Prime vs. Subcontracting: When to lead, when to team

Two developments just shifted the prime-vs-sub calculus for small federal contractors. First, the Pentagon finalized the CMMC rule; requirements start appearing in solicitations beginning 11/10/2025 with a phased rollout over three years. Translation: cybersecurity readiness is no longer a “someday” item, your role choice will hinge on your CUI/FCI exposure and your readiness to pass assessments. Second, access to huge swaths of services and IT work continues to flow through mega-vehicles—OASIS+ (still navigating protests), SEWP V (extended through 10/31/2025 while SEWP VI moves forward), and CIO-SP4 (still in flux). If you’re not on a vehicle, you’ll often need to team with someone who is.