SDVOSB Contracting Guide for Security, Cyber and Investigations

SDVOSB contracting gives agencies and prime contractors a lawful way to bring a service-disabled veteran-owned small business onto security, cyber and investigations work. It can be a set-aside, a sole-source award, a VA Vets First buy or a subcontract under a prime. Each path has its own certification check, dollar limit and workshare rule. Get one wrong and the award can be protested.

This guide is for contracting officers and prime contractors buying guard services, investigations, forensics or cyber support. It covers the rules as of October 2026, common NAICS codes and a verification checklist. For how we fit those requirements as a contractor, see our SDVOSB government contracting page.

This article is general information, not legal or acquisition advice. Your contracting office, agency supplement and counsel control the details of any specific buy.

Where this guidance comes from. We checked every rule below against primary sources on October 2, 2026: FAR Subparts 19.14 and 19.7 and FAR 2.101 on Acquisition.gov (FAC 2026-01), the FAR Overhaul Part 19 text, 13 CFR Parts 121, 125 and 128, 15 U.S.C. 644(g), 38 U.S.C. 8127, SBA guidance and Congressional Research Service reports. It also reflects our veteran-led team’s experience responding to government requirements as an SDVOSB.

What SDVOSB contracting means in 2026

Under 13 CFR 128.200, an SDVOSB is a small business that is at least 51 percent owned and controlled by one or more service-disabled veterans who live in the United States. The VA decides who counts as a service-disabled veteran. SBA decides whether the business qualifies. The firm must also be small under the size standard for the NAICS code on the contract.

Three dates changed how SDVOSB contracting works:

• January 1, 2023. SBA’s Veteran Small Business Certification program, called VetCert, replaced the VA’s verification program and ended self-certification for new entrants.
• January 1, 2024. FAR 19.1403 and 13 CFR 128.200 require SBA certification for SDVOSB set-asides and sole-source awards. The only exception is a firm that filed a complete application by December 31, 2023 that is still pending.
• December 22, 2024. Certification became required for a prime contract or subcontract to count toward SDVOSB goals, with a similar pending-application exception.

Certification is not permanent. Under 13 CFR 128.306, a firm must recertify every three years and report eligibility changes within 30 days.

The SDVOSB goal: from 3 percent to 5 percent

For years, the government-wide SDVOSB goal was 3 percent. Section 863 of the National Defense Authorization Act for Fiscal Year 2024 (Pub. L. 118-31, enacted December 22, 2023) amended 15 U.S.C. 644(g). The goal is now not less than 5 percent of the total value of all prime contract and subcontract awards each fiscal year. Some summaries credit the FY2025 NDAA, but the statute’s amendment notes point to the FY2024 law.

Agencies are meeting the prime side. A Congressional Research Service report dated September 8, 2026 shows $32.5 billion in SDVOSB prime awards in FY2025, or 5.01 percent of eligible dollars. The subcontract share was 2.42 percent. Subcontracting is where SDVOSB participation still lags.

SDVOSB set-aside paths and dollar thresholds

The right acquisition path depends on dollar value, market research and the buying agency. The table summarizes the main paths as of October 2026. Thresholds are adjusted for inflation, so confirm them in the current FAR.

Path	Authority	When it generally applies	Key limit or check
Micro-purchase	FAR 2.101, Part 13	Small buys with a quote and an active SAM registration	$15,000; $2,500 for services subject to Service Contract Labor Standards
SDVOSB set-aside	FAR 19.1405	Market research shows two or more certified SDVOSBs will offer at a fair market price	Above the micro-purchase threshold; considered before SDVOSB sole source or small business set-asides
SDVOSB sole source	FAR 19.1406	No reasonable expectation of two SDVOSB offers; firm is responsible; price is fair and reasonable	$5 million including options ($8.5 million for manufacturing NAICS)
VA Vets First	38 U.S.C. 8127	VA buys, with priority to SDVOSBs, then VOSBs	Noncompetitive below the simplified acquisition threshold; sole source up to $5 million in the statute
Subcontract under a prime	FAR 19.7, 13 CFR 125.3	Other-than-small primes with subcontracting plans	Plans required above $900,000 ($2 million construction); certified SDVOSB needed for goal credit

SDVOSB set-asides and the rule of two

FAR 19.1405 lets a contracting officer restrict competition to SDVOSBs when market research shows a reasonable expectation that two or more eligible SDVOSBs will submit offers and award can be made at a fair market price. The contracting officer must consider an SDVOSB set-aside before an SDVOSB sole source or a general small business set-aside.

