The agency behind the checks
Most technology firms that want federal work start at the Department of Defense, because that is where the noise is. The Social Security Administration is a quieter building, and in engineering terms it is one of the more interesting ones in Washington. SSA holds the earnings record of nearly every American who has ever worked, has issued more than 450 million Social Security numbers since 1936, and pays out roughly $1.5 trillion a year in benefits. It does that on a code base whose oldest layers were written before the personal computer existed. If your firm builds data systems, machine learning, or cloud infrastructure, SSA is a real customer with a real budget. It simply buys nothing like the Pentagon does.
SSA became an independent agency under the Social Security Independence and Program Improvements Act of 1994 (P.L. 103-296), effective in March 1995. Headquarters sits at 6401 Security Boulevard in Woodlawn, Maryland, outside Baltimore, not in the District. The agency runs two very different programs out of one operation: Old-Age, Survivors, and Disability Insurance under Title II of the Social Security Act, and Supplemental Security Income under Title XVI. Title II is an earned insurance program keyed to a worker's covered earnings. Title XVI is a means-tested program keyed to income and resources, which is why it drags a far heavier data-verification burden behind it.
The physical footprint is large and distributed: roughly 1,200 field offices, ten regional offices, program service centers, a national teleservice network, and about 160 hearing offices under the Office of Hearings Operations. Initial and reconsideration medical decisions are not made by SSA employees at all. They are made by state-run Disability Determination Services, one in each state plus the District of Columbia and Puerto Rico, funded federally and operating under 20 CFR 404.1503 and 416.903. Any technology that touches disability adjudication touches that federal-state seam, and that seam is where most integration work actually lives.
Follow the appropriation, not the press release
SSA's benefit payments are mandatory spending. Its administration is not. Everything the agency spends on staff, rent, phones, and computers comes out of a single annual discretionary appropriation called the Limitation on Administrative Expenses, which in recent years has run in the neighborhood of $14 billion. Set that against roughly $1.5 trillion in benefits and the administrative overhead is around one percent. Inside the LAE account there is a distinct Information Technology Systems line, plus whatever multi-year modernization money Congress chooses to add.
Two consequences follow, and they are the most useful things to know before you pitch anything. First, IT competes directly against front-line staffing in the same account. Every dollar of technology is a dollar not spent on a claims representative. Second, because the workload keeps rising while the account stays close to flat, the agency's only real lever is handling time per case. SSA buys things that take minutes out of a transaction, hours out of a case, or days out of a queue. A proposal that cannot state its effect in those units is a proposal that has not found its buyer.
Two public documents name the pain in the agency's own words: the Agency Financial Report and the Annual Performance Report. Both are on ssa.gov, both are audited, and both list operational measures SSA has committed to Congress. Its Inspector General has separately estimated nearly $72 billion in improper payments across fiscal years 2015 through 2022, under one percent of benefits paid, and preventing those payments is a standing line of work with money behind it.
The offices that hold the budget
Office of Systems and the CIO organization. The technology center of gravity. It owns the mainframe estate, the cloud migration, the enterprise data platforms, and the modernization plan SSA first published in 2017 and has reported against annually since. Most large IT task orders are written here, even when another component is the customer.
Office of Acquisition and Grants. SSA's contracting arm, sitting under the Deputy Commissioner for Budget, Finance, and Management. Every contract, task order, and BPA call goes through OAG. Contracting officers here are the people who can actually obligate money, and they are a separate audience from the technologists who want the capability.
Office of Analytics, Review, and Oversight. OARO houses quality review, anti-fraud programs, and the Office of Appellate Operations, which staffs the Appeals Council. This is the natural home for anomaly detection, case-sampling analytics, and decision-quality measurement.
Office of Retirement and Disability Policy. ORDP holds disability policy, research, evaluation, statistics, and employment-support demonstrations. It is the research buyer, and it funds work through cooperative agreements as often as through contracts.
Office of Hearings Operations. The administrative law judge corps and its support staff. OHO carries the heaviest per-case document burden in the agency, which makes it the most natural customer for document understanding and evidence-summarization tooling.
Office of Operations. Field offices, program service centers, and the national 800-number network. Raw volume lives here, so throughput tooling and workforce analytics land here.
