The new federal fiscal year started October 1, and primes are already forming teams for the next wave of IT solicitations. Choosing a tech subcontractor now affects more than delivery. It affects your security posture, your AI compliance, and your past performance rating.
When primes look at a tech subcontractor, the first question is usually whether they can build it. That question still matters. But in 2026, the real risk sits in everything that comes with the build: the data your sub touches, the AI tools they use, and the compliance claims they make on your behalf.
When the Sub Becomes the Weak Point
Look at what happened at the Centers for Medicare & Medicaid Services in late 2022.
Healthcare Management Solutions, a subcontractor to prime contractor ASRC Federal Data Solutions, was hit by a ransomware attack on October 8. Their job was to fix errors in Medicare entitlement and premium payment records. It was routine work, but it gave them access to sensitive data.
The exposed information may have included names, addresses, dates of birth, Social Security numbers, Medicare IDs, and bank account details for up to 254,000 people. CMS said its own systems were not breached. That mattered little to the people affected, who had to get new Medicare cards and numbers.
Here's the part every prime should notice. CMS stated publicly that, based on initial information, the subcontractor had acted in violation of its obligations to the agency. The sub was the weak point. The prime's contract and the agency's reputation were the ones exposed.
This subcontractor was doing specialized work it was qualified to do. Technical ability wasn't the failure. Security posture was, and that's exactly what a prime needs to check before signing a teaming agreement.
The questions you ask during teaming matter as much as the capabilities a sub lists. Here's what I'd tell any prime to look for.
1. A Security Posture They Can Document
Many people assumed cybersecurity requirements had loosened this year. On July 13, the Department of War suspended the CMMC Phase 2 transition, which had been scheduled for November 10, 2026, and launched a reform review.
That pause applies to the rollout schedule. The underlying requirements are still in place. DFARS 7012, CMMC self-assessments, and NIST 800-171 compliance all remain in effect, and primes still flow those requirements down to suppliers.
Enforcement hasn't stopped either. In September, the Justice Department announced a $2 million settlement with Honeywell Aerospace over alleged NIST 800-171 failures. The conduct predated any CMMC assessment requirement, and the government enforced compliance anyway.
Most primes haven't relaxed their expectations either. In a survey published October 1, fewer than a quarter of primes said they were easing Phase 2 requirements for suppliers. Most subcontractors said they had heard nothing from their prime about the pause.
The takeaway: your certification doesn't cover your subs. Ask every tech subcontractor what data they will touch, how they protect it, and what they can show you on paper.
2. AI Use That Will Hold Up in an Agency Review
Your sub's AI use is now part of your compliance picture. OMB memo M-25-22 directs agencies to consider how vendors and contractors use AI during contract performance, not only when an agency buys AI directly.
The memo also calls for contract terms that keep vendors from training public AI models on non-public government data, along with AI disclosure requirements.
So ask your sub three things. Which AI tools do they use? Where does government data go? Who reviews the output? If they can't answer clearly, that's your risk to carry.
3. Digital and Accessibility Compliance They Already Know
Government digital work comes with requirements commercial work doesn't. OMB memo M-23-22, "Delivering a Digital-First Public Experience," contains more than 100 requirements agencies must work through.
The stakes are high. Federal websites receive about 2 billion visits a month, and a poor digital experience can keep people from services that affect their health and well-being.
Your tech sub should be able to discuss Section 508, WCAG, and 21st Century IDEA without looking them up.
4. Real Delivery Capacity and Scope Discipline
Large primes are expected to make good-faith efforts to use the small business subcontractors they proposed, to the same degree they relied on them in the bid. Primes also shouldn't name subcontractors they don't intend to use.
Where a subcontracting plan applies, compliance with it factors into your annual CPARS evaluation. A sub who can't deliver after award becomes your past performance problem.
Scope discipline matters just as much. A strong tech sub answers the question you asked: can you deliver this specific piece, and what does it cost? They don't rewrite the scope, and they don't price work that already belongs to someone else on the team.
Overlapping scope makes your price less competitive and confuses evaluators about who owns what. That's why teaming agreement experience should be one of your first questions. A sub who is uneasy defining their lane before award won't get clearer about it after.
5. Certifications That Count Toward Your Plan
Above $900,000, large primes generally need a small business subcontracting plan, with separate goals for categories such as women-owned and small disadvantaged businesses.
Women-owned and HUBZone goals have fallen short year after year. A certified tech partner helps you meet goals that are historically hard to hit. Just confirm the certification applies at the level of the contract you're pursuing, whether federal, state, or local.
The Questions to Ask Before You Sign
Before you add a tech subcontractor to your team, get clear answers to these:
- Have you worked under a teaming agreement before?
- Can you scope and price only the portion we've defined?
- What government data will you touch, and how do you protect it?
- What is your current NIST 800-171 or CMMC self-assessment status?
- Which AI tools do you use, and where does our data go?
- How do you handle Section 508 and WCAG compliance?
- Does your certification count toward our subcontracting plan?
What This Looks Like at Guiding Point
This is the work we do, and we work the way primes need us to. Guiding Point Consulting is a certified WBE/MBE IT and digital strategy firm that serves as a delivery partner for prime contractors.
We handle website modernization, accessibility-minded digital delivery, AI-supported content operations, custom mission-aware chatbots built with governance from day one, and fractional digital strategy. We're comfortable with teaming agreements, defined workshare, and flow-down requirements from the start.
If you're forming a team for an upcoming IT bid, reach out. I'm happy to send our capability statement and talk through where we fit.