What CDC is, and what that means for a vendor
The Centers for Disease Control and Prevention is an operating division of the Department of Health and Human Services, headquartered at 1600 Clifton Road in Atlanta rather than in the Washington metro. It began in 1946 as the Communicable Disease Center, a malaria control office, and the founding logic never changed: find out what is happening in the population, tell the people who can act, and fund the state and local agencies that do the acting. Almost everything CDC buys serves one of those three verbs.
That matters commercially because CDC does not own the data it depends on. Public health authority in the United States sits with the fifty states, plus territories, tribes, and roughly three thousand local health departments. Case reports, lab results, immunization records, and death records are collected under state law and shared with CDC voluntarily, through data use agreements. A vendor who walks in offering to build a national database has misunderstood the constitutional arrangement. A vendor who offers to make sixty-four jurisdictions' incompatible feeds usable in one place has understood it exactly.
The second structural fact is where the money goes. CDC has consistently described the large majority of its budget as flowing out to state, local, tribal, and territorial health departments and other external partners through grants and cooperative agreements. The contract dollars that stay inside the agency run into the billions annually across all categories, but they are a minority share. Reading CDC as a grantmaker with a technology arm attached is closer to the truth than reading it as a federal IT buyer.
Where the technology budget actually sits
CDC's internal structure is a set of Centers, Institutes, and Offices, and the reorganization that followed the pandemic pulled the data functions into one place. The Office of Public Health Data, Surveillance, and Technology, stood up in 2023, consolidated what had been scattered across the Center for Surveillance, Epidemiology and Laboratory Services and the chief information officer's organization. It carries the Data Modernization Initiative, the Public Health Data Strategy, and the enterprise platform work. If a firm is selling data engineering, that office is the center of gravity.
The Center for Forecasting and Outbreak Analytics, created in 2022, is the modeling and analytics arm. It funds an external network of academic and public health modeling partners announced in 2023 at up to roughly $262 million over five years, and it is the office most likely to care about nowcasting, scenario modeling, and forecast evaluation methodology. The National Center for Health Statistics is a different animal again: a federal statistical agency inside CDC, running the National Health and Nutrition Examination Survey, the National Health Interview Survey, and the National Vital Statistics System, with its own restricted-data machinery.
Then there are the disease centers, each with its own surveillance systems and its own program-office budget: the National Center for Immunization and Respiratory Diseases, the National Center for Emerging and Zoonotic Infectious Diseases, the National Center for HIV, Viral Hepatitis, STD, and TB Prevention, the National Center for Chronic Disease Prevention and Health Promotion, the National Center for Injury Prevention and Control, the National Center for Environmental Health with ATSDR, and the National Institute for Occupational Safety and Health. The Public Health Infrastructure Center holds the workforce and infrastructure grants. Every one of these has data problems, and several buy technology directly rather than through the central office.
One caution on names. HHS announced a department-wide restructuring in March 2025 that consolidated divisions and created the Administration for a Healthy America. Org charts and office names move. Pull the current CDC organizational chart before you put a name in a capability statement, and check the acquisition office's current title the same way.
Entry Difficulty by Door: Small Engineering Firm
Editorial weighting from public procurement records and practitioner reading, not a measured statistic.
The data CDC holds
Understanding the named systems is the fastest way to sound like someone who has done this work. Case surveillance runs through the National Notifiable Diseases Surveillance System, fed by state systems including the NEDSS Base System that CDC provides to jurisdictions. Electronic case reporting moves structured HL7 FHIR and CDA documents from electronic health records to health departments, and it went from pilot scale to a mainstream pathway between 2020 and 2024. Electronic laboratory reporting carries the lab side.
Syndromic surveillance sits in the National Syndromic Surveillance Program, running on the BioSense platform with the ESSENCE analytic front end, taking near-real-time emergency department registration data. Healthcare-associated infections and antimicrobial use flow through the National Healthcare Safety Network, which more than 38,000 healthcare facilities report into. The National Wastewater Surveillance System launched in September 2020 and made sewersheds a routine data source. Foodborne outbreak detection runs on PulseNet, the molecular subtyping network established in 1996.
