DHS Language of Buying: How the Largest Civilian Agency Structures IT Modernization Procurements

DHS doesn't buy IT the way other civilian agencies do. It buys through component program offices — CBP, USCIS, ICE, FEMA, CISA, TSA, USCG — each with its own contracting shop, its own preferred vehicles, and its own incumbents. Reading DHS as one buyer is the first mistake. Reading it as seven buyers stitched together by HQ and CISA is closer to the truth, and that's the language capture teams need to speak to compete here.

Executive summary

DHS is the largest civilian IT buyer in the federal government and the second-largest IT buyer overall after DoD. Across the two primary IT NAICS codes — 541512 (Computer Systems Design) and 541519 (Other Computer Related Services) — the Department obligated $11.34B over the trailing 24 months on a total ceiling of $27.4B. Spend is accelerating: NAICS 541512 obligations grew from $2.52B in CY2024 to $3.94B in CY2025, a 56% year-over-year increase before any CY2026 partials are counted.

The market is concentrated. The top ten primes account for roughly 65% of NAICS 541512 obligations, with CACI ($1.18B), Anduril ($587M), Booz Allen ($548M), GDIT ($434M), and SAIC ($342M) leading. More striking is the offer pattern: 60% of NAICS 541512 task orders had a single bidder, and the $10M+ landscape across the broader 5415 family runs a 32% single-offer rate. Major recent awards — CDM DEFEND Group BD ($843M to Booz Allen), CACI BEAGLE ($479M), Accenture CBP DCSS ($227M), GDIT OBIM ($362M) — were all sole-source bridge or recompete actions. The vehicle is open; the competition is not.

For BD and capture leaders, that combination — growing spend, concentrated primes, and chronic single-offer awards — defines the displacement window. 188 DHS IT contracts worth $11.76B in obligated value are expiring inside 24 months, with 24 of them above the $100M band. This report names the dominant primes per program office, maps the vehicle landscape (EAGLE successors, FirstSource III, CDM DEFEND, CIO-SP4, GSA OASIS+/Alliant 2), and identifies where the Department's “language of buying” actually shapes win probability.

How to read this report

DHS is structurally different from the civilian agencies most BD teams have practice attacking. There is no single contracting office, no single technology road map, no single requirements owner. Instead, IT is purchased by component program offices, each with its own PIID prefix, set-aside posture, and incumbent bench. Reading the PIID is the first piece of tradecraft.

The numbers in this report are pulled from two PrimeRFP Scout queries against USASpending's transaction-level award data. Lens A is the DHS-as-buyer view filtered by agency = “Department of Homeland Security” and NAICS = 541512 or 541519, 24-month rolling window. Lens B is the broader 5415 contract landscape at DHS with a $10M minimum, surfacing the largest task orders that define program-office concentration. Both lenses exclude IDV base-vehicle rows so that ceiling values aren't double-counted against obligations. All dollar figures are obligated unless explicitly labeled as ceiling.

The PIID map: which prefix means which buyer

The first time a BD team reads a DHS award notice, the PIID usually looks like a jumble. It isn't. The prefix encodes the contracting activity — and that almost always maps 1:1 to the program office and the technology road map you're chasing. The Department's own data shows this cleanly.

Two practical consequences for capture: First, the PIID prefix tells you which contracting officer pool, which CAA, and which evaluation conventions you're walking into. A 70SBUR evaluation does not look like a 70B04C evaluation. Second, cross-component bridges are rare — an incumbent at USCIS almost never transitions to CBP work, and vice versa. Past performance has to be component-specific.

The top of the house: who dominates DHS IT

The DHS prime bench separates cleanly into three layers. At the top sit the platinum-tier integrators — CACI, Booz Allen, GDIT, SAIC, Accenture, Leidos, ManTech — each holding $250M–$1.2B in 24-month obligations and dominating the flagship border, biometric, and cyber programs. The mid tier runs $100M–$300M and is where the most contestable work lives: CGI, Deloitte, Steampunk, ECS Federal, Perspecta, Capgemini, IBM. The third tier is the small-business reseller channel — Four Points, ThunderCat, FCN, GovPlace, V3Gate — which dominates NAICS 541519 hardware-and-cloud resale flows.

The hardware/cloud-resale channel under NAICS 541519 looks entirely different. Here the dominant primes are small-business VARs — Four Points Technology ($327M), CACI NSS ($303M), ThunderCat ($207M), FCN, GovPlace, GovSmart — moving licenses and AWS/Azure consumption through DHS FirstSource and adjacent vehicles. Leidos sits on top of the 541519 list at $348M, but it's carried there by a small number of large vetting-software task orders rather than commodity resale volume.

