• Request debriefings after losses. If you lose a task order competition, request a debriefing from the contracting officer. Debriefings provide valuable insights into evaluation weaknesses and areas for improvement. Learn from losses and refine your approach for future opportunities. Learn more in our Debriefings Guide.

The most successful CIO-SP4 contractors treat the GWAC as a strategic business development platform requiring continuous investment in capture, agency engagement, and proposal excellence. Winning consistently requires a proactive, mission-focused approach — not a passive "wait for RFPs" strategy.

CIO-SP4 contractors have ongoing compliance obligations. Failing to meet these requirements can result in contract termination or ineligibility for task orders:

• Quarterly sales reporting. You must report all CIO-SP4 task order sales to NITAAC within 30 days after each calendar quarter ends. Reports include task order details, dollar values, and customer agency information. Consistent failure to report can result in contract termination.
• Contract Access Fee (CAF). NITAAC charges a small administrative fee (typically 0.75% to 1%) on all CIO-SP4 sales. This fee funds NITAAC's program management and is paid quarterly based on reported sales.
• Maintain SAM.gov registration. Keep your SAM.gov registration active at all times. An expired SAM.gov registration prevents task order awards and can lead to contract termination.
• Maintain socioeconomic certifications. If you hold a CIO-SP4 contract in Pool 2, 3, or 4, you must maintain your small business or socioeconomic certification to remain eligible for set-aside task orders. Notify NITAAC immediately if you lose a certification or exceed SBA size standards.
• Update company information. Notify NITAAC of any changes to company name, address, ownership, key personnel, or other contract-relevant information through contract modifications.
• Respond to NITAAC communications. NITAAC conducts periodic compliance reviews and may request updated financial statements, certifications, or other documentation. Timely, complete responses are required to maintain good standing.
• Maintain strong past performance. Agencies report CIO-SP4 contractor performance in CPARS. Excellent performance ratings improve your competitiveness for future task orders; poor ratings damage your reputation and can lead to fewer opportunities. Learn more in our CPARS Guide.

Set calendar reminders for quarterly reporting deadlines and CAF payments. Treat your CIO-SP4 contract as a high-value asset requiring regular attention and proactive management. The compliance burden is minimal — a few hours per quarter — but neglecting it risks losing the contract.