OASIS+ and CIO-SP4: What Primes Need from Cloud Subs on IDIQ Task Orders
OASIS+ and CIO-SP4 are the two largest governmentwide IT services IDIQ contract vehicles. Together they represent hundreds of billions of dollars in potential task order awards for federal IT services over their performance periods. For primes holding positions on these vehicles, the ability to respond to task order requests and deliver against awarded work depends substantially on their subcontractor ecosystem.
For cloud engineering and DevSecOps work specifically, the sub a prime brings to an OASIS+ or CIO-SP4 task order shapes both their ability to win the task order and their ability to deliver it. This article describes how these vehicles work and what primes need from a cloud engineering sub to compete on them effectively.
How OASIS+ and CIO-SP4 Work
OASIS+ (One Acquisition Solution for Integrated Services Plus) is GSA's professional services IDIQ that replaced the original OASIS contract. Organized into unrestricted and set-aside pools (including SB, WOSB, SDB, HUBZone, SDVOSB, VOSB, and 8(a)), OASIS+ covers a broad range of professional services: management consulting, program management, scientific and engineering services, and IT services. Agencies issue task order requests against the base contract; pool holders compete within their pools.
CIO-SP4 (Chief Information Officer Solutions and Partners 4) is NITAAC's (NIH Information Technology Acquisition and Assessment Center) governmentwide IDIQ for IT services. Organized into unrestricted, 8(a), and small business pools, CIO-SP4 covers IT services including cloud computing, cybersecurity, data analytics, enterprise architecture, and software development. Task orders are issued against the contract by agencies who've adopted it as their IT acquisition vehicle.
Both contracts are multi-vendor IDIQs: the base contract award doesn't guarantee revenue — it establishes eligibility to compete on task orders. The task order competition is where the work is actually won.
What Task Order Proposals Require
When a prime holding an OASIS+ or CIO-SP4 vehicle responds to a task order request, the proposal typically requires:
Technical approach: How will the team execute the specific work? For cloud engineering task orders, this means architecture design, tool stack, delivery methodology, and compliance approach. Primes who can't describe the technical approach credibly don't win.
Past performance: Evidence that the team has delivered similar work. Task order evaluators look for relevant cloud, DevSecOps, or IT modernization past performance. For a prime whose core business is program management rather than software engineering, the cloud engineering sub's past performance is what makes the proposal credible.
Key personnel: Many task orders require named key personnel — a program manager, technical lead, or cloud architect who will be specifically assigned to the work. If the prime's named cloud architect is a sub, the sub's personnel bio and project history need to be in the proposal.
Small business participation: For unrestricted pools, task order proposals often require a Small Business Participation Commitment Document showing what percentage of work will go to small business subs. Having a credible small business cloud sub pre-teamed reduces proposal risk and satisfies the SBA goal requirement.
What Cloud Engineering Subs Need to Deliver on Task Orders
A prime whose proposal wins a cloud engineering task order needs a sub who can actually execute. Here's where the gap typically is:
From proposal to kickoff in 30 days or less. Government programs don't wait for subs to stand up infrastructure. A cloud sub who needs 60 days to configure their environment, establish cloud accounts, and deploy development tooling creates schedule risk in the first sprint. Rutagon's infrastructure patterns are Terraform-first and deployable from scratch in hours — the production architecture pattern is documented and reproducible.
ATO documentation from the first sprint. For OASIS+ and CIO-SP4 task orders that involve cloud systems requiring ATO, the documentation burden starts immediately. A sub who generates compliance evidence automatically from the pipeline (scan results, deployment manifests, signed image digests) reduces the ATO package burden rather than adding to it.
CPARS-documented delivery. The past performance that wins the next task order is built by delivering the current one. A sub who requests CPARS evaluations after every delivered contract, maintains a delivery record, and can provide past performance write-ups for the prime's task order proposals is an asset that compounds over time.
Clearance path for future task orders. Many OASIS+ and CIO-SP4 task orders require cleared personnel, especially as they move into DoD customers. A sub without any clearance path limits the prime's ability to compete on the broader task order space. Rutagon's clearance sponsorship timeline targets Q4 2026 (Leidos non-compete expires October 2026), enabling cleared sub work to begin in 2027.
Where Rutagon Fits in the IDIQ Sub Ecosystem
Rutagon is not an OASIS+ or CIO-SP4 prime — those contract vehicles require a formal application process that Rutagon is evaluating for a future cycle. As a sub to primes who hold those vehicles, Rutagon provides:
- Cloud engineering and DevSecOps delivery scope on task orders where the prime's technical capability is limited
- Alaska geographic presence for task orders where local presence or Arctic/defense environment expertise is valued
- Small business subcontracting goal credit for unrestricted pool task orders
- CMMC Level 1 compliance posture for DoD task orders handling FCI
- Production past performance documentation for the prime's next task order proposal
For primes holding OASIS+ SB pool or CIO-SP4 small business pool positions, Rutagon's SAM.gov registration (active March 2026, UEI: FB2FHEJHM493, CAGE: 19ZR7) and NAICS 541512 primary classification make it a straightforward addition to a task order teaming package.
See the full capability overview at Rutagon as a Federal Cloud and DevSecOps Sub and SBA Subcontracting Goals: What Primes Need.
Discuss teaming for IDIQ task orders → rutagon.com/contact
Frequently Asked Questions
What is OASIS+ and how does it differ from the original OASIS contract?
OASIS+ (One Acquisition Solution for Integrated Services Plus) is GSA's replacement for the original OASIS IDIQ contract for professional services. OASIS+ expanded pool structures to include more socioeconomic set-aside pools and updated the scope and terms for current procurement needs. Like OASIS, it's a governmentwide vehicle that agencies can use for professional services task orders without conducting individual full and open competitions.
What types of IT work are covered under CIO-SP4?
CIO-SP4 (Chief Information Officer Solutions and Partners 4) covers IT services including cloud computing, cybersecurity, artificial intelligence/machine learning, data management and analytics, digital transformation, enterprise architecture, help desk and end-user support, IT operations and maintenance, network services, and software development. It's one of the broadest IT services vehicles in the federal market.
How does a prime use a sub's past performance on a task order proposal?
In most task order proposals, a prime can include a teaming partner's relevant past performance in the Past Performance volume, clearly identified as the sub's work. The evaluators assess it as part of the overall team's experience. The weight given to a sub's past performance vs. the prime's varies by task order evaluation criteria.
What is a Small Business Participation Commitment Document?
A SBPCD is required in many OASIS+ and similar unrestricted task order proposals. It commits the prime to a specific percentage of subcontracted work going to small businesses, by socioeconomic category. It's evaluated as part of the proposal and becomes a contractual obligation. Primes who miss the committed percentages face CPARS impacts and compliance findings.
When might Rutagon pursue OASIS+ or CIO-SP4 prime status?
OASIS+ and CIO-SP4 applications require documented past performance meeting specific thresholds (typically contracts over $150K-$500K in the relevant NAICS codes). Rutagon is building that track record through current sub arrangements and direct contracting. A future OASIS+ or CIO-SP4 application is planned for the Phase 2-3 timeline (2027-2028) once the past performance threshold is documented.