Office of Small and Disadvantaged Business Utilization. The door. OSDBU publishes the procurement forecast, runs vendor outreach, and will point a firm to the contracting officers who own the requirements.
Where Engineering Work Lands at SSA · Fit for a Specialist Firm
Editorial weighting from public sources and practitioner reading — illustrative, not a measured statistic.
What SSA actually holds
SSA's data is records, not imagery. The Numident is the master file of every Social Security number ever issued. The Master Beneficiary Record carries Title II entitlement, and the Supplemental Security Record carries Title XVI. The Master Earnings File holds posted wage and self-employment earnings going back decades, reconciled against W-2 and Schedule SE reporting. Death information flows into the Numident and out through the Death Master File, whose public release was restricted to records three years old or older by Section 203 of the Bipartisan Budget Act of 2013 and is now distributed to certified persons through NTIS.
Then there is the medical evidence, which is the largest unstructured corpus in the building. Claimants authorize disclosure on Form SSA-827; evidence arrives through Electronic Records Express as scanned PDFs and faxes, and through SSA's Health IT program as structured clinical documents pulled over the eHealth Exchange. A single adult disability file can run to hundreds or thousands of pages of hospital notes, imaging reports, function reports, and work history. Reading it is the job. Reading it faster, without losing the citation back to the source page, is the product.
SSA also runs one of the largest data exchange operations in government, with thousands of agreements moving verification data to and from federal agencies, state benefit programs, and financial institutions. The electronic Consent Based Social Security Number Verification service, created by Section 215 of the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 (P.L. 115-174), lets permitted financial institutions check name, date of birth, and SSN against SSA records through a fee-based API. That is the shape of most SSA data work: high-volume, low-latency matching against authoritative records.
How a disability case actually moves
Understanding the pipeline is worth more than understanding the org chart, because every stage is a queue and every queue is a budget line.
The Disability Adjudication Pipeline
End to end, a contested claim can take years, and average initial-determination time has run north of 200 days in recent reporting periods. Every hour a technology takes out of stage two or stage four is money the agency can point to in front of an appropriations subcommittee. That is the argument SSA buyers are trained to hear.
The named systems your work will touch
| System or program | What it does | Where engineering shows up |
|---|---|---|
| DCPS | The common Disability Case Processing System used across the state DDS network | Integration, data migration, workflow instrumentation, reporting |
| IMAGEN | Natural-language analysis of medical evidence to surface findings for adjudicators | Extraction quality, provenance, evaluation against adjudicator judgment |
| Insight | Decision-support and quality review for hearings and appellate operations | Policy-compliance checks, rationale traceability, reviewer tooling |
| QDD and Compassionate Allowances | Predictive flagging of claims likely to be allowed, for expedited handling | Model monitoring, drift detection, disparity testing, documentation |
| Electronic Records Express and Health IT | Intake of medical evidence as documents and as structured clinical exchange | Ingestion pipelines, OCR, document classification, deduplication |
| eCBSV | Fee-based SSN verification API for permitted financial institutions | Throughput, latency, matching logic, audit logging |
SSA also publishes an annual artificial intelligence use case inventory under Executive Order 13960, which is the fastest public read on what the agency already runs and what it is willing to say about it. Several of the systems above appear there by name. Read it before writing anything.
SSA has no SBIR program, and that changes the entry path
Under 15 U.S.C. 638(f), only federal agencies with extramural research and development obligations above $100 million are required to run an SBIR program. Eleven agencies participate. SSA is not one of them. There is no Phase I on-ramp here, no annual solicitation list, no small feasibility award to enter on. Firms accustomed to reaching federal customers through SBIR need a different plan for this one.
What exists instead is a research portfolio funded through cooperative agreements and ordinary contracting. SSA supports a Retirement and Disability Research Consortium of university-based centers, including centers associated with Boston College, the University of Michigan, and the University of Wisconsin, plus a small-grant program for doctoral research on disability, rehabilitation, and work. Those are academic instruments. For a firm that builds software, the road in is a FAR contract or a subcontract under one.