Survey and statistical data live at the National Center for Health Statistics, alongside the Behavioral Risk Factor Surveillance System, which CDC describes as the largest continuously conducted health survey system in the world at more than 400,000 adult interviews a year. Public query access runs through CDC WONDER. Immunization data lives in state Immunization Information Systems rather than one federal registry, which is exactly the kind of federated problem that generates work.
Data modernization is the standing program of record
The Data Modernization Initiative launched in 2020 and is the umbrella for nearly all of the agency's data engineering work. The American Rescue Plan Act of 2021 put $500 million toward public health data surveillance and analytics infrastructure, and Congress has since funded a recurring public health data modernization line in the annual appropriation, in the neighborhood of $175 million a year, on top of one-time supplemental money that has largely been spent.
Underneath the initiative sit the things a data engineer would recognize. An enterprise cloud analytics environment that CDC has publicly described as its enterprise data, analytics, and visualization platform. A push toward standardized intake so that each disease program stops building its own ingestion path. Adoption of HL7 FHIR as the exchange format instead of flat files and faxes. The Public Health Data Strategy, first published in 2023 and refreshed annually with dated milestones, is the closest thing CDC publishes to a requirements roadmap, and it is free to read.
Two external calendar items shape the demand. The ASTP/ONC certification rules set the United States Core Data for Interoperability version 3 as the certified baseline as of January 1, 2026, which changes what data elements a health system can be expected to send. The Trusted Exchange Framework and Common Agreement added public health as a recognized exchange purpose in its version 2.0 update, which changes how jurisdictions can request data at scale. Both create integration work that did not exist three years ago.
How work reaches a contract
CDC's acquisition function sits in Atlanta, in the acquisition services organization under the agency's financial resources office, which was separated from the grants organization in a reorganization of the former Procurement and Grants Office. Contracting officers there write to the Federal Acquisition Regulation with the HHS Acquisition Regulation at 48 CFR Chapter 3 layered on top.
| Path | What it carries | Practical note |
|---|---|---|
| NITAAC CIO-SP4 and CIO-CS | IT services and commodity solutions across HHS | NIH-run, HHS-preferred; small business pools exist |
| GSA MAS, SIN 54151S | IT professional services, including data and AI labor | Lowest barrier to a direct award; BPAs often ride it |
| GSA OASIS+ | Professional services including technical and engineering | Domain-based; small business and socioeconomic pools |
| Alliant 2 and successors | Large integrated IT programs | Realistic as a subcontractor, not as a new prime |
| 8(a) sole source | Services up to $4.5M without competition | FAR 19.805-1 threshold; fastest legitimate door |
| SBIR Phase III | Derivative work from a prior SBIR award | Sole-source authority at 15 U.S.C. 638(r)(4) |
Two mechanics are worth internalizing. First, the Rule of Two at FAR 19.502-2 requires a set-aside when the contracting officer has a reasonable expectation of two or more capable small business offers at fair market prices, and the government-wide small business prime goal is 23 percent under 15 U.S.C. 644(g). Second, most CDC technology work arrives as a task order against a vehicle you already have to be on. Getting on the vehicle is a separate campaign from winning the work, and it has to start earlier than most firms plan for.
The research door
CDC participates in the HHS small business research programs. NIH runs an annual Public Health Service SBIR contract solicitation that carries topics for NIH institutes, CDC, and FDA, with CDC's topics historically originating from the occupational safety and health institute. The HHS grant-based omnibus, with its three standard receipt dates each year, is the other route, and CDC-relevant work regularly fits under it. Phase I awards in the health agencies commonly run in the low hundreds of thousands with Phase II an order of magnitude larger, and the exact ceilings are restated in each solicitation.
