When a federal agency needs information technology services, it has several large contract vehicles to choose from — and for small firms, the most important of them after the GSA vehicles is CIO-SP3. Run by the National Institutes of Health, CIO-SP3 is a government-wide acquisition contract for IT services with a large small-business pool, and it is one of the most heavily used IT vehicles in the federal government.
This guide explains what CIO-SP3 is, who can hold it, what services it covers, how task orders work, and how a small firm should think about it alongside the other IT vehicles — plus what to do if you missed the original award.
What Is CIO-SP3?
CIO-SP3 — the Chief Information Officer – Solutions and Partners 3 contract — is a multiple-award, indefinite-delivery indefinite-quantity contract managed by NIH’s Information Technology Acquisition and Assessment Center, known as NITAAC. It is a GWAC, which means any federal agency can order IT services through it, and only the contract holders can compete for its task orders. The vehicle carries a very large ceiling — tens of billions of dollars — and it has been one of the government’s most active IT vehicles for years.
CIO-SP3 is organised into two main tracks: a small-business track and an unrestricted track. The small-business track is reserved for small firms, and it is where a small IT company competes — against other small firms, not against the large primes that dominate the unrestricted track. Within the small-business track there are further set-aside pools, including 8(a), HUBZone, and SDVOSB pools, so a firm with a certification competes in an even narrower field.
What Services Does CIO-SP3 Cover?
The vehicle’s scope is broad and organised into ten task areas that cover the full range of IT services. They include IT services for biomedical research, health sciences and healthcare; chief information officer support; imaging; outsourcing; IT operations and maintenance; integration services; critical infrastructure protection and information assurance; digital government; enterprise resource planning; and software development. In practice, the vehicle covers almost any IT service a federal agency might need, from help-desk support to complex systems integration and cybersecurity.
The scope is deliberately wide because NIH designed the vehicle to serve the whole government, not just health agencies. The Department of Defense, the Department of Homeland Security, civilian agencies, and many others order through CIO-SP3. For a small IT firm, the practical question is not whether the vehicle covers your services — it almost certainly does — but whether your firm’s past performance maps to the task areas where the work is actually being ordered.
How Task Orders Work
As with other GWACs, the work on CIO-SP3 comes through task orders. An agency posts a task-order request to the holders in the relevant track and pool, the holders submit proposals, and the agency awards the order to one of them. The competition is limited to holders, which is the vehicle’s core value: once you are in, you are competing in a closed pool rather than in the open market.
Task orders on CIO-SP3 range from short, small engagements to multi-year efforts worth tens of millions of dollars. They can be fixed-price, cost-reimbursement, or time-and-materials, depending on the agency’s need. The ordering process is run through NITAAC’s systems, and the agency sets the requirements and evaluation criteria for each order. Firms that win consistently invest in a fast, disciplined task-order proposal process — the ability to turn around a strong proposal in a week or two is a competitive advantage in itself.
Our guides on IDIQ task order competition and how task orders work under IDIQ contracts explain the mechanics that apply here too, since CIO-SP3 is an IDIQ vehicle at its core.
CIO-SP3 vs OASIS+ vs STARS III
A small IT firm will usually consider three vehicles: CIO-SP3, OASIS+, and 8(a) STARS III. They overlap, but they are not interchangeable.
CIO-SP3 is the broadest IT vehicle: its scope covers nearly all IT services, it is open to small businesses generally, and it is heavily used by agencies across the government. Its small-business track is competitive, but the volume of work is large.
OASIS+, run by GSA, covers professional services including IT, and it has small-business pools of its own. Its scope is wider than IT — it covers management consulting, engineering, and other professional services — which makes it a better fit for a firm whose work spans IT and advisory services. Our guide on OASIS+ explained covers it in detail.
8(a) STARS III is reserved entirely for 8(a) firms. If you are 8(a) certified, it offers the narrowest competition of the three, but it is closed to everyone else and it ends when your 8(a) term ends.
The right strategy for most small IT firms is to hold a place on more than one vehicle. CIO-SP3 and OASIS+ together cover most of the IT and professional-services work a small firm will encounter, and a GSA Schedule — see our guide on how to get on GSA Schedule — gives you a route for smaller, faster buys that do not go through a GWAC at all. Our guide on how to get on a GWAC explains the application process that applies to all of these vehicles.
How to Get On — and What If You Missed the Award?
CIO-SP3, like other GWACs, is awarded through a competitive solicitation that opens only every several years. The evaluation weighs relevant past performance, corporate experience, and proposed labour categories and rates, and the number of awards is limited. A firm that wants a place needs a record of IT work for federal or commercial customers, a current SAM.gov registration, and a proposal that maps its experience to the vehicle’s task areas.
If you missed the original award, the route in is the on-ramp: a later solicitation that adds new holders to the existing vehicle. On-ramps open when the managing agency decides the vehicle needs more holders, and they are announced on SAM.gov. There is no fixed schedule, so the practical move is to monitor the vehicle, build relevant past performance now — through subcontracting, teaming, and smaller contracts — and be ready to propose when the on-ramp opens. The solicitation window is short, often 30 to 60 days, and a proposal built from scratch in that time is rarely competitive.
What Small Firms Should Do Now
Check your eligibility and registrations. Confirm your small-business status, keep your SAM.gov registration current, and make sure your NAICS codes match the IT services you sell.
Build the record. Win IT work as a subcontractor or on smaller contracts, and document your results. Past performance is the single biggest factor in a vehicle award.
Study where the work is. Look at the task orders agencies actually place through CIO-SP3 — the task areas, the agencies, and the size of the orders — and shape your capability statement around the areas where demand is real.
Price realistically. Know your indirect rates and your fully loaded labour costs before you propose. Our guides on indirect rates and how to build a price proposal explain the costing that underpins a competitive rate.
Do not put everything on one vehicle. A GSA Schedule, a place on OASIS+ or STARS III, and a CIO-SP3 position are complementary, not alternatives. Each one opens a different slice of the market, and together they protect you if one vehicle closes or your eligibility changes.
The Bottom Line
CIO-SP3 is NIH’s government-wide IT vehicle and one of the most heavily used contract vehicles in the federal government, with a large small-business track and set-aside pools that let small firms compete against peers rather than primes. Getting on requires relevant IT past performance and a strong proposal, and if you missed the original award, the on-ramp is the way in. For a small IT firm, CIO-SP3 belongs in the vehicle strategy alongside OASIS+ and a GSA Schedule — and the work of getting there starts with the past performance you build today.