The Pulaski County School Board meeting (Nov. 11, 2026; titled Nov. 10) reviewed the school operating budget and approved the consent agenda, which included payment of bills, personnel matters, and the sale of surplus equipment. Finance staff reported that revenue collections were behind the year-to-date target and identified transportation fuel and electricity costs as budget risks. Transportation spending was about 22% higher than the prior year at the same point, and the estimated budget exposure was roughly $500,000. The board agreed to continue the spending freeze for another month: nonessential discretionary purchases require case-by-case approval, while safety, essential, and day-to-day needs continue to be considered. Staff are also reviewing bus routes and utility usage. No contract awards, vendor selections, or specific procurement contracts were reported.
The board approved the 2027–28 high school course catalog, proposed SOL testing days, additional Riverlawn field trips, and the superintendent’s authorized designees. Policy revisions were presented for a first reading, with board review and a later vote planned; the changes were described as largely reflecting General Assembly updates. Other discussion included student and school recognitions, attendance and discipline data, and student perspectives on AI in education.
📋
Contracting Vehicles
🌐
Digital Infrastructure
💻
Information Technology
WidePoint reported 27% year-over-year revenue growth and a $209 million backlog for Q3 2026, while its two-cent-per-share loss missed expectations. Its federal pipeline includes DHS’s CWMS 3.0 procurement, where DHS requested revised proposals after GAO sustained a protest, and ongoing CWMS 2.0/2.5 bridge work that generated $33.7 million in Q3 task orders. NASA’s SEWP VI ordering period opened November 1, 2026; WidePoint is preparing to respond to RFQs. The company also cited an anticipated Census 2030 RFP in Q4 2026 and a potential subcontract through CDW related to the LA28 Games.
CWMS 3.0 remains a live competition, while CWMS 2.0/2.5 task orders provide near-term work; the CWMS 2.5 vehicle is expected to run through approximately February 2027, and task orders may extend beyond that period.
Federal IT suppliers can pursue opportunities through SEWP VI’s open ordering period. WidePoint’s stated preparation to respond to RFQs signals active competition for orders on the vehicle.
Companies pursuing Census 2030 work can factor the anticipated Q4 2026 RFP into their pipeline planning; the signal provides no specific release or proposal deadline.
WidePoint’s reported backlog and revenue growth provide context on its business position, while the missed EPS view and pending CWMS 3.0 decision underscore execution and competition risks. A potential CDW subcontract for LA28 is a separate, non-federal opportunity.
GSA’s Federal Acquisition Service issued a request for information on commercial products and services that can help federal agencies migrate to post-quantum cryptography (PQC). Responses are due December 7, 2026 (25 days remaining). The RFI is market research only: GSA will not assign work under it and has not committed to a follow-on solicitation. Vendors can use responses to demonstrate alignment with NIST standards, validation status, product maturity, interoperability, operational impacts, migration support, and available purchasing pathways. Related extracted marketplace information identifies QuSecure offerings listed through Carahsoft’s GSA Schedule.
Companies responding should address the RFI’s stated evaluation areas and explain how agencies could acquire and operationalize their offerings; the response deadline is December 7, 2026.
Procurement teams can use the market research to understand product maturity, interoperability, validation, migration support, and potential purchasing routes, without treating the RFI as a source of funded work or a guaranteed solicitation.
Carahsoft’s GSA Schedule listing of QuSecure offerings indicates one existing purchasing pathway for PQC products; agencies and contractors can assess its relevance alongside other solutions described in RFI responses.
DARPA’s Biological Technologies Office (BTO) will host a virtual Industry Day on December 9, 2026, for the upcoming Laguna Program Solicitation. The response/registration deadline is December 2, 2026—20 days from November 12—and DARPA anticipates publishing a draft solicitation on SAM.gov. Contractors interested in the opportunity can use the event to learn more about the solicitation and should complete the required response or registration by the deadline.
Companies should review SAM.gov for the anticipated draft solicitation and use it to assess the opportunity and prepare questions for the Industry Day.
Key deadline: Submit the response or registration by December 2, 2026, to participate in the December 9 virtual event.
🔒
Cybersecurity
✅
Regulatory Compliance
💻
Information Technology
Fortreum made its annual-subscription VDR/VER service, powered by the Kovr platform, generally available to help FedRAMP-certified cloud service providers evaluate, remediate, and report vulnerabilities under new FedRAMP requirements. The requirements become mandatory on December 7, 2026, in 25 days, with a grace period through March 7, 2027. The launch creates near-term demand for vulnerability assessment, compliance automation, and implementation support among CSPs and the contractors that serve them.
FedRAMP-certified CSPs must address the new vulnerability evaluation, remediation, and reporting requirements; the stated grace period runs through March 7, 2027.
Fortreum’s annual-subscription offering combines the Kovr platform with onboarding and professional services; pricing was not stated.
Contractors serving FedRAMP CSPs can assess whether they can provide vulnerability evaluation, remediation, reporting, or implementation support to meet customer needs before the deadline.
The United States began FY2027 in October with a reported $404 billion deficit and $773 billion in federal outlays. The report points to higher military spending across operations, maintenance, and procurement, but identifies no specific contract, solicitation, or funding allocation. For procurement professionals, the figures highlight both potential spending in defense accounts and added pressure on federal budget planning.