Vehicles, thresholds, and where the notices appear
SSA runs conventional FAR-based acquisition. Most information technology services flow through the GSA Multiple Award Schedule, particularly SIN 54151S for IT professional services and the cloud SINs, and through governmentwide acquisition contracts such as GSA Alliant 2 and the NITAAC CIO-SP family. Products often ride NASA SEWP. Small business set-asides are common at the task-order level, and an 8(a) firm can receive a sole-source services award up to $4.5 million under 13 CFR 124.506.
Know the thresholds, because they tell you which door a requirement will use. The micro-purchase threshold is $10,000 and the simplified acquisition threshold is $250,000 under FAR 2.101. Commercial products and services can be bought using simplified procedures up to $7.5 million under the FAR 13.500 test program. Above that, expect a full competition or a task order under an existing vehicle.
Here is the part firms miss. A large share of SSA task orders are solicited as requests for quotation against the GSA Schedule under FAR 8.405-2, which are posted on GSA eBuy to schedule holders, not to the world on SAM.gov. Watching SAM.gov alone means watching a fraction of the pipeline. If your firm is not on a schedule, get on a team that is, and set up eBuy visibility as a priority rather than an afterthought.
The access gates that decide who gets in
SSA data is among the most protected in civilian government, and the controls are not negotiable. This is the compliance perimeter for any firm that wants to touch production records.
- Section 1106 of the Social Security Act (42 U.S.C. 1306) and SSA's disclosure rules at 20 CFR part 401 govern every release of program information, with criminal penalties attached.
- The Privacy Act of 1974 (5 U.S.C. 552a) requires a matching System of Records Notice for the records your system touches, and routine-use analysis before data moves.
- Federal tax information received from IRS under 26 U.S.C. 6103 carries IRS Publication 1075 obligations, including personnel screening and a prohibition on offshore access.
- Contractor staff need favorable suitability determinations under 5 CFR part 731 and HSPD-12 credentials before they get accounts.
- FISMA applies, which means a FIPS 199 categorization and a NIST SP 800-53 Rev. 5 control baseline, with FedRAMP authorization for any cloud service in the boundary.
- Controlled Unclassified Information marking and handling follow 32 CFR part 2002 and the agency's own handbook.
- Section 508 of the Rehabilitation Act (29 U.S.C. 794d) and the Revised 508 Standards at 36 CFR part 1194 apply to everything a claimant or an employee will see.
None of this is exotic once a firm has done it, but all of it takes calendar time, and the calendar time belongs on the schedule you propose. Firms that price a six-week build and then discover a twelve-week suitability process have priced the wrong thing.
Accessibility is a hard engineering requirement here
SSA serves a public that is older and more disabled than the country as a whole. That is the program's design. Section 508 conformance at this agency is a functional requirement with a real user behind every criterion, not a form to sign at the end. The Revised 508 Standards incorporate WCAG 2.0 Level A and AA by reference for electronic content. The Department of Justice rule issued under Title II of the Americans with Disabilities Act sets WCAG 2.1 Level AA for state and local government web content, with compliance dates phased by entity size, which reaches the state DDS agencies that adjudicate on SSA's behalf.
For anyone building an interface on top of a model, this has a sharp technical edge. Streaming text, dynamic result panes, confidence indicators, and inline citations all have to be announced correctly to a screen reader, operable by keyboard alone, and legible at 200 percent zoom. Our engineers treat conformance as part of the definition of done and test it with assistive technology, because a demo that fails a screen-reader walkthrough at an SSA review is finished in that room.
AI governance is part of the delivery
Any model that shapes an entitlement decision is rights-impacting, and the federal governance framework says so explicitly. Executive Order 13960 established the public use case inventory. OMB memorandum M-24-10 in 2024 set minimum practices for rights-impacting and safety-impacting uses, required agencies to name a Chief AI Officer, and mandated pre-deployment testing, impact assessment, ongoing monitoring, human oversight, and a route for people to contest an outcome. It was replaced in 2025 by M-25-21, with a companion memorandum on AI acquisition, M-25-22, that pushes those expectations into contract terms.
