What the Fixed-Price Order Means for Federal Cyber Recompetes

Executive Order 14402 makes fixed price the federal default, and much of the government's expiring cyber work runs on cost-type terms. SCOUT data shows how far the order reaches into the coming year of recompetes and why the next round of cyber awards could test who can compete on fixed price. Every contract figure here comes from PrimeRFP's SCOUT.

Cost-Type Awards Now Need Senior Sign-Off

The President signed Executive Order 14402 on April 30, 2026. A contracting officer must justify in writing any use of a cost-type contract, and a cost-type contract above $10 million needs written approval from the agency head or a designated non-career senior official. The threshold rises to $25 million at the Department of Homeland Security (DHS), $35 million at the National Aeronautics and Space Administration (NASA), and $100 million at the Department of War.

The FAR Council posted class deviation text on July 1 that applies the requirement to task and delivery orders under multiple-award contracts and measures each award by its estimated total value, including options. The council proposed permanent changes to the FAR on September 18, and public comments close October 19, 2026.

Cyber Buying Runs on Cost-Type Pricing

SCOUT counts 41 contracts above $10 million described as cybersecurity work that end their current period of performance within 12 months. Those contracts carry $1.66 billion in obligations, cost-type pricing covers 45% of the dollars, and the Department of War holds more than half of the total.

The full market follows the same pattern. Cost-type contracts account for 43% of the $517.05 billion across 7,349 contracts above $10 million that expire in the same window. About 500 of them, worth about $178 billion, exceed the order's approval thresholds, led by 195 Department of War contracts worth $80.8 billion. GSA runs higher, with 74% of its $16.8 billion in expiring contracts and orders above $50 million on cost-type terms.

Two GSA Task Orders Show the Range

Two General Services Administration (GSA) cyber operations task orders that end in January 2027 show how pricing shapes competition. Peraton Technology Services won Cyberspace Operations Support Services (COSS) as the only bidder in an open competition among vehicle holders, and it reports one subaward worth $231,000 against $93.4 million in obligations. General Dynamics Information Technology (GDIT) won the Guard Enterprise Cyber Operations Support order on Alliant 2 against two competing offers, and it reports $109.2 million, or 48% of obligations, in 66 subawards to 26 subcontractors.

Both orders carry total values above $100 million, so a cost-type follow-on of similar size would cross every threshold in the order. Cost-type work requires an accounting system the government has found adequate, and a fixed-price follow-on removes that barrier for firms that lack one.

What It Means for Capture Teams

Four moves follow, in order of urgency.

• Comment on the rule. Firms that want a voice in the permanent rule can file comments with the FAR Council through October 19.
• Single-bid targets. Cost-type orders above their agency's threshold that drew one bid last time give a challenger the clearest opening.
• Fixed-price models. Capture teams that bring a fixed-price version of the scope to the contracting office before the follow-on strategy sets give the agency a ready alternative to the incumbent's pricing.
• Teaming routes. On high flow-through orders such as GDIT's, the subcontractors hold past performance on the mission and can position as primes or as teammates for a challenger.

SCOUT connects each expiring contract to its bid count, pricing type, total value, subcontract flow-through, and end date, and Policy Intelligence tracks agency implementation of the order with a cited source for each signal, all in one view. Both task orders here have free pages on PrimeRFP's Intel Hub: COSS and Guard Enterprise Cyber Operations Support. Get started with a free Exposure Check to see contracts by company, UEI, or NAICS code: Run the Exposure Check.

Method: Contract counts and values draw on USASpending.gov and show obligations to date as of October 5, 2026. Cybersecurity figures cover contracts whose award descriptions name cybersecurity work. Threshold counts compare obligations with each agency's approval threshold, so they understate contracts whose full value with options would cross it. Order requirements come from the executive order, the FAR Part 16 class deviation text, and the FAR Council's proposed rule.

The Federal Capture Brief publishes on LinkedIn with each week's capture signals and the recompetes behind them. Subscribe on LinkedIn →