The 90-Day Window: Federal Contracts Expiring Q4 2026 That Nobody's Tracking

Executive Summary

Q4 FY2026 closed yesterday. Q1 FY2027 opens with a recompete calendar that is heavier than most capture teams have planned for: 921 contracts in four sectors, 391 of them ending in December alone.

The headline dollar figure needs one honest adjustment. TriWest's TRICARE T-5 West contract ($8.40B obligated) and Vectrus's LOGCAP V order for Army Prepositioned Stocks-5 ($1.84B) account for 65% of the value. Neither is likely to hit open competition this quarter. Strip them out and the actionable pipeline is 919 contracts worth $5.62B.

Three patterns stand out. A large share of these contracts already passed their current period-of-performance end and are running on extensions. December 31 is a cliff in every sector. And roughly a third of the value in cyber, cloud, and non-TRICARE healthcare carries a small-business set-aside code.

How to Read This Report

SCOUT's recompete engine scans USASpending prime-contract data for awards whose period of performance ends inside the next three months. Each row carries the incumbent, the PIID, the awarding agency, and the value obligated on that specific order— not the parent IDIQ ceiling. A recompete can come in larger or smaller once scope is rewritten.

Dates marked * are contracts whose current period of performance has already passed. The agency extended them, and the date shown is the extended (effective) end. The † on TRICARE West is explained in the healthcare section. All dates are 2026 unless noted.

Cybersecurity: 43 Contracts, $458.0M, and the Same Names as Q2

DOD holds $365.7M of the $458.0M cyber pipeline across 21 contracts, most of it Navy engineering work on SeaPort-NxG. Tri Star Engineering's $99.7M C3I and cyber engineering order (Nov 29) is the single largest.

The more useful signal is who is stillon the list. Our Q2 edition flagged SimVentions' Navy cyber risk management and A&A order as a June 30 expiration. SCOUT's award history shows the order (N0017821F3010) was modified on June 5 and now runs to October 31, with $87.6M obligated across 105 FPDS transactions since its July 2021 start. Four offerors competed for it originally. The same pattern holds for three other Q2 names:

• Chenega Systems— GSA's 8(a) sole-source bridge for Enterprise Cyber Services, now $12.2M, current PoP ended July 9, extended to November 9.
• AptNexus— Treasury cyber compliance and privacy, 8(a), $6.1M, extended to November 4.
• Copia Consulting Group— Treasury cyber information analysis on GSA MAS, $1.9M, ending October 20.

A bridge that gets bridged again is a requirement the agency has not finished defining. That is the best time to shape it.

Treasury's October 15 cluster.Treasury has 10 cyber contracts in the window worth $33.7M. Three of them, all cybersecurity support BPA orders, end on the same day: ManTech's CyberOps ($5.6M) and Safeguards & Risk Management ($3.6M) orders under BPA 9531CB25A0014, and Gunnison Consulting's Information Security Standards order ($1.4M) under BPA 9531CB25A0013. All three were running past their original end dates. Two BPAs, one office, one expiration date: watch for a consolidated follow-on.

Market context.SCOUT's award summary puts trailing-12-month federal cybersecurity obligations at $52.70B, with a median of two offers per award and 44% of awards receiving a single offer. Incumbents in this market rarely face a crowded field. Showing up early with a credible alternative matters more here than in most categories.

IT Modernization & Cloud: 105 Contracts, $549.7M, Back-Loaded Into December

Cloud is the most fragmented sector in this edition. The median contract is $816K, and DOD's 36% share is the lowest lead-agency concentration of the four. But the dollars are back-loaded: 39 contracts worth $332.3M (60% of sector value) end in December.

Hyperscaler consumption.Amazon Web Services' GSA order (47QDCB21F0015, $101.3M, Dec 13) is the only cloud contract over $100M. Microsoft holds three orders under the same DISA parent IDV (HC105023D0003) worth $84.7M combined: the Enterprise Cloud Management Agency's Azure IL4/5/6 order ($75.5M, Dec 19), DCAA Mission Cloud ($5.0M, Nov 29), and DeCA cloud adoption ($4.2M, Oct 5). Consumption orders like these tend to renew on the incumbent platform. The opening is in the services wrapped around them.

Where the services work is.GovPlace's USCIS cloud hosting order ($47.8M, Oct 31) covers IaaS, PaaS, and SaaS for mission-critical systems and ends in 29 days. Samtek's CMS CCSQ cloud sustainment and modernization order ($38.0M, small business) passed its current end date in February and now runs to November 11. EzteQ's Air National Guard web tools and cloud support ($16.8M, ITES-3S, small business) ends October 31.

