The Department of Homeland Security's Office of the Chief Procurement Officer (OCPO) released the solicitation for the FLASH II BPA in March 2026, with proposals due in late May. FLASH II replaces the current FLASH BPA — DHS's primary vehicle for agile IT and software development services — and expands it to a $6 billion ceiling with dedicated socioeconomic tracks. The solicitation is posted at SAM.gov under the DHS OCPO industry page.
New set-aside tracks in FLASH II
FLASH I was awarded exclusively on an unrestricted basis, leaving small businesses to compete as subcontractors or primes only on the full-and-open track. FLASH II addresses this with separate ordering tracks:
- Unrestricted track: Open to any size firm; large business or small
- 8(a) track: Reserved for SBA-certified 8(a) firms; no competition required for sole-source task orders under $4.5M
- WOSB track: Reserved for women-owned small businesses in NAICS codes designated as underrepresented
- SDVOSB and HUBZone set-asides will be accommodated through task order competition, not separate BPA tracks
Scope and capability areas
FLASH II covers six functional areas (FAs), each of which will have separate CLIN structures:
- FA1: Agile software development and DevSecOps
- FA2: Cloud infrastructure and migration
- FA3: Cybersecurity (including CISA support, Zero Trust implementation)
- FA4: Data and analytics
- FA5: IT operations and maintenance
- FA6: Emerging technologies (AI/ML, RPA)
What to do before proposals are due
- Decide which track and functional areas to target — submitting across all FAs in multiple tracks is possible but resource-intensive
- 8(a) firms should confirm current program participation status in SAM.gov — expired 8(a) certifications at time of award will disqualify
- Identify at least two relevant DHS or large-agency agile delivery references; DHS evaluators place heavy weight on civilian agency IT experience
- Review FLASH I task order history on USASpending.gov to size labor categories and pricing benchmarks