The vehicle landscape: EAGLE successors, FirstSource III, CDM DEFEND, CIO-SP4

DHS does not buy IT off a single mothership vehicle. It moves spend through a layered stack of internal IDIQs, GSA-hosted vehicles, and NITAAC pathways. Knowing which lane a requirement sits in is the difference between a credible capture plan and wasted BD cycles.

Internal DHS vehicles (the EAGLE family and FirstSource)

EAGLE Next Gen (ENG) succeeded EAGLE II as DHS's flagship IT services IDIQ and is the spiritual heir to where IT modernization labor is bought across components. EAGLE II is still active in task-order form — CBP DCSS, BEAGLE, and several ICE bridges still cite EAGLE II as parent — but new work flows through EAGLE Next Gen pools. The evidence in USASpending: ENG-style task orders are the engine behind CBP's 70B04C mega-awards, including CACI's $479M BEAGLE and Accenture's $227M DCSS.

FLASH (Flexible Agile Support for the Homeland) was DHS's ill-fated 2016 attempt at a separate agile software vehicle. It was cancelled before award after a series of GAO protests; the procurement model survived, however, and shows up today in USCIS's NEON II, SPEED, ODOS, and DID(IT) II agile pools, each running its own rotating bench of small-and-mid primes (Excella, DV United, Highlight Technologies, Customer Value Partners, ADG-REI, Ekagra Partners).

FirstSource III is the IT products vehicle and is where the small-business reseller bench lives. Four Points, ThunderCat, FCN, GovPlace, GovSmart, and V3Gate are all FirstSource III holders or compete for FirstSource-style task orders. If the requirement is hardware, COTS software, cloud consumption, or commodity end-user equipment, the prime almost always sits on FirstSource III.

GSA-hosted vehicles supporting DHS

CDM DEFEND is the most important non-DHS vehicle in DHS IT. Hosted by GSA FEDSIM on behalf of CISA, the CDM Continuous Diagnostics & Mitigation task orders are the cybersecurity backbone of the federal civilian government. Four of the five active DEFEND groups recompete inside the next 12–24 months:

• Group A — CACI, $906M ceiling, current PoP ended April 30 2026 (bridge active through 2027-04-30)
• Group BD — Booz Allen, $843M obligated, same expiry profile
• Group C — CGI Federal, $227M
• Group E — ManTech, $182M
• CDM Data Services — ECS Federal, $528M ceiling, $154M obligated since FY2024

Every one of those task orders was awarded with a single offer when the bridge actions hit USASpending. The market is on notice and the recompete window is open.

GSA OASIS+ and Alliant 2 carry the DHS professional-services and integrated-IT solution buys that don't fit an internal EAGLE pool. DHS uses OASIS+ heavily for R425 (engineering/technical) and R408 (program management) labor. Alliant 2 carries the large integrated-IT task orders — including the $573M General Dynamics One Source ASSIST 2.0 ceiling true-up landed in April 2026.

NITAAC CIO-SP4 is DHS's preferred NITAAC lane for IT services that need an HHS-hosted vehicle — Steampunk's $124M CBP HR IT task order is the canonical example, and CIO-SP3 SB remains active for legacy small-business ITS task orders. CIO-SP4 won't be a full replacement until protest dust fully settles, but DHS contracting officers are already routing IT modernization through it where small-business socioeconomic targets need to be hit.

The concentration story: 60% single-offer on flagship IT

The most consequential statistic in this entire data set is the single-offer rate. On NAICS 541512 — the IT modernization labor category that defines the bulk of DHS's software, application development, and systems-engineering work — 60% of task orders were awarded with a single bidder over the trailing 24 months. The median number of offers is 1. The average is 3.1, pulled up by a small number of highly contested small-business set-asides.

At the $10M+ level across the broader 5415 family, the same pattern holds at lower intensity: 32% single-offer, median 3 offers. But the dollar-weighted picture is starker. Looking only at the contracts in this report's landscape pull worth more than $200M, single-offer rates exceed 75%. The biggest recent awards — CACI BEAGLE ($479M), Booz Allen CDM DEFEND BD ($843M), Accenture CBP DCSS ($227M), ManTech CDM Group E ($182M), Steampunk CBP HR IT ($76M off CIO-SP3 SB), GDIT OBIM ($362M) — were all sole-source bridge or recompete actions at the moment of latest action.

Two reasons drive this. First, DHS components run under relentless mission pressure; when a contract is up, the contracting officer's incentive is to bridge, not to re-compete. Second, the incumbent benches are deeply entrenched in mission-system institutional knowledge — OBIM biometrics, ICE SEVIS, CBP ACE/ATAP, USCIS adjudication systems — and the perception of switching risk is high. The capture implication is exactly the inverse: when DHS does re-compete, the displacement opportunity is enormous because there is no recent competitive baseline to anchor evaluators.

