DCAA compliance is a mandatory requirement for defense subcontractors billing cost-type contracts, and it's one of the most common reasons primes lose confidence in small business subs. A cloud engineering subcontractor that can't produce timekeeping records, demonstrate proper cost categorization, and survive an audit creates risk for the entire program. This post covers what DCAA-compliant cloud subcontracting looks like in practice.
What DCAA Compliance Requires of Subcontractors
The Defense Contract Audit Agency (DCAA) audits the adequacy of contractor accounting systems under FAR 52.215-2 and DFARS 252.242-7006. Subcontractors on cost-reimbursable contracts (CPFF, CPAF, CPIF) must meet the same accounting standards as primes.
Core DCAA accounting system requirements for cloud subs:
1. Adequate timekeeping: Every labor charge must be tied to a specific contract or cost account. Employees cannot work on multiple contracts in a day and record time at the end of the week from memory — the DCAA standard requires daily recording at minimum, with real-time access for auditors.
2. Proper cost allocation: Costs are categorized as direct (charged directly to a specific contract), indirect (overhead, G&A, fringe), or unallowable (FAR Part 31 unallowable costs that cannot be billed to the government). Cloud infrastructure costs, SaaS tool subscriptions, and license fees must be allocated with documented methodology.
3. Job cost accounting: A cost accounting system that tracks charges by contract and contract line item, with labor categories (LC) matching the rates bid in the task order.
4. Subcontract flow-down: When a sub-tier subcontracts, those costs must flow through the accounting system with the same categorization discipline.
AWS GovCloud and Cloud Infrastructure Cost Allocation
Cloud infrastructure costs are where most small cloud subs make allocation mistakes. AWS GovCloud billing generates detailed cost data by service, region, and tag — but turning that into DCAA-compliant cost allocation requires deliberate configuration:
Tagging strategy: Every AWS resource should be tagged with at minimum:
Contract: [contract-number]CLIN: [CLIN-identifier]Environment: [dev/test/staging/prod]Owner: [team or labor-category]
Cost Explorer views by contract: AWS Cost Explorer supports tag-based cost views. Monthly cost reports by contract tag are the foundation of DCAA-compliant cloud cost allocation. These reports, combined with invoicing from AWS, provide the audit trail.
Direct vs. shared infrastructure: Infrastructure dedicated to one contract is direct cost. Shared infrastructure (VPN concentrators, security tooling used across contracts) must be allocated using a documented methodology — usually proportional to direct labor hours or usage.
This is one area where primes benefit from a cloud sub who's thought through the DCAA implications of their AWS architecture. Ad-hoc tagging or informal cost allocation doesn't survive an audit. See FinOps GovCloud cost optimization for the FinOps foundation that makes DCAA cost tracking accurate and sustainable.
Labor Categories and Hourly Rates
DCAA compliance requires that the labor categories in the approved contractor billing system match the labor categories in the task order. Billing a senior engineer at junior engineer rates, or billing indirect labor as direct, triggers audit flags.
For cloud engineering subs, relevant labor categories typically include:
- Software Engineer (I, II, III by experience level)
- Cloud Architect
- DevSecOps Engineer
- Systems Engineer (cloud infrastructure)
- Program Manager
- Technical Writer (for ATO documentation)
The Forward Pricing Rate Agreement (FPRA) or Forward Pricing Rate Recommendation (FPRR) submitted to DCAA establishes the billable rates. Rates must be consistent across proposals for similar work.
Timekeeping Systems for Subcontractors
DCAA auditors will inspect the timekeeping system directly. Requirements:
- Daily entry: Employees record time daily, not retroactively
- Real-time access for auditors: The timekeeping system must be accessible for DCAA floor check — auditors may arrive unannounced and ask employees to demonstrate their timekeeping process
- System-enforced controls: Retroactive edits should be tracked (who changed what, and when)
- Supervisor approval: Weekly timesheet approval by a supervisor or PM with contract authorization knowledge
Common DCAA-compliant timekeeping tools: Unanet, Deltek Costpoint, Costpoint Time & Expense, or custom-configured solutions that meet the floor-check requirements. Spreadsheet-based timekeeping that employees fill out manually fails DCAA adequacy.
Incurred Cost Submissions
Defense contractors on cost-type contracts must submit incurred cost proposals annually — reconciling actual costs incurred to the indirect rates billed during the year. For subcontractors:
- The prime may require the sub's incurred cost data as part of their own submission
- Maintaining complete records throughout the year makes the annual incurred cost submission a documentation exercise rather than a reconstruction effort
- Subcontractors with cost-type task orders exceeding $750,000 may be subject to direct DCAA audit of their accounting system
Why This Matters for Primes
Primes bear responsibility for monitoring their subcontractors' cost accounting adequacy. If a sub's billing is found non-compliant in a DCAA audit, the prime may be required to return funds. This creates real incentive for primes to vet sub accounting systems before subcontracting begins.
Questions primes should ask cloud subs:
- Has your accounting system been found adequate by DCAA?
- Can you show me your timekeeping system?
- How do you allocate AWS/cloud infrastructure costs to specific contracts?
- What indirect rate pools do you use and how are they structured?
Rutagon maintains accounting practices aligned to FAR Part 31 cost principles and can walk primes through our cost accounting structure during due diligence.
Frequently Asked Questions
Does every defense subcontractor need DCAA compliance?
DCAA compliance requirements depend on contract type. Cost-type contracts (CPFF, CPAF, T&M) require adequate accounting systems. Fixed-price contracts have fewer requirements — the government pays the agreed price regardless of actual cost. Many cloud engineering task orders are T&M or cost-type, so DCAA compliance is relevant for most defense cloud sub work.
How does DCAA handle cloud infrastructure costs like AWS?
AWS and other cloud costs are allowable direct costs when properly allocated to a specific contract and documented with usage justification. DCAA auditors expect to see: tagged resources, cost reports by contract, a documented methodology for shared infrastructure allocation, and consistency between estimated and actual cloud costs in budget tracking.
What happens if a sub fails a DCAA audit?
An inadequate accounting system finding results in the government's contracting officer potentially requiring corrective action before further billings are processed. In severe cases, payments can be suspended. For primes, a sub audit failure creates program risk and potential holdbacks on prime billing. This is why primes who've experienced sub accounting failures are increasingly rigorous in pre-award accounting system due diligence.
Can a small business cloud subcontractor maintain DCAA-adequate accounting?
Yes. DCAA adequacy is about process discipline, not company size. A 5-person cloud engineering firm with proper timekeeping, cost allocation methodology, and FAR Part 31 unallowable cost screening can maintain an adequate accounting system. The challenge is implementing the right tools and processes from the start — not retrofitting them after a failed audit.
What's the difference between a DCAA pre-award and incurred cost audit?
A pre-award accounting system audit evaluates whether your accounting system is adequate before you're awarded a cost-type contract. An incurred cost audit reconciles actual costs to billed amounts after performance. Pre-award audits are initiated by primes or contracting officers before award. Incurred cost submissions are submitted annually by contractors performing cost-type work above $750,000.
If your prime program needs a cloud engineering sub with DCAA-aligned cost accounting, contact Rutagon to discuss your program requirements.