Federal IT

Federal agencies are tightening controls for AI procurements, with GSA safeguards covering data handling, supplier due diligence, foreign influence, human oversight, and incident reporting. DoD guidance emphasizes vendor transparency and enforcement, including a 15-business-day response window; the roundup identifies no specific solicitation or award.

The IRS is testing an agentic AI tool to handle clerical work after existing machine-learning models flag potentially fraudulent tax returns. The pilot could create future opportunities in secure document processing and data interoperability, but the agency has announced no deployment timeline, solicitation, or contract value.

CISA’s Binding Operational Directive 26-04 requires covered civilian agencies to prioritize software vulnerability remediation by risk, with the highest-risk tier due within three days. Contractors are not directly covered, but agencies may impose similar timelines and evidence requirements through contracts and security programs, increasing the importance of continuous exposure tracking and auditable records.

WidePoint reported 27% year-over-year revenue growth and a $209 million backlog for Q3 2026, while its two-cent-per-share loss missed expectations. Its federal pipeline includes the pending DHS CWMS 3.0 competition, active SEWP VI ordering, and an anticipated Census 2030 RFP, alongside $33.7 million in Q3 CWMS bridge task orders.

A Washington Technology podcast explores how rapid advances from frontier AI labs are changing cybersecurity tradecraft, cyber-defense budgeting, and government-industry partnerships. The discussion offers strategic context for federal contractors, but identifies no solicitation, award, funding amount, procurement timeline, or point of contact.

inDirectIT appointed retired Air Force veteran and former CMMC Level 2 lead assessor Alexy Johnson as Director of Compliance Services. The hire reflects continued contractor demand for CMMC readiness and NIST-aligned support, even as the Pentagon’s planned second phase is suspended and applicable self-assessment and CUI protection obligations remain in effect.

Patrick Newbold will leave CMS on November 27, with Information Systems Group Director Mark Plaugher serving as acting CIO while the agency searches for a permanent successor. Contractors should plan for leadership continuity and connect technology proposals to measurable outcomes across modernization, cybersecurity, cloud services, and responsible AI—without assuming a change in requirements or a new procurement.

TYCHON argues that cryptographic discovery must lead to traceable remediation, connecting findings to asset owners, business risk, dependencies, authorized changes, and verification. The sponsored article highlights potential requirements for federal cryptographic inventory and post-quantum readiness efforts, but identifies no solicitation, award, funding, or procurement timeline.

Red Hat’s RHEL 10.3 release adds sealed images for Image Mode, post-quantum cryptography features aligned with CNSA 2.0 requirements, and self-managed AI assistance for disconnected environments. This is a product update, not a procurement award or solicitation, but it may inform federal technology evaluations, security reviews, and deployment planning.

Accenture Federal Services appointed Edward Wood as CTO, underscoring its focus on commercial networking, cybersecurity, cloud, and agentic AI for federal customers. The leadership move is not a contract award or solicitation, but it offers contractors a signal of potential teaming and competitive priorities.

Qualys reported Q3 2026 revenue of $188 million, up 10.7% year over year, and raised its full-year adjusted EPS outlook, citing federal demand and adoption of automated, AI-enabled remediation. CISA’s BOD 26-04 72-hour remediation requirement may increase agencies’ interest in these capabilities, but the reported results do not identify a specific solicitation, award, or contract opportunity.

President Donald Trump has nominated Palantir Chief Information Security Officer Michael LoSapio to lead CISA, which has lacked a Senate-confirmed director since January 2025. Confirmation timing is uncertain, and the leadership transition could affect agency priorities, oversight, staffing, and service reviews—but no contract or procurement action is announced.

CISA’s enhanced web-based incident form collects more detailed information, including expanded incident classifications and MITRE ATT&CK-aligned activity questions. Federal civilian agencies must report incidents, while submissions from other organizations remain voluntary; contractors supporting federal cyber operations may need to align response workflows with the updated form.

NIST has finalized ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), while FN-DSA remains unpublished and nine additional candidates continue through evaluation. Federal agencies have a December 31, 2031 target for migrating digital signatures, creating a planning window for suppliers to document support, algorithm agility, and upgrade paths.

System One appointed John Heneghan CEO of its government solutions business on November 10, 2026, tasking him with expanding market share, scaling services, and strengthening customer relationships. The move signals a growth strategy, but includes no new award, solicitation, or procurement timeline.

DOGE Acting Administrator Amy Gleason described a possible evolution from America.gov to authenticated digital services and AI agents, with chatbots potentially replacing agency websites over time. The concept points to potential demand for secure AI implementation, integration, and human-centered design, but no solicitation, contract value, or procurement timeline has been announced.

Reps. Don Beyer and Sara Jacobs plan to release an initial AI safety legislation draft by the end of 2026, with House floor readiness targeted for the first quarter of 2027. Potential provisions could shape future contractor expectations around AI testing, safety reporting, evaluations, liability, and export controls, but no current procurement requirement or compliance deadline has been identified.

