Sole Source Contracting in Government IT

CICA and FAR Subpart 6.3 enumerate the specific circumstances under which an agency may bypass full and open competition. Each authority is discrete, carries its own evidentiary burden, and is not interchangeable. That last point matters more than most people realize, because the authority you cite in the justification must actually match the facts. Citing the wrong one is among the most reliable ways to lose a protest — think of it as showing up to court with the right argument for the wrong case.

FAR 6.302-1, "only one responsible source," is the authority you see most often in IT procurement, and for reasons that are technically coherent. Compatibility and standardization with existing systems is an explicitly recognized sub-justification under this authority. An agency running a specific enterprise resource planning platform, a particular cloud architecture, or a proprietary data management system can make a credible argument that only the incumbent can support a follow-on requirement without introducing unacceptable operational risk. That argument is legitimate. It is also, as you will see later, increasingly difficult to disentangle from lock-in dynamics the agency itself helped create.

FAR 6.302-2, "unusual and compelling urgency," covers situations where the government would be seriously injured, financially or operationally, without an immediate award. The critical qualifier, the one GAO scrutinizes closely and that protest attorneys lean into hard, is that the urgency must be genuinely unforeseen. Poor planning is not urgency. A contract that expired on a known date, a follow-on competition the agency delayed, a requirement that was visible on the horizon for months but never acted upon: none of those qualify. The FAR says so directly. Agencies test this line consistently, and GAO's published protest decisions document how frequently they cross it.

Additional authorities exist for international agreements, industrial mobilization, and preservation of unique research capabilities, but they appear rarely in commercial IT procurement. The workhorse authorities are 6.302-1 and 6.302-2, and the choice between them is not cosmetic. Using urgency to paper over a planning failure that should have been handled under 6.302-1 is among the most common grounds for a successful protest. The authority named in the justification must match the facts on the ground. If it does not, the record fails GAO review, and no amount of post-award documentation will rescue it.

What the Justification and Approval Document Must Contain

The Justification and Approval document, the J&A, is the legal instrument that makes a sole source award defensible. It is not a formality, and it is not a summary of the decision. It is the decision, documented in a form that must survive external scrutiny from the moment it is signed.

The required components are specific. The J&A must describe the requirement and explain, with particularity, why only one source can meet it. It must name the specific FAR authority being invoked. It must summarize the market research conducted and explain why alternatives were inadequate. It must include a price reasonableness determination. And it must carry the contracting officer's certification.

Price reasonableness is a consistent failure point. In a competitive procurement, market pressure does the agency's work: multiple bids establish a range, and the lowest technically acceptable offer sets the anchor. In a sole source award, that mechanism does not exist. The agency must construct a price reasonableness determination through cost analysis, historical pricing data, or an independent government estimate. Done well, it is rigorous and defensible. Done poorly, it is the element most likely to draw a protest, and the one most likely to result in the agency paying significantly more than it should have.

Market research is the other chronic failure point. Thin market research, the kind that documents two phone calls and a GSA Advantage search, does not satisfy the standard. GAO looks at whether the agency genuinely investigated the market, not just whether it went through the motions. An agency that cannot demonstrate it seriously considered alternatives before concluding none existed has a problem that no procedural compliance can fix after the fact. I have seen this play out more times than I can count: the underlying award was defensible, but the documentation was lazy, and that laziness became the whole case. The agency had a perfectly good argument — it just failed to show its work, and in federal procurement, if it isn't written down, it didn't happen.

J&As above certain dollar thresholds must be posted publicly, which adds a transparency layer that experienced protest counsel monitor closely. A publicly posted J&A is an open invitation for any interested vendor to read the agency's reasoning and decide whether to challenge it. That transparency is a feature of the system, not a flaw. But it means the J&A must be written to withstand scrutiny from people who are actively looking for weaknesses, because those people exist and they are effective.

How Much Federal Contract Spending Flows Through Sole Source Awards

In FY2025, total federal contract obligations reached approximately $793 billion. Of that, nearly $278 billion went to noncompetitive contracts of all types. Pure "not competed" sole source awards accounted for $148 billion, roughly 21.7 percent of total obligations, according to a June 2026 Congressional Research Service report.

Across the past decade, the noncompetitive share of federal contracting has held between 31 and 38 percent every year. That is not a spike or an anomaly. It is a structural feature of how the federal government buys. CRS has noted directly that competition is associated with lower prices, higher quality, and greater public trust. When more than a third of dollars consistently flow outside that competitive framework, those benefits go unrealized. The numbers are not ambiguous on this.

IT services represent one of the largest individual procurement categories in the federal market, with combined spending across the primary IT services codes exceeding $89 billion annually. That scale makes IT a particularly consequential arena for sole source decisions, because each noncompetitive award in that space involves significant dollars, long performance periods, and the kind of technical entrenchment that compounds over time. The dollar figures matter less than what they represent: years of dependency, accumulated switching costs, and competitive options that quietly close while everyone is focused on the current requirement. It is like a door that swings shut one inch at a time — no single moment feels decisive until the day you realize it no longer opens.

