Five Federal Agency Stories That Impacted the Public Sector in Q3 2026
What changed at GSA, DoD, the Army, DISA and VA—and what government contractors should do next
KEY TAKEAWAYS
- Agency purchasing changes are shifting commercial leverage: GSA’s coordinated technology agreements and DISA’s cloud recompete require contractors to revisit pricing, eligibility and teaming.
- Cybersecurity obligations do not disappear when CMMC assessment timelines change; defense suppliers still need documented controls and accurate representations.
- Army counter-drone awards reward demonstrable field performance and interoperability, but contract ceilings are not booked revenue.
- VA’s EHR expansion brings modernization opportunities alongside intense scrutiny of cost, usability, clinical outcomes and contractor performance.
- The common discipline is to verify solicitation terms, obligated funding and customer ownership before assigning senior capture resources.
Between July and September 2026, five federal agency developments showed why contractors must evaluate the mechanics of a government decision – not simply the size of its announcement. Federal agencies changed purchasing terms, revisited a major compliance timetable, accelerated defense acquisition and extended a complex health-IT modernization. The commercial consequences are different in each case, but the practical question is consistent: what has the agency actually authorized, funded or made available to compete?
01 GSA: OneGov changes the terms of the technology sale
AGENCY / GOVERNMENT: GENERAL SERVICES ADMINISTRATION (GSA) / FEDERAL ACQUISITION SERVICE
What happened. During July through September, GSA’s OneGov initiative remained at the center of federal technology purchasing coverage. Officials discussed expanding the approach beyond software, reported estimated negotiated savings, and adjusted AI offers as introductory terms approached expiration. The important development was not the creation of direct supplier relationships—federal agencies have long bought from manufacturers—but increased coordination of government-wide pricing for selected commercial technology. OneGov offers are supplier-specific, and some of the most visible AI terms were temporary or consumption-based.
Why it matters to contractors. A reseller or integrator cannot assume that license pass-through will continue to carry the same revenue or negotiating leverage when the agency has access to manufacturer-negotiated terms. Conversely, lower license resale revenue does not erase the value of migration, implementation, cybersecurity, data integration, change management, training, and ongoing operations. Contractors will need to evaluate actual gross profit and customer access, rather than judging a pursuit by its apparent license volume alone.
What contractors should do. Audit pipeline and installed-base accounts for their exposure to OneGov-covered products. Verify the current offer, authorized purchasing path, usage conditions, and expiration or renewal provisions before quoting. Separate professional services from license economics where appropriate; document measurable implementation and adoption outcomes. For every large software account, ask who holds the licensing relationship and who controls the follow-on services conversation.
Sources for this story: 1, 2, 3, 4, 5.
02 DoD: CMMC Phase 2 pauses while contractor cyber duties remain
AGENCY / GOVERNMENT: DEPARTMENT OF DEFENSE / OFFICE OF THE CHIEF INFORMATION OFFICER
What happened. In July, Pentagon officials suspended the planned CMMC Phase 2 expansion of third-party certification requirements and launched a task force to review the program. Industry feedback became a major September storyline, including questions about assessment burden, controlled unclassified information (CUI) marking and whether a point-in-time assessment adequately represents continuing security. September coverage also described a class deviation affecting the contract-clause rollout. The pause concerned the assessment and phased implementation path; it did not cancel existing protection requirements.
Why it matters to contractors. Defense contractors and subcontractors now face timing uncertainty in an area that affects bid eligibility, compliance costs and supply-chain relationships. Firms that stop cybersecurity work because an assessment milestone has shifted could still fall short of obligations under their current contract terms. Smaller suppliers must particularly distinguish between a future third-party certification requirement, an applicable NIST SP 800-171 control, and the accuracy of any self-assessment or representation they submit.
What contractors should do. Review active contract clauses and each new solicitation against the then-current DoD guidance, rather than applying a blanket interpretation of the pause. Maintain a system security plan, documented remediation priorities, evidence of control implementation and subcontractor data-handling arrangements. Assign one owner to track the reform task force and contract deviations, but keep practical protections for CUI and operational technology moving.
