The NIH Information Technology Acquisition and Assessment Center's flagship IT services contract — task areas, tracks, and what holding it means.
Last reviewed on May 12, 2026.
What CIO-SP4 is
CIO-SP4 is a government-wide acquisition contract (GWAC) operated by the National Institutes of Health Information Technology Acquisition and Assessment Center (NITAAC). It is the fourth iteration in the CIO-SP series and provides federal agencies with a streamlined path to acquire IT services, with an emphasis on health-related IT, biomedical research support, and broader civilian and defense IT services. It is structured as a family of indefinite-delivery, indefinite-quantity (IDIQ) contracts.
Like other GWACs, CIO-SP4 is designated for use government-wide. Any federal agency may issue task orders under the contract; NITAAC earns a small fee per task order to fund operations.
Task areas
CIO-SP4 organizes work into task areas that span the IT services landscape. The structure includes areas for:
IT services for biomedical research, health sciences, and healthcare
Chief Information Officer support
Imaging
Outsourcing
IT operations and maintenance
Integration services
Software development
Critical infrastructure protection and information assurance
Digital government
Enterprise resource planning
Software/cloud services
Bidders self-score against task areas during the original solicitation. Contract holders typically support task orders in the task areas where they have the strongest qualifications, though scope-eligible orders can be pursued more broadly.
Tracks and pools
CIO-SP4 separates contract holders into tracks based on size and socioeconomic status. Like other major GWACs, this allows task orders to be set aside for specific small business categories while preserving an unrestricted track for larger awards.
Unrestricted track. Open to firms of any size. Used for task orders that are not set aside.
Small business track. Set aside for small business under the relevant NAICS.
SDVOSB track. Reserved for SBA-certified SDVOSB firms. See SDVOSB / VOSB.
WOSB track. Reserved for SBA-certified WOSB or EDWOSB firms. See EDWOSB / WOSB.
A firm may hold contracts in multiple tracks if it meets the eligibility for each. Most small businesses target one or two tracks plus the small business pool.
How task orders work
Agency develops requirement. A federal customer identifies an IT services need that fits the CIO-SP4 scope.
Track selection. The ordering agency picks a track — unrestricted or one of the set-aside tracks.
Task order RFP issued. A request for task order proposal is released to contract holders in the selected track through NITAAC's electronic ordering system.
Proposals submitted. Contract holders respond with task-order-specific proposals — typically technical approach, key personnel, and pricing under the contract's labor categories.
Evaluation and award. The agency evaluates per the task order's criteria, typically under FAR 16.505 procedures rather than full Part 15 source selection.
Performance. The task order is performed under CIO-SP4 master terms, layered with the task order's specific scope and period.
Task order cycles are generally faster than open competitions — weeks rather than months. NITAAC provides ordering agencies with assistance throughout.
Where CIO-SP4 fits versus other vehicles
Vehicle
Sponsor
Best for
CIO-SP4
NIH NITAAC
IT services with health-IT emphasis but broad federal applicability
Broadest scope, lower competitive density per task order than expected
Agencies often use multiple vehicles in parallel. Vendors with strong IT services capability typically hold CIO-SP4 alongside GSA Schedule and at least one of the other GWACs.
What it takes to hold a CIO-SP4 contract
CIO-SP4 awards are made through periodic competitive solicitations. On-ramps add new contract holders to specific tracks; off-ramps remove non-performing contractors. Original solicitation typical requirements:
Self-scoring against published evaluation criteria — accuracy here is critical, since over-scoring can disqualify
Past performance against the task areas the bidder claims qualification in
Financial responsibility documentation
Required certifications and clearances for the relevant tracks
Self-scoring discipline is the most consequential preparation step. Bidders that over-claim qualifications face protest exposure and possible disqualification.
Common mistakes
Treating CIO-SP4 as "health IT only." The health emphasis is real, but the scope extends across federal IT services. Many agencies outside the HHS family use CIO-SP4.
Over-scoring during self-evaluation. NITAAC and competitors check claimed qualifications carefully. Stretched claims invite protest and disqualification.
Bidding the wrong track. Pursuing unrestricted task orders when you hold only a small business track contract is a non-starter.
Confusing CIO-SP4 with CIO-CS or other NITAAC vehicles. NITAAC operates multiple contracts; scope and eligibility differ.
Skipping post-award business development. Holding the contract does not generate orders. Active capture against ordering agencies is required.