The Cyber CSO That Drew Thirty Bidders

Air Combat Command's A2 shop posted an umbrella Commercial Solutions Opening on April 2. Six weeks later a modification stamped a deadline on one of the topic calls: Call 0001 (Topic 007 - AF IC & 16 AF Cybersecurity Program Transformation) is OPEN for submissions until June 12th, 2026 @ 4:30pm CST.

Ten weeks after that clock ran out, one line on the August 28 Pentagon board explained who came through the door.

Telos Corp., Ashburn, Virginia has been awarded a $37,777,500 indefinite-delivery/indefinite-quantity contract...

The buyer got what it asked for. A firm that has been running Air Force and joint cyber work for a decade now has another IDIQ to run through 2031.

What the Board Actually Says

The whole announcement is worth quoting, because every clause matters.

This contract provides for modernization to the cybersecurity framework in implementing new and innovative Artificial Intelligence tools/capabilities. Work will be performed in San Antonio, Texas, and is expected to be completed by Jan. 31, 2031. This contract was a competitive and 30 offers were received. Fiscal 2026 operations and maintenance funds in the amount of $3,137,460 are being obligated at time of the award.

Read carefully:

Ceiling $37,777,500, with no option-year language on the board line.
Period of performance to Jan. 31, 2031, a five-year and five-month ordering window from award.
$3,137,460 obligated at award from FY26 O&M, or 8.3% of the ceiling.
Thirty offers, and the board's word for the procurement is "competitive."
Contracting activity ACC AMIC at JBSA-Lackland, which resolves in SAM's organization tree to AMICDET2.
PIID FA703726D0003, the 616 Operations Center contracting office at JBSA-Lackland whose CSO umbrella carries solicitation FA7037-26-S-C001.

The CSO the Award Came From

FA7037-26-S-C001, "ACC/A2 IC Commercial Solutions Opening", first published April 2, 2026 and modified nine more times through September 1. Its Call 0001 covers "AF IC & 16 AF Cybersecurity Program Transformation" and closed at 4:30pm CST on June 12, 2026. The July 13 modification recorded the call as closed; every later modification carries the same closing language for that call and rolls other calls forward.

Under 10 USC 3458, DoD may acquire commercial products and services through general-solicitation competitive procedures and a peer, technical, or operational review of proposals. Subsection (b) says the plain part out loud: use of these procedures "shall be considered to be use of competitive procedures" for CICA purposes. That is the statutory hook behind the board's word "competitive" on a call that never ran through a FAR Part 15 source selection.

Two other constraints from the same statute shape what the award can look like:

(d)(1) limits CSO awards to fixed-price (including fixed-price incentive). Every task order under FA703726D0003 will be FFP or FPIF.
(e) requires Congressional notification within 45 days only for awards over $100 million. This ceiling clears that threshold by a factor of about 2.6, so no notification.

The umbrella notice names its target areas: "AI-driven predictive analysis, JADC2 integration, advanced sensing, and resilient cyber operations." Call 0001 sits inside that, at cybersecurity program transformation for the Air Force IC element and the 16th Air Force.

If you sit on this office's bidders list, the interesting number is the field.

Thirty

Thirty offers on a cyber IDIQ is deep. Not a record, and the desk isn't going to claim it is: the CSO route is young enough that a clean baseline doesn't sit on a shelf yet.

What is fair to say is that thirty comfortably beats the four-to-six-offer average that ACC services IDIQ recompetes have been landing on this desk's boards for the last month.

Two structural reasons plausibly explain the depth.

A CSO is fast. Call 0001 ran to award in a compressed window: the June 12 deadline, then a 77-day evaluation, then the August 28 announcement. Firms that would not chase a 12- to 18-month FAR Part 15 source selection will chase a CSO because the calendar cost of losing is small.
A CSO is a general solicitation. The topic named the capability, not the technical volume. Any commercial-item vendor with a defensible way to modernize the buyer's cybersecurity framework could bid without answering an SOW that already assumed the incumbent's architecture.

Both are features. Both were used.

A Decade of Prior Work at the Same Bench

What the winner brings to that ordering window is a decade of Air Force cyber prime work, from public USAspending data alone (chart below).

The bars are Telos Corp.'s ten largest DoD prime definitive contracts on the USAspending page pulled this morning, sorted by end date. The record includes Defensive Cyber Operations ($76.8M, ended January 2023), TDC Black Core Architecture Redesign ($66.4M, ended November 2022), and two lines that still count as active: MLOS field service representatives and Xacta support services ($20.1M, through September 20, 2026).

That last one is the tell. Xacta is Telos's own IT governance, risk, and compliance automation platform. The Air Force has been buying support services on Xacta itself since July 2021, and the standing line ends twenty-three days before the new IDIQ begins. The buyer is extending an ordering window with a firm whose GRC tool is already inside the ATO process the modernization is meant to accelerate.

Two facts we deliberately leave outside the picture. The board carries no small-business set-aside, no J&A, and no named incumbent for Topic 007. Because a CSO topic is a general capability call, there is no single predecessor in the way a FAR Part 15 recompete would have one, and the award reads as new money for a new capability line. Second, FA703726D0003 has not reached USAspending yet; the board-to-record lag is running about 90 days this quarter, so the small-business and extent-competed codes will surface later.

Final Thoughts

There isn't much romance in commercial-item procurement. A CSO buys a commercial capability, in fixed-price form, from a peer-reviewed proposal, and hands the winner a five-year ordering window.

What makes it interesting is the who and the how many.

The who is a firm that built the RMF automation tool the Air Force is already using to authorize systems the same modernization line is meant to move faster. The how many is thirty, on a topic that lived on the fourth page of a general solicitation until a modification stamped a deadline on it. If Call 0004 draws even half that field on September 10, the ACC/A2 detachment at JBSA-Lackland has quietly become one of the more genuinely competitive cyber buying seats in Air Combat Command, and the pipeline the desk is running will need a column for these.

Thanks for reading.