Small Business Sole Source Programs and How They Differ from Agency Sole Sourcing

Sole source authority is not monolithic, and conflating the small business program pathways with agency-level sole sourcing is a mistake that costs vendors time and credibility. The 8(a) Business Development Program, the Women-Owned Small Business program, the Service-Disabled Veteran-Owned Small Business program, and the Historically Underutilized Business Zone program each carry their own sole source pathways, and the presumptions embedded in each program are meaningfully different.

The 8(a) program treats sole sourcing as a routine tool. It is built into the program's architecture: sole source awards are a primary mechanism for how the SBA sponsors 8(a) firms into contracts. The other programs presume competition is the rule and sole sourcing is the exception, with tighter eligibility criteria and lower thresholds before competitive procedures are required. Understanding which program you are operating in is not optional background knowledge. It determines what is actually available to you.

In FY2024, small business sole source awards totaled $30.3 billion, representing 3.9 percent of total contract obligations of $774 billion. The thresholds governing these awards have been moving. The DoD's 8(a) sole source threshold, raised to $100 million by the FY2020 NDAA and subsequently adjusted for inflation, now stands at $150 million. The FAR Council proposed raising the IDIQ sole source justification threshold from $100 million to $150 million in November 2024. In emerging technology categories, including AI, cybersecurity, and supply chain visibility, small businesses frequently lead innovation, which means these thresholds have direct practical consequence for where procurement dollars flow and who is positioned to capture them.

One specific change worth knowing: effective January 1, 2024, a contracting officer may only award a sole source contract to an SDVOSB if the firm is designated in SAM as SBA-certified, or had applied for certification by December 31, 2023. That certification step now gates eligibility entirely. A vendor operating under the previous self-certification model and expecting a sole source award under the SDVOSB program faces a hard stop if that certification is not current. This is not an obscure technicality. It is a threshold requirement, and missing it closes the door.

How IT's Technical Dependencies Make Vendor Lock-in a Structural Outcome of Sole Sourcing

Lock-in does not arrive in one decisive moment. It accumulates. Custom integrations, bespoke workflows, one-off configurations, proprietary data formats: each individual decision is rational at the time it is made, and each one quietly raises the cost and complexity of switching vendors later. By the time an agency reaches a renewal decision, the architectural reality of its environment has often made a competitive procurement functionally impossible, not because anyone acted in bad faith, but because of dozens of individually defensible choices made over years by people who were solving the problem directly in front of them.

NAVSEA's 2025 Microsoft cloud award illustrates this dynamic with unusual candor. NAVSEA approached the other JWCC cloud providers, including Google, AWS, and Oracle, in April 2025. Each said it could not support the full requirement in its current configuration or within the timeframe needed. Only Microsoft confirmed service parity without introducing unacceptable operational risk. That is a textbook FAR 6.302-1 justification. But NAVSEA's own documentation acknowledged that prior configuration choices shaped that outcome. The agency noted it would work to overcome future competition barriers through containerization standards not tied solely to Microsoft. That commitment is meaningful. It is also a frank acknowledgment that today's sole source award becomes tomorrow's structural constraint if the architecture is not managed deliberately from this point forward.

The Army's Palantir Gotham contract is a frequently cited example of proprietary platform dependency producing a sustained sole source relationship. The platform becomes mission-critical, the data lives inside it, the workflows are built around it, the personnel are trained on it. At that point, the argument that only one vendor can meet the requirement is no longer a legal construct. It is simply true.

Compatibility justifications under FAR 6.302-1 are legitimate. They are also the category most susceptible to being shaped over time by vendor behavior rather than genuine mission necessity. A vendor that designs its product to integrate deeply and proprietary is not necessarily acting improperly. But the cumulative effect, compounded across a long contract period, produces sole source eligibility that was engineered rather than inherent. Agencies that want competitive options at the next renewal need to make architectural decisions now that preserve those options: interoperability requirements, data portability standards, open-architecture specifications built into the award before the lock-in calculus has already been decided.

Bridge Contracts and Urgency-Based Awards as Recurring Pressure Valves

Bridge contracts are where urgency authority meets incumbency, and the accountability structures are thinner here than almost anywhere else in federal procurement. A bridge contract is a short-term, noncompetitive award to an incumbent when a follow-on competition is not ready. It is typically justified under the unusual-and-compelling-urgency exception. And crucially, "bridge contract" is not defined in statute or in the FAR, which means there is no systematic mechanism for oversight bodies to identify and track them in agency data. For IT programs with long incumbency periods and complex follow-on competitions, that is a structural accountability deficit, not a minor gap.