Translated into engineering work, the requirements are concrete. Model documentation a program analyst can read. Evaluation on data that reflects the actual claimant population, reported by subgroup. Logging that reconstructs why a specific case was flagged, on a specific date, under a specific model version. A human decision point that is real rather than nominal. A rollback plan. Our team writes these artifacts alongside the code, because at this agency they are contract deliverables and retrofitting them costs far more than producing them as you go.
Where a small engineering firm realistically fits
Not the enterprise mainframe rewrite. Those programs run for years under large integrators with hundreds of billets. The realistic fits are bounded, technically demanding pieces where depth matters more than headcount, and there are more of them than most firms expect.
Document understanding over medical evidence with span-level provenance, so every extracted finding points back to a page an adjudicator can open. Entity resolution and duplicate detection across records that were never designed to be joined. Improper-payment analytics that produce a case a program integrity analyst can defend rather than a score nobody can explain. Accessible front ends over legacy transactions. Cloud data engineering and MLOps inside an authorized boundary, with the evidence package that keeps the authorization alive. Independent evaluation of a model another vendor built, now that governance memoranda require testing agencies cannot always run in-house.
On contract structure, the subcontract path usually moves faster here, because the task orders are large and the vehicles are held by firms that need specialist benches they do not carry full-time. Our team works both ways, prime or subcontract. Before approaching anyone, pull the incumbent picture from FPDS-NG and USAspending.gov by NAICS 541512, 541511, 541519, and 541715 and by the D-series product service codes for information technology. That shows who holds what, how big it is, and when it recompetes.
The first step, concretely
The sequence is short, and none of it requires permission. Register in SAM.gov with UEI, CAGE, and NAICS codes that read as software and data services rather than something generic. Read the latest Agency Financial Report and Annual Performance Report, and write down the three operational measures SSA has told Congress it is trying to move. Read the public AI use case inventory and note which offices own which entries. Pull three years of SSA obligations from USAspending by office and vehicle, and mark two recompetes inside the next eighteen months. Get on a schedule or onto a team that holds one, and turn on eBuy visibility. Then write one page naming a single queue, a measurable effect on handling time, and the security posture that makes it credible, and send it to SSA's OSDBU with a request for the procurement forecast and the next vendor outreach session.
That page is the pitch. Everything else is follow-through.
Bottom line
SSA is a records agency with a text problem, an appeals backlog, a flat administrative account, and a legal duty to explain every decision it makes to the person it affects. That combination rewards firms who can extract meaning from documents without losing the citation, join records that were never meant to be joined, and ship it all inside a control boundary that survives an audit. Our team builds exactly that kind of system, and we are glad to look at a specific queue with you.
Frequently asked questions
No. Under 15 U.S.C. 638(f), SBIR participation is required only of agencies with extramural research and development obligations above $100 million, and eleven agencies participate. SSA is not among them. Entry is through ordinary FAR contracting, GSA Schedule task orders, governmentwide acquisition contracts, set-asides, or subcontracts.
The Office of Systems and the CIO organization own most enterprise IT. Program demand comes from the Office of Hearings Operations, the Office of Operations, the Office of Analytics, Review, and Oversight, and the Office of Retirement and Disability Policy. Every award is executed by the Office of Acquisition and Grants, and the Office of Small and Disadvantaged Business Utilization is the entry point for new vendors.
SSA work is generally unclassified, so the gate is suitability rather than a security clearance. Expect a background investigation and a public trust determination under 5 CFR part 731, plus an HSPD-12 credential. Anyone touching federal tax information received from IRS also falls under Publication 1075, which adds screening requirements and bars access from outside the United States.
Open-market solicitations appear on SAM.gov, but a large share of task orders are competed as schedule requests for quotation under FAR 8.405-2 and posted only on GSA eBuy to schedule holders. Watching SAM.gov alone will miss much of the pipeline. The agency's procurement forecast, available through its OSDBU, shows what is coming before it is solicited.
Anything that shapes an entitlement decision is treated as rights-impacting. Executive Order 13960 requires public use case inventories, and OMB's AI memoranda set minimum practices including pre-deployment testing, impact assessment, ongoing monitoring, meaningful human oversight, and a way for an affected person to contest the outcome. The 2025 acquisition memorandum pushes those obligations into contract terms, so plan to deliver the documentation with the code.