One AI signal worth noting.VA's ambient dictation SaaS contract with Abridge AI (36C10G25C0011, $15.0M, Dec 23) buys a cloud-hosted clinical AI product outright, under VA ATO and FedRAMP requirements. Its follow-on will show how VA buys this category the second time around: renewal, competition, or a move onto an enterprise vehicle.

Set-aside share:51 of 105 cloud contracts ($210.0M, 38% of value) carry a small-business, 8(a), SDVOSB, WOSB, or HUBZone code. Lancer Information Solutions' $39.4M IRS VMware order inherits an SDVOSB designation from its SEWP V parent.

Logistics & Supply Chain: 466 Contracts, $5.84B, Almost All DOD

Logistics is the largest sector by count. DOD holds 373 of the 466 contracts and 94% of the value. Nine contracts over $100M account for $3.49B.

LOGCAP V.Vectrus Systems' APS-5 task order (W52P1J19F0400) carries $1.84B in obligations and is the largest single logistics row. Its current period ended June 30; the effective end is now December 30. Two more LOGCAP V orders sit in the window: PAE-Parsons Global Logistics Services' SOUTHCOM order ($85.3M, Nov 20) and KBR's APS-2 Germany maintenance, supply, and transportation order ($30.1M, Oct 20). LOGCAP task orders move inside a closed pool of IDIQ holders, so treat these as subcontracting targets unless you hold a LOGCAP V seat.

Big Safari. Sierra Nevada (Corporation and Company, LLC) holds four orders under Big Safari BOA FA862021G4009 worth $605.5M, ending between October 31 and December 31. The largest, $429.7M, ends December 30.

Foreign Military Sales. Eight FMS sustainment and conversion orders total $728.6M: the Royal Saudi Air Force F-15 conversion (Alsalam, $249.5M), MQ-9 contractor logistics support for France (General Atomics, $229.8M), the Saudi CH-47 maintenance augmentation team (Pinnacle Solutions, $75.7M), the Czech AH-1Z flight training device and CLS (Bell, $51.9M), RSAF F-15 repair and return (Boeing, $35.2M), France-Germany C-130J long-term sustainment (Lockheed Martin, $33.4M), RSLFAC UH-60L trainer and CLS (CAE USA, $30.7M), and RAAF unique integration support (Boeing, $22.4M). FMS recompetes follow partner-nation funding cycles, which makes them harder to time and easier to miss.

The small-business standouts.Falconwood's $202.0M engineering and logistics order for Navy PEO Digital (N0003922F3001, SeaPort-NxG, Dec 9) is the largest small-business set-aside in this entire report. Sentry View Systems' Minuteman III remote visual assessment CLS ($66.0M, Nov 4) and QED Systems' Army logistics support order ($26.9M, Dec 30) follow. Across logistics, 187 contracts worth $712.5M carry a small-business code — 18% of value once the Vectrus order is set aside.

Q2 follow-up: JPATS Logistics Services, which led our Q2 logistics section, is back. Its COMBS III base supply order (FA810623F7504, $117.2M) passed its current end date on December 31, 2025 and now runs to December 31, 2026.

Healthcare & Medical: One $8.4B Outlier and 306 Contracts Worth Watching

† The TRICARE caveat.TriWest's TRICARE T-5 West managed care support contract (HT940223C0002) shows $8.40B obligated and a December 31 period-of-performance end. SCOUT's award history puts the contract's ceiling at $65.14B. A December 31 end on a contract that size marks the close of a performance period, not a quarter-end competition. We include it because it is in the data; we do not count it as an open opportunity.

Without TRICARE, healthcare is 306 contracts worth $616.9M, and the shape changes. VA holds 179 of the contracts ($259.2M), HHS holds 61 ($119.1M), and DOD drops to 34 contracts. This is a volume market: the median contract is $542K.

Defense Health Agency.Beyond TRICARE, three DHA contracts worth $98.2M end this quarter: Luke & Associates' East Region medical coding ($36.8M, Oct 29), Spectrum Healthcare Resources' Fort Belvoir Dumfries and Fairfax clinics ($34.5M, Dec 31 — current PoP ended December 31, 2024), and Peraton's Healthcare Delivery Platform ($26.9M, Oct 9 — current PoP ended December 2025). Two of the three have been running on extensions for most of a year or longer.

VA fragmentation.VA's 179 contracts include Change Healthcare's EDI paper-to-electronic services ($48.6M, Nov 30), two Prometheus Federal Services informatics orders under the Integrated Healthcare Transformation 2.0 IDIQ ($12.4M combined, SDVOSB), and a long tail of facility-level clinical, equipment, and janitorial work. GE Precision Healthcare alone holds 48 equipment maintenance orders worth $31.2M in the window. That is 48 separate renewal decisions for anyone who services imaging equipment.