A discussion on security in a post-AGI environment highlights agent authorization, prompt-injection resistance, rapid access revocation, and verification as important challenges. For federal buyers and contractors, these concerns offer potential criteria for evaluating agentic AI security, but the discussion identifies no agency requirement or procurement opportunity.

Rep. James Walkinshaw is urging the next Congress to revive annual FITARA-style IT oversight scorecards and broaden them to measure federal AI adoption, cybersecurity, modernization and digital customer service. The proposal could sharpen scrutiny of agency IT outcomes, but it is a policy direction—not a current mandate, solicitation or funding announcement.

The Treasury Common Services Center is actively recruiting IT professionals and expects its team to grow, while Treasury promotes broader AI adoption and technology collaboration. The workforce signal may inform future demand for IT engineering and process modernization, but it identifies no solicitation, contract award, or procurement timeline.

Dropzone AI’s AI SOC Analyst achieved FedRAMP High (Class D) certification through Second Front Systems’ 2F Game Warden platform, making it eligible for federal agencies to evaluate for security operations and alert investigation. Agencies still need their own authorization and acquisition steps; no contract, funding, or procurement deadline was reported.

NIST finalized IR 8547, establishing a staged federal path to replace quantum-vulnerable cryptography across interconnected infrastructure. Suppliers and agencies should assess product dependencies and account for hardware lead times as they plan toward key-establishment adoption by 2030, digital-signature adoption by 2031, and broader migration by 2035.

A Washington Technology commentary urges agencies and contractors to test AI in focused pilots embedded in existing workflows, measuring operational outcomes against established baselines rather than adoption alone. Defined human-review limits and documented results can help agencies decide whether to scale, revise, or stop an initiative; the article identifies no specific procurement opportunity.

A Federal News Network commentary recommends that agencies publish service-level scorecards for AI spending, but the proposal is not an announced government policy or procurement. Rising reported AI use cases and reduced federal staffing make measurable outcomes, workforce readiness, and acquisition performance important considerations for agencies and contractors.

The NSA, CISA and Australia’s ASD’s ACSC released vendor-neutral questions to help organizations assess third-party readiness for post-quantum cryptography. Procurement teams can apply them in sourcing, renewals and ongoing vendor assurance to identify cryptographic dependencies and transition risks; the guidance is voluntary, not a solicitation or compliance mandate.

NIST SP 800-53 AC-6 calls for limiting, reviewing, and logging privileged access, including permissions held by processes acting for users. Separately, the UK Information Commissioner’s Office is seeking evidence on agentic AI through November 20, 2026; this is not a procurement or compliance deadline, but a chance for organizations to inform its work.

FedRAMP confirmed Perplexity Enterprise and API Platform as the first fully compliant 20x Class C (Moderate) service, making it available for eligible federal use. Agencies can access Enterprise Pro for Government through GSA’s OneGov offer for $0.25 per agency through March 31, 2027, but the certification does not automatically authorize every workload or CUI use case.

A Federal News Network commentary says agencies should distinguish AI-agent identities from human identities, document agent ownership, and require human authorization for high-risk actions. The analysis signals potential future demand for identity assurance, IAM integration, governance, and audit capabilities, but identifies no funded opportunity or solicitation.

NIST plans to update SP 800-61 and develop additional guidance for AI-related cyberattacks, misuse, malfunctions, and unintended agent behavior. The effort signals standards-development engagement—not an active procurement—with contractors potentially able to contribute through a planned community and Task Group 8.

MeriTalk is offering a GuidePoint Security-sponsored whitepaper on using AI-enabled behavioral defenses against AI-assisted cyberattacks targeting federal networks, personnel, and procurement processes. The informational resource cites FBI Internet Crime Complaint Center data showing an average business email compromise loss of $129,185 per incident; it is not a solicitation, award, or funding opportunity.

GDIT and AppGate signed a strategic collaboration agreement to integrate AppGate zero-trust capabilities into GDIT’s Everest solutions for federal missions. The announcement signals potential demand across enterprise IT, operational technology, inter-agency, and tactical-edge environments, but identifies no contract award, solicitation, contract value, or procurement timeline.

Crytica Security’s RDAi device-level operational technology threat-detection solution is now available to federal and state, local, and education buyers through Carahsoft’s reseller network, NASA SEWP V, and NASPO ValuePoint. The partnership creates an existing-vehicle purchasing path for agencies evaluating OT cybersecurity, but the announcement provides no pricing, contract value, solicitation deadline, or specific deployment requirement.

Carahsoft has added cBrain’s F2 government software platform and related services to its NASA SEWP V contract, giving federal agencies an established procurement route. This is a distribution-channel development, not a new award or solicitation; the announcement provides no pricing, ceiling, or agency-specific requirement.

A Forrester Consulting study commissioned by Hack The Box modeled a 330% three-year ROI for cybersecurity workforce readiness at a composite organization with more than 300 security staff. The results may inform government and contractor business cases for hands-on training, but are not a procurement announcement and should be weighed against the study’s assumptions and seven-customer interview sample.