Sources for this story: 6, 7, 8, 9, 10.
03 Army and JIATF-401: Counter-drone procurement emphasizes speed and interoperability
AGENCY / GOVERNMENT: U.S. ARMY / JOINT INTERAGENCY TASK FORCE 401
What happened. The Army’s Joint Interagency Task Force 401 advanced the Domestic Shield counter-unmanned-aircraft effort through a series of Q3 actions. Coverage followed July awards, plans for directed-energy demonstrations in August, and multiple counter-UAS indefinite-delivery/indefinite-quantity awards in late September. Army officials described a layered architecture involving detection, tracking, electronic effects, command and control and other means of defeating drone threats. They also pointed to more than one acquisition pathway, including marketplace arrangements.
Why it matters to contractors. This creates a path for sensor vendors, software providers, electronics specialists, integrators, and sustainment firms to demonstrate mission value. It also changes how companies should assess competitive advantage: a product’s operational performance and ability to work with other systems may matter more than a standalone capability claim. Publicized multibillion-dollar ceilings measure maximum potential ordering capacity; they are not immediate funding commitments or guaranteed revenue for all awardees.
What contractors should do. Map the specific awardees, contracts, demonstrations, and potential buying organizations. Build a test-and-evidence package covering performance in realistic conditions, interoperability, deployability and sustainment. Seek teaming relationships where direct access is constrained. Track obligated task orders and demand from identifiable installations or missions instead of forecasting sales from the overall IDIQ ceiling.
Sources for this story: 11, 12, 13, 14, 15.
04 DISA: The JWCC successor separates core cloud buying from a broader marketplace vision
AGENCY / GOVERNMENT: DEFENSE INFORMATION SYSTEMS AGENCY (DISA)
What happened. DISA’s next-stage Joint Warfighter Cloud Capability procurement took shape in August and September. A final solicitation for JWCC Unified Cloud Marketplace Core targeted the major hyperscale cloud providers and described a $21.6 billion ceiling over as many as ten years. A companion Premier acquisition was being developed to cover additional software, platform and non-hyperscale infrastructure offerings, with some room envisioned for smaller and emerging suppliers. The Premier track was a forecast, not an already-awarded contract at quarter’s end.
Why it matters to contractors. Cloud providers, application vendors, managed services companies and systems integrators should plan against different eligibility standards and award calendars. Being able to deliver on a current federal cloud vehicle does not automatically qualify a firm for the successor. Likewise, a company hoping for Premier access should not treat an anticipated solicitation as an awarded purchasing channel. Core ceiling values alone say little about when or how much task-order spending may materialize.
What contractors should do. Separate Core and Premier in account plans. Analyze the actual solicitation language, authorization and security requirements, contract terms and teaming assumptions. Identify which customers are transitioning workloads, who operates the environment, and which services are competed separately. Monitor solicitation amendments, awards and obligations; reserve capture spending for the portion of the program where the company has a credible route to the buyer.
Sources for this story: 16, 17, 18.
05 VA: Electronic health record modernization expands in scope under close oversight
AGENCY / GOVERNMENT: DEPARTMENT OF VETERANS AFFAIRS / ELECTRONIC HEALTH RECORD MODERNIZATION PROGRAM
What happened. The Department of Veterans Affairs modified its Oracle electronic health record modernization agreement in August, increasing the contract’s ceiling by almost $17 billion to approximately $27 billion and creating additional room for continued deployment and support. VA also moved forward with additional 2026 facility go-lives. September reporting highlighted congressional scrutiny of implementation costs, the timeline and contractor accountability. The ceiling change expanded contractual capacity; it was not an announcement that the entire increase had been obligated.
Why it matters to contractors. For health-IT contractors, the program illustrates how a large modernization effort can create sustained need for integration, interface development, cybersecurity, data conversion, testing, training, workflow redesign and onsite support. Yet opportunities exist under unusually high delivery scrutiny. Failure to demonstrate clinical usability, patient-safety safeguards and control over cost and schedule can overwhelm the commercial value of a large contract modification.