Indian Health Service. IHS has two emergency physician contracts for the Kayenta Health Center in Arizona ending December 31: Bay Area Anesthesia ($6.8M) and NativeARC II ($4.4M), both under the Indian Small Business Economic Enterprise set-aside. Healthcare has seven ISBEE-coded contracts in the window worth $14.3M.

Set-aside share:73 healthcare contracts worth $226.3M carry a small-business code. Against the non-TRICARE base, that is 37% of value — nearly identical to cyber and cloud.

Cross-Sector Patterns: Three Things Your Team Should Act On

1. The extension treadmill

In cybersecurity, 12 of 43 contracts have already passed their current period-of-performance end and are running on extensions. The pattern repeats across sectors: Vectrus ($1.84B), JPATS ($117.2M), Samtek ($38.0M), Spectrum ($34.5M), Peraton ($26.9M). Some of these extensions run past a year.

An extended contract tells you two things. The agency still needs the work. And the follow-on is late, which usually means the requirement, the vehicle, or the acquisition strategy is still open. That is where a capability briefing changes outcomes.

2. The December cliff

391 of the 921 contracts end in December, carrying $13.69B. Even without TRICARE and the Vectrus order, December holds $3.44B. The concentration on December 30–31 reflects period-of-performance boundaries set to the calendar year. Expect bridge actions and sole-source extensions to cluster in late November and December, when contracting offices run out of time to compete.

3. Set-aside signals

332 of the 921 contracts ($1.31B) carry a small-business, 8(a), SDVOSB, WOSB, HUBZone, or ISBEE code. In cyber (36% of value), cloud (38%), and non-TRICARE healthcare (37%), the share is consistent enough to plan around. Logistics is the exception at 18% outside LOGCAP, and Falconwood's $202.0M PEO Digital order shows that large small-business logistics work exists when it is engineering-led.

What to Do With This Data

For business development leaders

• Pick the 3–5 contracts in your sector where your past performance maps to the scope. Start with the ones marked *: the agency has already shown it is not ready to compete on schedule.
• Pull the award history on each incumbent. How many offers did the original award draw? How many modifications since? SimVentions' A&A order has 105 transactions on it. That is an incumbent embedded in the program office.
• For orders inside closed vehicles (LOGCAP V, SeaPort-NxG, STARS III, SEWP V), decide now whether you are priming through a holder or teaming under one.
• Lock teaming partners before Thanksgiving for anything ending December 31.

For proposal teams

• Watch Treasury's October 15 cyber BPA orders and DHS USCIS cloud hosting (October 31) for bridge or follow-on notices this month.
• Set alerts on the parent vehicles behind your targets, not just the task orders. Follow-on orders often post under a new PIID.
• Build a December calendar now. Agencies that miss the window will issue extensions; agencies that do not will release RFPs with short response times.

Data Notes and Known Gaps

• Keyword matching is broad.Sector pulls use keyword queries (“cybersecurity,” “cloud,” “logistics,” “healthcare”). Some rows match on a company or facility name rather than scope: an electrical maintenance contract held by a firm with “Cybersecurity” in its name, NASA's ICESat-2 (“Ice, Cloud, and Land Elevation”) mission operations, and VA construction projects at facilities named “Healthcare System.” Sector totals include these rows; the tables above exclude obvious false positives.
• Sectors can overlap. A contract matching two keywords appears in both sector pulls. The 921 total is a sum of the four queries, not a de-duplicated count.
• Values are order obligations.They reflect money obligated on the specific PIID, not parent IDIQ ceilings or the follow-on's eventual size.
• Two outliers dominate the total. TRICARE West and the Vectrus LOGCAP V order are 65% of the $15.87B. We report totals with and without them.
• Effective end dates.The 90-day window is based on each contract's effective (extended) end date. Contracts marked * passed their current end date before October 1.

Methodology: How SCOUT Built This Report

All figures come from PrimeRFP SCOUT, queried live on October 1, 2026. We ran SCOUT's recompete intelligence with a three-month forward window across four sector queries, sorted by value, then pulled award summary and award history data to add incumbent and market context (trailing-12-month cybersecurity obligations, SimVentions' order history, TriWest's contract ceiling).

• Cybersecurity: 43 contracts, $458.0M
• IT modernization & cloud: 105 contracts, $549.7M
• Logistics & supply chain: 466 contracts, $5.84B
• Healthcare & medical: 307 contracts, $9.02B

SCOUT's recompete data is built from USASpending.gov prime-contract records (contracts over $100K). Agency, set-aside, vehicle, and pricing fields come from FPDS coding on each order or are inherited from the parent IDV where the order itself is uncoded. Set-aside counts in this report include inherited codes.

To run the same pull for your own agencies, NAICS codes, or keywords, query SCOUT recompete intelligence directly.