13 Jul 2026CMMC Phase II suspended: no C3PAO assessments can be designated. DFARS 7012 and Rev 2 still apply.What changed, and what did not →
MacZine
The MacTech Solutions Newsletter
Issue Nº 056 ·

Analysis · Capture

Bid/No-Bid: The Pursuits a Small Contractor Should Kill Early

Small defense contractors lose more money bidding too much than too little. Seven bid/no-bid questions, worked against two real 541512 awards.

A small defense contractor rarely gets into trouble because it bid too little. The slower failure is a pipeline nobody had the nerve to prune: three proposals in flight at once, the best engineer writing management volumes at midnight instead of billing, and a bid and proposal pool that lands in next year's indirect rate whether the company wins or not. Every proposal is paid for out of overhead. The ones that should never have been written get paid for twice, once in their own cost and again in the stronger pursuit the team was too stretched to chase properly.

Bid/no-bid discipline is the habit of asking a short run of questions in a fixed order, each able to end a pursuit before the next one costs anything. The cheap questions go first. To show how fast the answers come, we pulled two real awards in NAICS 541512, Computer Systems Design Services, from USASpending this week and ran them through the same gates a capture lead should.

Who holds this work now, and when does it come back?

Start with the award history, because it is free and it often settles the matter. The first record is a Navy order for cybersecurity operations and maintenance, funded by the Cruise Missile Support Activity and awarded by NAVSUP Fleet Logistics Center Norfolk in August 2023 to Command Cyber Solutions LLC of Milwaukee, a tribally owned 8(a) firm. The record shows an 8(a) sole source citing the statutory authority at FAR 6.302-5(a)(2)(i), one offer received, firm fixed price, $2,133,731 obligated against $3,005,651 in base and options, and a potential end date of December 31, 2028.

For any firm outside the 8(a) program, the answer is already in. There was no competition to enter, and if the options are exercised there will be none for more than two years. Put a reminder on the 2028 calendar and move on. The whole answer took five minutes.

The second record is the interesting one. An Army order for help desk, IT operations and cybersecurity services, funded by U.S. Army North and performed in San Antonio, went to Digital Consultants LLC in May 2023. It carries $11,869,315 in obligations, and its current end date and its potential end date are the same day: November 14, 2026. No options remain. That is what a recompete signal looks like in the data.

The same record says why most readers still should not chase it. The order was placed under a GSA government-wide acquisition contract competed among 8(a) firms, as a fair-opportunity competition among that vehicle's holders, and it drew 23 offers. If the follow-on goes back to the same vehicle and you do not hold it, you are bidding for a subcontract, not a prime. The record shows the past, not the next solicitation, and the Army may buy the follow-on another way. Watch for the notice before you spend anything on it.

Is it set aside for a firm like yours, and can you perform it under that set-aside's rules?

Set-aside fit goes past eligibility. On a set-aside services contract, 13 CFR 125.6(a)(1) bars the prime from paying more than 50 percent of what the government pays it to subcontractors that do not share its status. A small firm planning to win an SDVOSB set-aside and hand most of the labor to a large teammate has built a compliance problem into its teaming plan, and it will surface during performance. If you cannot staff at least half the work with your own people or similarly situated partners, the set-aside is not yours. Where SDVOSB money actually goes is worth reading alongside this one.

How will the government choose?

For DoD services in this space, the default answer is tradeoff. DFARS 215.101-2-70 allows lowest price technically acceptable only when eight conditions all hold, and tells contracting officers to avoid it, to the maximum extent practicable, for information technology and cybersecurity services. So when a cybersecurity requirement does arrive as LPTA, read it as a message. The customer has decided the work is a commodity and that nothing above the minimum is worth paying for. Whatever makes your firm better goes unscored, and the bidder with the lowest loaded rates wins.

A tradeoff gives a small firm room, but only if it can name a discriminator in Section M's own terms. If the capture team cannot write one sentence that an evaluator would score as a strength, the pursuit is a price shootout dressed as a best-value competition.

Does the work require a clearance you do not have?

If the solicitation carries a DD Form 254, read it before the statement of work. Under 32 CFR 117.9(a)(10), a contractor cannot apply for its own facility clearance; a government contracting activity or a cleared contractor has to sponsor it, though that sponsorship can happen during the solicitation phase. No sponsor, no facility clearance, and no amount of proposal polish changes that. The same applies to key personnel whose clearances the PWS requires at start of performance.

What CMMC level does the solicitation name, and do you hold it today?

Reading the cybersecurity clauses is its own discipline, and the status of the certification clause has been moving all year (our class deviation coverage tracks it). The bid/no-bid question is narrower, and it is about time. A response window is measured in weeks, and a security posture is not built in weeks. If winning depends on finishing remediation between the proposal and award, either price that work into the bid on purpose or pass.

What would you have to charge to win, and can you live on that number?

Price-to-win starts with arithmetic the award history hands you. The Army order spent about $11.87 million over roughly three and a half years, or about $3.4 million a year, firm fixed price, for help desk, IT operations and cybersecurity at one installation. Divide that by your own fully loaded annual cost per seat. The result is how many people the incumbent's price buys at your rates. If that number is smaller than the PWS plainly needs, you will lose on price or win and lose money. Do not assume the follow-on budget will be larger because you would like it to be.

The cheapest proposal a small firm ever writes is the one it decides, on day two, not to write.

Who on your payroll would actually do the work?

Name the people already on staff, their start availability, their clearances and where they live. The Army work is performed in San Antonio, and a bench in northern Virginia is a relocation budget or a contingent-hire letter, each of which an evaluator can read for what it is. Staffing also feeds back into the 50 percent rule. Every seat you cannot fill yourself goes to a teammate, and a teammate outside your status counts against the limit.

What does a no-bid buy you?

It buys back the hours, the overhead and the attention that a better-fitted pursuit needs. It should also leave a record. A no-bid with written reasons tells next year's capture lead why the firm passed on this agency and what would have to change before it tries again.

MacTech runs its own pipeline this way. In CaptureOS, the capture platform we build and use, a pursuit cannot move into the Proposal column until someone records a Bid decision, and that column holds at most three pursuits at a time. The software does not choose for anyone. It only refuses to let a proposal start before somebody has decided to write it. That is about the right amount of help, because the decisions above are judgment calls, and the firm that makes them early and writes them down bids less often, with more to give each bid it keeps. If a live solicitation is on your desk and the answer is not obvious, talk to us before the first volume gets drafted. ◆

Pass this along

No trackers, no scripts - these are ordinary links.

Tools and guides for this topic

MacZine: compliance, argued.

Short practitioner pieces on what DFARS, NIST 800-171 and CMMC actually require, with the clause cited. New issues most weekdays.

No sales sequence, no sharing your address. Unsubscribe with one reply.