If only one acceptable SDVOSB offer arrives, the FAR says the contracting officer should award to that firm. If none arrive, the set-aside is withdrawn. A sources-sought notice that asks about specific capability gives better evidence than a status checkbox.

SDVOSB sole-source awards

FAR 19.1406 allows a sole-source award when the contracting officer does not expect offers from two or more SDVOSBs. The anticipated price including options must not exceed $5 million, or $8.5 million in manufacturing NAICS codes. The requirement must not belong to the 8(a) program, the firm must be responsible, and the price must be fair and reasonable.

VA Vets First under 38 U.S.C. 8127

The VA runs its own program. Under 38 U.S.C. 8127, VA contracting officers give priority to SDVOSBs, then to veteran-owned small businesses, then to other small business programs. The statute allows noncompetitive awards below the simplified acquisition threshold and sole-source awards up to $5 million at a best-value price. The firm must be listed in SBA’s certification database.

What the FAR Overhaul changes

Many agencies now use FAR Overhaul class deviations. In the model Part 19 text, the SDVOSB set-aside and sole-source rules move to 19.106-2 and 19.106-3, with the same $5 million and $8.5 million sole-source limits. Check which version your agency has adopted before you cite a section number in a file.

Need a capable SDVOSB for a security, investigations or cyber requirement? Submit a service request online with your draft statement of work, or book a consultation online for a capability discussion before your sources-sought closes.

NAICS codes and size standards for security, investigations and cyber

Size is measured against the NAICS code the contracting officer assigns to each solicitation. Under 13 CFR 128.401, an SDVOSB must be small under that code’s size standard and certified at the time of its initial offer that includes price, or on the date of award for a sole source.

These are the codes most often used for the work in this guide, with size standards from 13 CFR 121.201 as of October 2026 (average annual receipts unless noted):

NAICS code	Title	Size standard	Typical requirements
561612	Security Guards and Patrol Services	$29.0 million	Armed and unarmed guard posts, access control, patrol, fire watch
561611	Investigation and Personal Background Check Services	$25.0 million	Background investigations, fraud and misconduct investigations
561621	Security Systems Services (except Locksmiths)	$25.0 million	Alarm, camera and access control installation and monitoring
541512	Computer Systems Design Services	$34.0 million	Cyber security engineering, systems integration, network security
541519	Other Computer Related Services	$34.0 million (150 employees for IT value added resellers)	Digital forensics, incident response and other computer services

Match the code to the main purpose of the work, not to a single line item. A guard contract with some camera monitoring is usually still a guard contract.

How to verify an SDVOSB before award

A logo on a capability statement proves nothing. Before you rely on a firm, run these checks:

1. Search SBA’s certification records. Use SBA’s Small Business Search at search.certifications.sba.gov, or the VetCert database at veterans.certify.sba.gov, to confirm the firm is a certified SDVOSB and to see its status.
2. Check SAM.gov. Confirm the registration is active, the legal name, UEI and address match the offer, the NAICS codes cover the requirement, and there are no active exclusions. FAR 19.1403 tells contracting officers to confirm that SAM shows the firm as an SDVOSB certified by SBA. SBA’s own guidance notes that VOSB and SDVOSB certifications may show in SBA’s systems rather than under SAM entity types, so check both.
3. Confirm size for this NAICS code. Compare the firm’s size with the standard for the code in your solicitation.
4. Ask for state licenses. Security guard and private investigation work is state-licensed. In Arizona, those licenses come from the Department of Public Safety. Ask for the agency license numbers and check them.
5. Check where the firm’s own staff perform. A firm that cannot staff your location itself may break the limitations on subcontracting.
6. Note the recertification date. Certification lasts three years. Make sure it covers the offer date, or the award date for a sole source.

Limitations on subcontracting: what SDVOSB contracting requires

When an SDVOSB wins a set-aside or sole-source contract above the simplified acquisition threshold ($350,000 as of October 2026), 13 CFR 125.6 limits how much it can pass to other firms. For services, the SDVOSB may not pay more than 50 percent of the amount the government pays it to firms that are not similarly situated. Supplies are also 50 percent; construction limits are higher.

A similarly situated firm is one that shares the same program status, here another certified SDVOSB, and is small for the NAICS code it gets. Work that firm performs with its own employees does not count toward the limit. Compliance is measured over the base period and then each option period, or per order on some multiple-award contracts.

The penalty for a violation is the greater of $500,000 or the amount paid above the limit. On a guard contract, the SDVOSB should employ the officers who stand the posts. Model the workshare before the proposal goes in.

