Protests Challenge Small Business Rules in $50B Army Deal

Professional services firms bidding on the MAPS vehicle face uncertain small business eligibility and cybersecurity compliance requirements.

Updated on Nov. 6, 2026 in Advertising

Protests Challenge Small Business Rules in $50B Army Deal

Live Poll

Should the government reserve more federal contracts for small businesses?

Three companies filed new protests with the Government Accountability Office against the Army's $50 billion MAPS professional services vehicle, challenging its small business portion and its cybersecurity certification requirements. The protests follow earlier challenges over small business participation and transparency that GAO largely resolved by late September.

Why it matters

For professional services firms, especially small businesses, the outcome determines whether they can compete for a share of a very large federal contract pool. The protests also turn on Cybersecurity Maturity Model Certification (CMMC) requirements, which can add compliance cost and time before a firm can bid at all.

The Army's Marketplace for the Acquisition of Professional Services (MAPS) vehicle carries a $50 billion value, the figure at the center of the protests. GAO previously told the Army to allow small business teams to submit revised bids and the Army reopened the proposal window for them.

The players

Government Accountability Office (GAO)

The federal watchdog agency that adjudicates bid protests and reviews federal procurement decisions for compliance with competition rules.

U.S. Army

The military branch whose contracting office issued the $50 billion MAPS professional services vehicle and manages its solicitation.

AHS Business Services Inc.

A small business protester challenging the MAPS solicitation's small business portion as too narrow.

Mindboard

A protester joining the challenge to the MAPS small business category, arguing small business teams should bid on the commercial-sector vendor portion.

Intelligence Consulting Enterprise Solutions

A contractor protesting the Cybersecurity Maturity Model Certification requirements built into the MAPS solicitation.

The details

Protesters AHS Business Services Inc. and Mindboard argue the Army's approach is too narrow because it limits the small business category, and they contend small business teams should be able to submit proposals for the commercial-sector vendor portion. Intelligence Consulting Enterprise Solutions is challenging the CMMC requirements in the solicitation, which govern how contractors protect controlled unclassified information. The Department of Defense has paused aspects of the CMMC program beyond self-certification, adding uncertainty to the compliance path for bidders.

Summer 2026: earlier protests were filed over small business participation and transparency.
Late September 2026: GAO resolved most of the earlier protests.
November 2026: three new protests were filed against the MAPS vehicle.
Early February 2027: a GAO ruling on the new protests is expected.

Market Landscape

The MAPS protests sit inside a broader federal shift in how professional services are bought through large multi-award vehicles, where set-asides for small businesses compete with cybersecurity compliance gates. The CMMC program is being phased in across defense contracting, and the Department of Defense's partial pause shows how contested its implementation remains for contractors of all sizes.

Professional services firms bidding on large federal vehicles should review whether their cybersecurity posture would meet CMMC requirements before the February ruling. Small businesses weighing a MAPS bid should track whether the small business teaming rules change, since that would reshape their eligibility and competitive position.

The takeaway

Operators in federal professional services should calendar the early February 2027 GAO decision and confirm their CMMC readiness now, since the outcome may change both eligibility and compliance cost. Monitor whether the Department of Defense restores the paused CMMC elements, because that signal would set the compliance timeline for bids across the sector.

What happens next

A GAO ruling on the three new protests against the MAPS vehicle is expected by early February 2027, which will determine whether the small business portion and CMMC requirements stand as written.