The 24-month recompete pipeline: $11.76B, 188 contracts

Scout's recompete query against DHS NAICS 541512 with a $10M floor returns 188 contracts expiring inside 24 months, $11.76B in obligated value, 24 of them at or above the $100M band. The single largest near-term recompete cluster sits at USCIS, where the SPEED, ODOS, and DID(IT) II agile pools all hit period-of-performance end dates between June and October 2026. The single largest individual recompete is CDM DEFEND Group A (CACI, $906M ceiling). The single most urgent is ManTech's CBP Architecture and Engineering Services (AES) at $121M, current PoP ending May 17 2026.

Pipeline composition by value band: 24 contracts at $100M+ totaling $6.66B, and 164 contracts in the $10M–$100M band totaling $5.10B. By component, 96% of pipeline value sits inside DHS components proper, with the remaining ~$2.3B routed through GSA-hosted vehicles (CDM DEFEND, Alliant 2).

What's live right now: DHS IT solicitations in the market

Two solicitations capture the current shape of DHS IT modernization buying as of May 2026.

ADEMS (Architecture, Development, Engineering, and Management Services) — DHS OCIO's general IT services umbrella, currently in market with a response deadline of June 3 2026. ADEMS covers Dynamics 365, Power Platform, SharePoint, Office 365, Azure, Dataverse, Confluence, Jira, ServiceNow, and agile software delivery across DHS HQ and its component customer base. This is the modern successor to the EAGLE II application-services tower and signals that DHS is consolidating its Microsoft and ServiceNow spend under a single umbrella vehicle. [SAM.gov]

NOSC NCCS 2.0 — the Network Operations Security Center Network, Cloud, and Cyber Services recompete held an Industry Day on May 14 2026. NCCS 2.0 succeeds the original NCCS task order and consolidates network, cloud, and cyber-defense operations for DHS HQ infrastructure. The active RFI from February 2026 named cloud security, ZTA, and SD-WAN as scope priorities. Set-aside is unrestricted today but socioeconomic small-business participation requirements are likely under Refresh 32 / OMB M-25 guidance. [SAM.gov]

Both solicitations sit at the seam between DHS HQ IT modernization and component-level mission systems. A win on ADEMS positions a prime to subcontract or task-order into every component; an NCCS 2.0 win opens the door to CISA-adjacent cyber spend without going through CDM.

Program office deep dive: where the dollars actually flow

CBP (Customs & Border Protection) — the largest single buyer

CBP is the dominant DHS IT buyer. Its 70B04C PIID prefix shows up against the largest active task orders in the portfolio: BEAGLE ($479M to CACI for border-enforcement applications), DCSS ($227M to Accenture for data-center support), SAIC's O&M services ($597M), ManTech's AES ($121M), and the Travelers Processing Vetting Software stack (Leidos, $232M). Anduril's $362M tower contract under 70B02C sits inside CBP's OFAM (Office of Facilities and Asset Management) lane and is one of the largest single non-traditional vendor footprints in the entire civilian government.

Capture posture at CBP: heavy emphasis on past performance with ACE, ATAP, RAVEN, and border-system platforms; tight bench; single-offer bridge actions are normal. Small-business prime opportunities sit primarily under FirstSource III hardware and a small set of 8(a) set-asides (Ellumen, Nativa, Sentrillion).

USCIS — the agile-delivery factory

USCIS runs the most explicitly agile procurement model in DHS. Its 70SBUR PIIDs cluster around named program pools — NEON II (IT user support), SPEED (product engineering), ODOS III (outcome-based DevSecOps), DID(IT) II (digital innovation), FINCH (fraud analytics), and BIMS (biometric information management). Each pool runs a multi-prime bench with rotating task-order assignments, and most are small-business-set-aside eligible. The displacement story at USCIS over the next 12 months is the simultaneous expiration of SPEED, ODOS III, and DID(IT) II inside a 4-month window.

ICE — analytics, ERO IT, SEVIS

ICE's 70CTD PIIDs are dominated by ERO (Enforcement and Removal Operations) IT and SEVIS (Student and Exchange Visitor Information System). Booz Allen sits on RAVEN ($64M analytics platform for HSI); Capgemini holds ERO IT Upgrades ($31M); Dev Technology Group holds SEVIS O&M ($23M, expanded to $63M ceiling); Harmonia Holdings holds ERO O&M ($75M). Recompete pressure: SEVIS-adjacent task orders saw 18 bidders on the latest competition — the most competitive evaluation in the entire DHS IT dataset.

FEMA — integrators and disaster-response geospatial

FEMA's 70FA3 and 70FB7 PIIDs run on a mix of Deloitte system-integration work ($99M for system integration support, $100M for financial management) and small-business geospatial and disaster-response task orders. NFIP PIVOT O&M (ACE Info Solutions, $149M) is the marquee recompete here, currently in bridge through June 2026.