Urgency-based contract obligations peaked at $40.8 billion in FY2021, driven by COVID-19 emergency spending, then returned to a pre-pandemic baseline of roughly $3 to $5 billion annually by FY2023. In just the first two quarters of FY2026, urgency-based obligations reached $18.4 billion, with DHS driving 92 percent of that figure. That concentration warrants scrutiny of whether the urgency exception is being applied as intended or whether it is functioning as a pressure valve for agencies operating under severe workforce and capacity stress.

The FAR's requirement that urgency must result from genuinely unforeseen circumstances, not from planning failures, is the line agencies most frequently strain and that GAO most frequently examines in protests. The evidentiary question in any urgency-based challenge is direct: was this situation truly unforeseeable, or did it result from decisions and delays that a reasonable agency would have anticipated? The answer determines whether the award stands. GAO has been consistent on this for years, and that consistency has not done much to deter the behavior.

How the Current Policy Environment Is Pressuring the Sole Source Framework

The structural stresses on the sole source framework are not hypothetical. They are measurable and they are happening now.

DOGE has terminated more than 13,000 contracts totaling approximately $61 billion by its own reporting, alongside cuts to nearly 16,000 federal grants worth roughly $49 billion. It has removed senior cybersecurity officials at multiple agencies and significantly reduced CISA's operational capacity. At least 32 cybersecurity-related contracts at the CFPB were cancelled. The workforce reductions across contracting and acquisition functions have been substantial, and those functions are precisely what agencies depend on to run competitive procurements correctly.

At the same time, the DoD alone is requesting more than $66 billion in IT and cybersecurity spending for FY2026, including $14.3 billion for cybersecurity specifically and $3 billion for cloud migration. The procurement requirement is not shrinking. The workforce capacity to manage it competitively is.

That gap produces a predictable outcome. Agencies with fewer contracting officers, fewer technical evaluators, and less institutional capacity to manage complex source selections will default to noncompetitive awards more frequently, not because they intend to circumvent competition policy, but because running a competitive procurement requires resources that are increasingly scarce. Urgency-based sole source awards become the path of least resistance even for requirements that were entirely foreseeable. The policy conditions most likely to erode competitive procurement capacity are operating simultaneously with the largest procurement requirements the government has fielded in years.

The vendor community has recognized this dynamic and is acting accordingly. Security and IT vendors are positioning their offerings as essential to the efficiency mission that DOGE articulates. If that positioning succeeds, it entrenches sole source relationships under the banner of reform, a particularly durable form of lock-in because it carries political cover that pure incumbency does not.

On the regulatory front, the June 2025 FAR Part 6 deviation reorganized and shortened existing sections but made no substantive changes to competition exceptions or J&A requirements. The broader FAR overhaul is ongoing. The legal framework governing sole source awards is the same framework it has always been. The pressure on it is new.

What Vendors and Agency Stakeholders Should Understand About Navigating This Path Correctly

Sole source is not a relationship play. A long incumbent history, a friendly contracting officer, a tight timeline: none of those substitute for a documented technical or capability basis that survives a J&A and a potential protest. "We've always done this work" is not a FAR 6.302-1 justification — that's a little like telling a judge you've always parked in that spot. The record must establish, specifically and defensibly, why the vendor's capability is unique relative to the requirement. If that case cannot be made in writing, the award is exposed, regardless of what the relationship looks like informally.

For small businesses, the program pathway matters as much as the technical case. The 8(a), SDVOSB, WOSB, and HUBZone programs carry different sole source authorities, different thresholds, and different certification requirements. Understanding which program applies, and whether current certifications are actually in place, is a precondition to any strategy built around sole source eligibility. Getting the program wrong wastes time at best and creates legal exposure at worst.

For contracting officers, the J&A is the record. Not a summary of it, not a cover sheet for it: the J&A itself is what GAO will read if a protest is filed. Thin market research and weak price reasonableness determinations are the two most consistent failure points in challenged sole source awards. Both require real work. Market research must reflect genuine investigation of alternatives, not a documented performance of looking. Price reasonableness must be grounded in cost data, historical pricing, or an independent estimate that can be defended under adversarial scrutiny. And contracting officers invoking FAR 6.302-2 need a record that clearly distinguishes genuinely unforeseen circumstances from planning failures that contributed to the timeline pressure. That distinction is the entire case.

For everyone involved in IT procurement, the architecture decisions made during a sole source award determine the competitive options available at the next renewal. NAVSEA's commitment to containerization standards not tied to a single vendor is the model. It will not undo the lock-in that shaped the 2025 award, but it is a deliberate attempt to prevent that lock-in from compounding. The time to negotiate portability and interoperability requirements is before award, while there is still leverage to do it. After the dependency has set, those conversations get very expensive very fast, and the agency is no longer negotiating from strength.