CVE-2026-97631 is a Red Hat-rated CVSS 8.8 out-of-bounds write in EDK2’s PXE network-boot driver, with potential for unauthenticated code execution before startup or denial of service. Exposure is limited to affected RHEL and OpenShift environments during network boot; the report identifies no contract or procurement opportunity.

IBM launched Quantum Safe tools to inventory cryptographic dependencies, identify vulnerabilities, and plan post-quantum cryptography migration. NIST’s final IR 8547 guidance sets 2035 as the federal transition target, with earlier 2030 key-exchange and 2031 digital-signature deadlines for the most critical systems; no federal solicitation, award, or endorsement of IBM is identified.

Oddball appointed public-sector technology executive Jay Tansing as chief strategy officer to lead strategy, acquisitions, and technology partnerships. The move supports the company’s goal of expanding across federal agencies and pursuing larger programs, while its participation in a December 3 healthcare summit offers an industry-engagement touchpoint for military health technology firms.

Cisco reports active exploitation of CVE-2026-76418, an unauthenticated vulnerability affecting ASA and FTD firewalls that can force devices to reload and disrupt VPN and network availability. Agencies and contractors should identify exposed devices and prioritize upgrades to fixed releases; disabling secondary authentication is only a temporary mitigation with security and compliance trade-offs.

A MeriTalk feature describes how AI-driven vulnerability discovery and exploitation are increasing federal focus on trusted open-source software components and resilient supply chains. Contractors should be prepared to demonstrate SBOMs, provenance, attestation, and rapid remediation—including for classified and air-gapped environments—but the source identifies no specific procurement or award.

Socure appointed Rohan Sivaram as CFO while expanding identity, fraud, and AI-enabled casework offerings for government missions. Federal buyers and integrators can assess the FedRAMP-authorized version of RiskOS for mission fit; the announcement does not identify a contract award or solicitation.

NIST has proposed 10 design tenets for managing AI-agent identities and access, including verifiable identities, least-privilege permissions, human review of high-risk actions, and tamper-evident logs. The guidance is not a procurement announcement or stated mandatory requirement, but offers federal buyers and contractors a reference for shaping and evaluating AI security capabilities as NCCoE demonstrations explore supporting standards and technologies.

RAID-AI offers a free, manual self-assessment for identifying ransomware-resilience gaps across AI systems, mapping controls to NIST Cybersecurity Framework 2.0 and CISA Cybersecurity Performance Goals 2.0. It is a voluntary reference—not a solicitation or funded procurement—but may inform agencies’ security evaluations and contractors’ AI assessment and remediation services.

Booz Allen’s Dr. Jordan Kenyon says federal quantum readiness requires agencies to move beyond cryptographic inventories and build the acquisition, workforce, engineering, and operational capacity to implement solutions. The source describes PQC milestones and a cited estimate exceeding $7 billion for federal non-national security system transitions, but identifies no current solicitation or funded opportunity.

NIST’s final NISTIR 8547 guidance sets December 31, 2030, for post-quantum key-establishment migration and December 31, 2031, for digital signatures on federal high-value assets and high-impact systems, with broader migration targeted by 2035. Federal contractors should inventory cryptographic dependencies, update product roadmaps, and prepare for procurement needs in implementation, interoperability, and supply-chain assessment.

A reported breach exposed searchable records on more than 41,000 current and former DHS employees and contractors, including personnel at CBP, ICE, and CISA. DHS says it is addressing a potential breach; the reports identify no related solicitation, award, or contract action, but raise operational cybersecurity and workforce-protection concerns for contractors supporting the department.

CISA added two actively exploited PHP vulnerabilities to its Known Exploited Vulnerabilities catalog and required federal civilian agencies to remediate them by October 29, 2026, including forensic triage for potential compromise. The deadline creates immediate work for contractors supporting federal websites and IT systems, particularly in asset discovery, patching, exposure assessment, and incident response; no specific solicitation or award is identified.

Executive Order 14412 and agency guidance elevate post-quantum cryptography (PQC) migration as a federal cybersecurity and acquisition priority, with milestones extending through 2031. Contractors should assess cryptographic dependencies, support approved quantum-resistant algorithms and cryptographic agility, and use the November 10, 2026, Homeland Security Summit as an industry engagement opportunity.

Dragos Public Sector expanded its xOT cybersecurity capabilities and named former U.S. cyber and defense leaders to its board, while positioning Accenture Federal Services as a federal go-to-market and delivery channel. The announcement aligns the offering with agency security deadlines but identifies no solicitation, contract value, award, or procurement contact.

Assail has launched Assail Federal to bring its Reaper autonomous offensive AI platform and dedicated federal-market infrastructure to U.S. government, defense, and national security organizations. The announcement signals a potential new supplier and teaming prospect, but identifies no solicitation, award, contract value, acquisition vehicle, or specific agency requirement.

Worldwide NFT Inc. signed a nonbinding letter of intent to acquire all of an undisclosed Mid-Atlantic cybersecurity software and services provider serving the U.S. federal government. The proposed deal targets a year-end 2026 close, but due diligence and definitive agreements remain outstanding, and no purchase price or contract details have been disclosed.