CISA — cyber through GSA

CISA does not run most of its IT through DHS contracting offices — it runs cyber operations through GSA FEDSIM (47QFRA prefix) and its own 70RCSJ activity. CDM DEFEND is the flagship. CISA Enterprise Engineering and Operations Support Services (Sev1Tech, $58M) is one of the few CISA-direct actions visible in the dataset; the bigger CISA dollars hit USASpending under GSA.

TSA, USCG, USSS — the secondary buyers

TSA's IT spend concentrates in identity and credentialing — IMPACT II (Perspecta, $261M), MyID (Countertrade Products, $18M), SIVM (Foxhole Technology, $82M). USCG buys C5I sustainment (Synergy Business Innovation, $32M; Information Technology Coalition, $54M for the USCG Academy .mil/.edu domains). USSS runs EIS network and voice through AT&T ($17M obligated, $13M ceiling). All three are buyer pools where small primes can win without going through CBP-scale capture cycles.

Set-aside posture: where small-business primes actually win

DHS's set-aside profile on NAICS 541512 is meaningfully different from the rest of the civilian government. Most of the obligated dollars — $6.37B of $7.06B over 24 months — flow through full-and-open competition. Small-business set-aside obligations total $665M, distributed as follows:

• SBA total small business — $333M (239 transactions)
• 8(a) sole-source — $153M (203 transactions)
• 8(a) competitive — $118M (348 transactions)
• HUBZone competitive — $33M (58 transactions)
• WOSB — $30M (15 transactions)
• SDVOSB competitive — $26M (58 transactions)

On NAICS 541519, where the hardware-and-cloud resale channel lives, the small-business share is dramatically higher: $1.55B of $4.28B (36%) flows through small-business set-asides, with SBA total small business alone at $1.02B. The implication is clear: small primes targeting DHS should split their pursuit strategy by NAICS — lead with 541519 for resale, partner up with a platinum-tier prime for 541512 labor.

What this means for capture

Four practical implications fall out of the data.

1. PIID-prefix triage is non-optional. DHS is too fragmented to run a generic “capture DHS” plan. Every active opportunity should be tagged by the contracting activity in its PIID prefix on day one, and pursued with a component-specific past-performance narrative.

2. The single-offer rate is the real opportunity.A 60% single-offer rate on NAICS 541512 is not normal in federal contracting and it's not stable. Each bridged sole-source award is a capture clock starting on the recompete — one that, when DHS decides to actually run competition, opens the door to a credible second bidder with relevant past performance.

3. The USCIS agile-pool window is closing fast.SPEED, ODOS III, and DID(IT) II all hit period-of-performance end dates inside the next 4 months. The capture decisions for the next vehicle generation are happening now, not when the solicitations drop.

4. ADEMS and NCCS 2.0 are the visible top of a much larger iceberg. The two solicitations live in market today are the consolidation vehicles that will route a significant portion of the $11.76B recompete pipeline through their downstream task orders. Winning a pool seat on either positions a prime for years of DHS IT spend; missing both materially constrains the addressable opportunity through 2028.

Methodology

All figures in this report were generated from PrimeRFP Scout on May 13, 2026. The underlying source is USASpending transaction-level award data, refreshed daily into Scout's warehouse. The two NAICS-specific queries used:

• get_award_summary(agency = "Department of Homeland Security", naics_code = 541512, months_back = 24)
• get_award_summary(agency = "Department of Homeland Security", naics_code = 541519, months_back = 24)

Contract landscape and recompete queries used get_contract_landscape against NAICS family 5415 with a $10M floor over the 15 most recently modified months, and find_recompete_contracts with a 24-month forward window and $10M floor. IDIQ/IDV base-vehicle rows are excluded from all obligation totals so that ceiling values are not double-counted against actual task-order spend. Current solicitations are pulled from SAM.gov via search_opportunities filtered to DHS within the last 90 days.

Data caveats: USASpending DoD-style reporting lag does not apply meaningfully to DHS (a 1–2 week lag is typical), but small-dollar 8(a) set-aside transactions and below-$25K purchase-card actions are not captured. PIID-prefix to program-office mapping is built from PrimeRFP's structured catalog of DHS contracting activities, cross-validated against DHS's public organizational data and FPDS contracting office hierarchies. Vehicle landscape descriptions (EAGLE Next Gen, FirstSource III, CDM DEFEND, CIO-SP4) reflect publicly-known program structures as of May 2026.

Every dollar figure, every prime name, every PIID, and every period-of-performance end date in this report is verifiable in public records. Where a number is rounded for readability, the underlying transaction-level value is available in Scout.