Defense contractors can account for reported increases across operations, maintenance, and procurement in market planning, while recognizing that the report does not identify specific acquisition opportunities.
Agencies and industry stakeholders should distinguish broad spending trends from funded requirements: the signal provides no contract values, procurement timelines, or solicitations to pursue.
The record deficit adds budgetary context for contractors assessing the durability of planned federal spending, particularly where requirements depend on future budget decisions.
📜
Policy
🔒
Cybersecurity
✅
Regulatory Compliance
🛡️
Defense & Military
💻
Information Technology
On November 11, 2026, the House passed seven small-business bills, including measures to expand SBA cybersecurity and CMMC information for small businesses, establish a resource portal connecting businesses with U.S. manufacturers and suppliers, and strengthen SBA support and reporting for veteran-owned businesses. The bills still require Senate action; none announces a contract award, procurement funding, or a new CMMC obligation. The signals report H.R. 10238 passed, although the supplied introduced-version text shows committee referral and does not independently confirm that status.
For small businesses pursuing federal prime contracts or subcontracts, H.R. 10238 would direct SBA to coordinate cybersecurity resources and CMMC information with CISA and other agencies. It would expand outreach, not create new compliance requirements.
If enacted, the Reshoring American Manufacturing Act (H.R. 9718) would codify an SBA resource portal for four years, potentially increasing visibility for U.S. manufacturers, producers, and suppliers; it does not create a solicitation or guarantee business.
The veterans-business measure would require SBA’s Office of Veterans Business Development to establish compliance procedures within 60 days of enactment and improve reporting to Congress. Companies should distinguish these proposed changes from currently effective requirements while the bills await Senate action.
🔒
Cybersecurity
✅
Regulatory Compliance
💻
Information Technology
CISA’s Binding Operational Directive 26-04, issued June 10, 2026, requires covered civilian federal agencies to prioritize software vulnerability remediation according to risk, with remediation due within three days for the highest-risk tier. Federal contractors and critical-infrastructure suppliers are not directly subject to the directive, but agencies may set similar expectations through contracts and security programs. Procurement teams and contractors should assess whether their tools and processes can track exposure continuously and produce auditable evidence that remediation deadlines are met.
Agencies must align vulnerability remediation with CISA’s risk tiers; the highest-risk vulnerabilities carry a three-day remediation deadline.
Contractors should review applicable contract and security-program terms to determine whether comparable remediation timelines or evidence requirements apply to their work.
Organizations supporting federal agencies can evaluate whether their vulnerability-management processes provide continuous exposure tracking and auditable remediation records.
🔒
Cybersecurity
📋
Contracting Vehicles
🛡️
Defense & Military
💻
Information Technology
Parsons reported strong third-quarter 2026 performance and said it is shifting its Federal Solutions business toward higher-margin hardware and software while reducing lower-margin services. The company cited 26 Other Transaction Agreements (OTAs), a $1.6 billion OTA award baseline, and a largely funded backlog spanning cyber, counter-UAS, electronic warfare, and space and missile defense. For procurement professionals and contractors, these figures point to potential federal work as technology efforts move from development and prototyping toward production and deployment.
Parsons’ OTA portfolio covers multiple defense technology areas; contractors with relevant capabilities can assess where their offerings may complement these efforts.
The largely funded backlog may indicate work with a nearer-term path to revenue, though the signal does not identify specific agencies, solicitations, or production-transition dates.
Companies pursuing federal work should account for Parsons’ stated shift toward hardware and software and track the production transitions and OTA opportunities identified in the signal.
On November 2, 2026, the National Institute of Standards and Technology (NIST) released Small Business Cybersecurity: Non-Employer Firms, a practical guide for businesses without paid employees and firms with limited IT resources. It organizes risk-management practices around the six functions of the NIST Cybersecurity Framework. The guide does not establish a new procurement requirement or announce a solicitation, but contractors—particularly small firms handling sensitive information—can use it to assess account security, software updates, backups, monitoring, and incident-response readiness.
Small contractors can use the guide’s framework to review these cybersecurity practices against their available IT resources.
Procurement professionals may find the guide useful context when engaging small suppliers, but the release itself does not create a new contract requirement.
🔒
Cybersecurity
✅
Regulatory Compliance
🛡️
Defense & Military
💻
Information Technology
On November 12, 2026, inDirectIT appointed Alexy Johnson, a former CMMC Level 2 lead assessor and retired U.S. Air Force veteran, as Director of Compliance Services. The appointment reflects continued demand for CMMC readiness and NIST-aligned security support among defense contractors. Although the Pentagon suspended the planned second phase of CMMC in July, the signal states that applicable self-assessment requirements and existing protections for controlled unclassified information remain in effect.
Defense contractors should distinguish the suspended second phase from requirements that remain applicable to their organizations, including relevant self-assessments and protections for sensitive information.
Johnson’s assessor experience may be relevant to contractors seeking support to evaluate whether security controls operate effectively, as well as whether they are documented.
inDirectIT’s appointment indicates ongoing commercial demand for CMMC readiness and compliance services; its media contact is media@indirectit.com.