The reason to care about the research door is not the award size. It is that an SBIR award creates a sole-source pathway for follow-on work under 15 U.S.C. 638(r)(4), and it creates protected data rights in whatever you build. Under the current SBIR and STTR Policy Directive, the protection period runs twenty years from the date of award, which is a substantially stronger position than delivering the same code under a standard rights-in-data clause.
The jurisdictional door most firms ignore
CDC's grant money is where the buying volume is. The Public Health Infrastructure Grant announced in November 2022 sent about $3.2 billion to 107 state, local, tribal, and territorial health departments over five years, explicitly including data and information systems capacity. The Epidemiology and Laboratory Capacity cooperative agreement is the long-standing channel that funds jurisdictional surveillance and lab data work year after year.
Those dollars are spent by health departments through state procurement rules, not federal ones. That means smaller solicitations, shorter evaluation cycles, and buyers who will actually take a meeting. It also means a different compliance profile: state IT security standards, state records law, and for public-facing tools the Department of Justice web accessibility rule under Title II of the Americans with Disabilities Act published in April 2024, which sets WCAG 2.1 Level AA and phases in compliance for larger public entities in April 2026 and smaller ones in April 2027. A firm that solves a data problem for three states arrives at CDC with something more useful than a briefing.
The gates that decide whether you can execute
- Personnel security. HSPD-12 requires a PIV credential for contractor staff with recurring access. Expect fingerprinting, an electronic questionnaire, and favorable adjudication before a badge or a network account. Position risk drives the tier.
- System authorization. FISMA applies. Anything you stand up needs an authority to operate against NIST SP 800-53 Rev. 5 controls, signed by an HHS or CDC authorizing official.
- Cloud. a cloud service supporting the work needs FedRAMP authorization, Moderate in most public health cases. Inheriting controls from an authorized platform is faster than authorizing your own.
- Controlled Unclassified Information. health and privacy CUI categories apply under 32 CFR Part 2002, with FAR 52.204-21 basic safeguarding as the floor and a government-wide CUI rule proposed in January 2025.
- Privacy. the Privacy Act of 1974 at 5 U.S.C. 552a governs records systems, and the FAR privacy training clause binds anyone who touches them.
- Accessibility. Section 508 at 29 U.S.C. 794d and FAR Subpart 39.2 apply to every deliverable with a user interface, including dashboards and reports.
Confidentiality law is the gate vendors miss
Public health data carries protections that most federal IT people have never encountered. Section 308(d) of the Public Health Service Act, at 42 U.S.C. 242m(d), lets CDC issue an Assurance of Confidentiality: data collected under it may not be used or disclosed for any purpose other than the one it was collected for, and that restriction follows the data to contractors. Statistical data at the National Center for Health Statistics is additionally protected by the Confidential Information Protection and Statistical Efficiency Act, codified at 44 U.S.C. 3561 and following, where willful unauthorized disclosure is a felony carrying up to five years and a fine up to $250,000.
Practically, this reshapes architecture. Restricted microdata is worked inside the NCHS Research Data Center, on-site or through a remote enclave, and the data does not leave. Identifiable data may sit under state data use agreements that forbid cross-jurisdiction pooling. Model training on protected records may be constrained in ways a commercial team would find surprising. Design for the constraint at proposal time, and say so plainly, because a proposal that ignores it reads as a proposal from someone who has not done public health work.
HIPAA is a related but separate question. CDC acting as a public health authority receives disclosures permitted under 45 CFR 164.512(b) without patient authorization, so CDC is often not the covered entity in the chain. A contractor handling identifiable records for a hospital or a state Medicaid agency may well be a business associate, with a business associate agreement and breach notification duties attached. Sort out which role you occupy before you write the security section.
Where a small engineering firm realistically fits
The honest answer is that the enterprise platform work is held by large integrators, and a firm winning that as a new prime is not the near-term play. Spend ten minutes on USAspending.gov filtered to CDC and NAICS 541511, 541512, and 541519 and you will know exactly who holds what and when it recompetes. That list is a teaming target list.