What contractors should do. Follow facility-by-facility deployment plans, related task orders and subcontractor requirements. Offer capabilities against evidenced bottlenecks rather than treating the total program ceiling as a sales forecast. Build proposals around interoperability, clinician adoption, data quality, independent testing, incident response and clear measures of delivery progress. Verify the funding, prime relationships and ordering authority for each prospective work package.
Sources for this story: 19, 20, 21, 22, 23.
The next capture decision
Each story affects a different customer, contract or technology segment. Contractors should therefore keep an agency-level decision log: confirm the responsible buying office, applicable acquisition pathway, current solicitation or compliance rule, credible funding, competitive posture and next decision date. A well-publicized program may be strategically important while still being too early, too constrained or too uncertain for a full capture investment. The strongest responses in Q4 will be deliberate—verify first, then allocate people and budget.
Government Contractors LLC helps teams turn policy, procurement and market changes into account priorities and actionable growth plans. Contact us at 703-996-9029 or team@governmentcontractors.com to discuss agency intelligence, account research and capture positioning.
Sources and further reading
Q3 2026 coverage listed in story order. Opinion, syndication and primary agency releases are labeled. Developments are reported as of September 30, 2026.
[1] F01 | Nextgov / FCW | Jul 16, 2026. GSA is eyeing OneGov savings beyond software and tech, official says
[2] F01 | Nextgov / FCW | Aug 11, 2026. How OneGov is changing CACI’s contractor role
[3] F01 | Nextgov / FCW | Aug 13, 2026. OneGov savings balloon to over $1.6B as agencies weigh future of AI in contracting
[4] F01 | Nextgov / FCW | Sep 10, 2026. GSA unveils new, token-based OneGov discount with OpenAI
[5] F01 | Nextgov / FCW | Sep 29, 2026. Google extends Gemini OneGov deal into November
[6] F02 | DefenseScoop | Jul 13, 2026. DOD halts cybersecurity requirements for CMMC Phase 2
[7] F02 | DefenseScoop | Jul 17, 2026. Pentagon task force to review CMMC hits the ground running
[8] F02 | DefenseScoop | Aug 20, 2026. Pausing CMMC cannot mean pausing accountability (Opinion / analysis)
[9] F02 | DefenseScoop | Sep 9, 2026. Pentagon pores over heaps of industry feedback on CMMC reform
[10] F02 | Washington Technology | Sep 9, 2026. CMMC’s Phase 2 suspension locked in with binding regulation
[11] F03 | Breaking Defense | Jul 30, 2026. JIATF-401 awards CACI $500M for non-kinetic cUAS
[12] F03 | Breaking Defense | Aug 24, 2026. Pentagon counter-drone task force preps shoot-off for directed-energy prototypes
[13] F03 | Breaking Defense | Sep 29, 2026. Army awards up to $7B in sprawling counter-drone IDIQ
[14] F03 | U.S. Army Public Affairs | Sep 29, 2026. JIATF-401 advances Domestic Shield with counter-UAS contract awards (Primary agency corroboration)
[15] F03 | U.S. Army Public Affairs | Sep 29, 2026. JIATF-401 accelerates kinetic drone defeat (Primary agency corroboration)
[16] F04 | Washington Technology | Aug 11, 2026. DISA sets release date for follow-on cloud solicitation
[17] F04 | Nextgov / FCW | Aug 12, 2026. DISA sets release date for follow-on cloud solicitation (syndicated coverage) (Syndication — not independent)
[18] F04 | Washington Technology | Sep 8, 2026. Pentagon unveils first of two solicitations for its next big cloud contract
[19] F05 | Nextgov / FCW | Aug 12, 2026. VA seeks to extend its Oracle health record contract through 2031
[20] F05 | Nextgov / FCW | Aug 20, 2026. VA boosts EHR modernization contract with Oracle by $17B
[21] F05 | Nextgov / FCW | Aug 24, 2026. VA deploys new EHR at 3 Indiana-based medical facilities
[22] F05 | Federal News Network | Sep 2, 2026. House VA lawmakers to subpoena Oracle over EHR contract
[23] F05 | Nextgov / FCW | Sep 2, 2026. House panel subpoenas Oracle heads over VA health record overhaul’s costs