Subcontracting plan credit for prime contractors

Under FAR 19.702, an other-than-small prime on a contract expected to exceed $900,000 ($2 million for construction) that has subcontracting possibilities must submit a subcontracting plan. The plan sets goals for small businesses, including SDVOSBs. Small businesses do not need a plan.

To count toward the SDVOSB goal, the subcontractor must be SBA-certified under 13 CFR 128.200. Primes report through the Electronic Subcontracting Reporting System (eSRS). On individual plans, SBA lists a mid-year report due May 15 and an annual report due November 14. A prime that fails to comply in good faith is in material breach and can face liquidated damages.

Good SDVOSB subcontracts carve out a real, defined scope. For example, a prime running a facilities contract in Arizona might subcontract the security posts at one site. If the work touches defense information, confirm the subcontractor’s cyber posture too. Our CMMC 2.0 compliance guide explains what flows down to subcontractors.

How Honeybadger supports SDVOSB contracting for security, cyber and investigations

Honeybadger Solutions is a veteran-owned, veteran-led SDVOSB based in Casa Grande, Arizona, with CAGE Code 9FNE2 and active SAM registration. We are an Arizona DPS-licensed private investigation agency (License No. 1759795) and a licensed security guard agency. Here is what we bring to a set-aside, sole source or teaming arrangement:

• Government facility security in Arizona. Our government and defense security team staffs access control, visitor processing, cleared-environment support and escort details on written post orders.
• Critical infrastructure protection. For utilities, water, telecom and industrial sites in Arizona, our critical infrastructure security service covers perimeter patrol, access control and alarm response.
• Managed cyber security nationwide. Our managed cyber security (MSSP) team provides 24/7 monitoring, incident response, penetration testing and compliance support, delivered remotely.
• Investigations and forensics. Our private investigations cover background, fraud and employee matters, and our digital forensics lab produces court-ready evidence for agencies and counsel nationwide.

We answer sources-sought notices and RFIs with specific capability, and we say plainly when a requirement falls outside what we do. Physical security is Arizona only; cyber, forensics and investigations are nationwide. Use the service request form with your draft statement of work, place of performance and timeline, or book a consultation to discuss teaming.

Why the online intake is faster than a phone call: it takes about two minutes, and your answers are routed straight to the specialist team that handles your kind of matter, whether that is cyber and forensics, investigations or field security. That team sees the full picture before it replies, so you skip phone tag and get a real answer and next steps sooner. If it cannot wait for business hours, use the urgent intake form, which is read seven days a week.

Frequently asked questions

Is the SDVOSB contracting goal 3 percent or 5 percent?

It is 5 percent. Section 863 of the FY2024 National Defense Authorization Act (Pub. L. 118-31) raised it from 3 percent to not less than 5 percent of prime and subcontract dollars each fiscal year.

What is the SDVOSB sole-source limit in 2026?

Under FAR 19.1406, as of October 2026, the anticipated award price including options cannot exceed $5 million for most NAICS codes, or $8.5 million for manufacturing NAICS codes. The contracting officer must also expect no other SDVOSB to compete, find the firm responsible, and get a fair and reasonable price.

Can a self-certified veteran firm still win an SDVOSB set-aside?

Generally no. Since January 1, 2024, an offeror must be certified by SBA, unless it submitted a complete application by December 31, 2023 that is still pending. Since December 22, 2024, certification is also needed for prime and subcontract dollars to count toward SDVOSB goals.

How does a prime contractor get credit for using an SDVOSB subcontractor?

The SDVOSB must be SBA-certified, and the prime reports the award against the SDVOSB goal in its subcontracting plan through eSRS. Credit generally covers the prime’s first-tier subcontracts unless the plan elects lower-tier credit under 13 CFR 125.3.

Which NAICS code fits a security guard contract?

Security guard and patrol work is usually 561612, Security Guards and Patrol Services, with a $29.0 million size standard as of October 2026. Investigations usually fall under 561611 ($25.0 million), and cyber and IT services often fall under 541512 or 541519 ($34.0 million each). The contracting officer assigns the code.

How much of an SDVOSB services contract can be subcontracted?

For services, the SDVOSB prime may not pay more than 50 percent of what the government pays it to subcontractors that are not similarly situated. Work passed to another certified SDVOSB that performs with its own employees does not count toward that limit.

Related reading

• ▸ FTC Safeguards Rule Compliance: Requirements and Checklist
• ▸ NIST 800-88 Media Sanitization Guide for Businesses (2026)
• ▸ Cyber Warfare & Defense: The CEO’s Guide to Ransomware and Recovery
• ▸ Hacking the Human: How Social Engineering Bypasses Your Firewall