The work that fits a small engineering bench is narrower and more technical: record linkage and entity resolution across jurisdictional feeds that share no common identifier, deduplication of case reports arriving from multiple channels, FHIR implementation-guide conformance and validation tooling, data quality instrumentation that tells an epidemiologist which of forty feeds degraded overnight, forecast evaluation tooling, and the unglamorous ingestion plumbing that turns a state's flat file into something an analyst can query the same day.
Our team builds exactly that class of system, on FedRAMP-authorized cloud, with the security documentation written alongside the code rather than bolted on afterward. We work as prime where the scope fits a small business set-aside, and as a subcontractor to integrators who need a data and AI bench that can pass an authorization review. SAM.gov active, CAGE 1AYQ0, JCP and DD-2345 certified.
Common questions on the approach
Do we need past performance with CDC specifically?
No. Evaluators look for relevant past performance, and relevance is judged on the problem class: federated data integration, health data standards, statistical disclosure control, and authorization work all count. State health department work is directly relevant and much easier to obtain first.
Is a GSA Schedule required before pursuing CDC?
Not required, but it removes friction. A Multiple Award Schedule contract with SIN 54151S lets a contracting officer place a task order directly. Without a vehicle, the realistic paths are subcontracting, an SBIR award, or a standalone competed action.
How long does contractor onboarding take?
Plan for weeks, not days, between award and network access. Fingerprinting, the security questionnaire, adjudication, and badge issuance are sequential, and the schedule in your proposal should show that you know it.
Does an AI component change the compliance picture?
It adds documentation rather than changing the gates. Model documentation, evaluation evidence, and human oversight expectations now travel with any federal AI system, and the NIST AI Risk Management Framework is the reference most reviewers reach for. The confidentiality restrictions on training data are usually the harder constraint.
The first step, concretely
Do these four things in order, in one quarter. Confirm SAM.gov registration is active with NAICS 541511, 541512, 541519, and 541715 on the profile. Read the current Public Health Data Strategy end to end and pick the two milestones your team could deliver against, by name. Pull every CDC award over the last three fiscal years in those NAICS codes from USAspending.gov, sort by end date, and build a list of primes with recompetes inside eighteen months. Then respond to one CDC sources-sought notice or request for information on SAM.gov with a short, specific, technically concrete response, and send the same material to the small business specialist in CDC's acquisition office.
That sequence produces something no capability statement does: a named problem, a named office, a named vehicle, and a written record that your firm answered when the government asked. The federal health data market rewards firms that show up early with a specific answer, and it ignores firms that show up late with a general one.
Frequently asked questions
The Office of Public Health Data, Surveillance, and Technology holds the enterprise data modernization work. The Center for Forecasting and Outbreak Analytics buys modeling and analytics. The National Center for Health Statistics has its own statistical data programs, and individual disease centers buy for their own surveillance systems.
NITAAC CIO-SP4 and CIO-CS, GSA Multiple Award Schedule under SIN 54151S, GSA OASIS+, and government-wide IT vehicles such as Alliant 2. Smaller actions run as 8(a) sole source up to $4.5 million for services, or as competed set-asides under the Rule of Two.
Standardized data intake, HL7 FHIR-based exchange with health systems and jurisdictions, an enterprise cloud analytics environment, and modernization of legacy disease-specific surveillance systems. The annually refreshed Public Health Data Strategy lists dated milestones and is the best public statement of demand.
Not a security clearance in the classified sense for most work. HSPD-12 requires a PIV credential backed by a background investigation sized to the position risk, plus system authorization under FISMA and FedRAMP for any supporting cloud service.
Yes, and it is usually faster. CDC pushes billions to jurisdictions through the Public Health Infrastructure Grant and the Epidemiology and Laboratory Capacity cooperative agreement, and those dollars are procured under state rules with shorter cycles and more accessible buyers.