Centers for Medicare & Medicaid Services runs Medicare, Medicaid, CHIP, and the federal Health Insurance Marketplace. Those programs cover roughly 160 million Americans. Running that infrastructure at scale requires enormous vendor support, and CMS spends approximately $4 billion annually on contracts to do it.
For a diverse small business in IT services, consulting, or healthcare administration, CMS is one of the most accessible large federal buyers. It operates under the Department of Health and Human Services (HHS), which has strong small business and socioeconomic goals baked into its acquisition policy. This guide explains what CMS buys, how the vendor ecosystem works, and how to get your first contract.
What CMS actually buys
The bulk of CMS contract spending falls into a few categories.
Information technology services dominate the portfolio. CMS administers some of the largest health data systems in the federal government. It contracts for software development, cybersecurity, cloud infrastructure, data analytics, system integration, and IT support. If you work in health IT, this is your primary entry point.
Management consulting and administrative support is the second major category. CMS contracts for program analysis, policy research, project management, and operational support across its regional offices and program offices in Baltimore, Maryland, where headquarters is located.
Health insurance and actuarial services form a third category. The agency regularly procures actuarial analysis, claims processing support, and healthcare financial modeling to manage Medicare and Medicaid program economics.
Primary NAICS codes for CMS opportunities include 541519 (Other Computer Related Services), 541611 (Administrative Management and General Management Consulting Services), and 524114 (Direct Health and Medical Insurance Carriers). When filtering SAM.gov for CMS solicitations, these three codes will surface the highest volume of relevant active opportunities.
Contract sizes vary widely. Task orders under large IDIQ vehicles can run from $500,000 to $50 million or more over a five-year period. Standalone small business set-asides tend to cluster between $150,000 and $5 million. Subcontracting roles under large prime contracts are often the first dollar a small business sees from CMS.
Registration: what you need before you apply
Before CMS will award you a contract, you need an active registration in SAM.gov. That registration must show your business as other-than-large under the NAICS codes relevant to your work, based on SBA size standards. Annual renewal in SAM is mandatory; a lapsed registration disqualifies you from award.
Your DUNS number is replaced by the Unique Entity Identifier (UEI), which SAM generates automatically during registration. Make sure your UEI appears correctly on all proposal documents.
If you hold an 8(a), WOSB/EDWOSB, HUBZone, SDVOSB, or VOSB certification, make sure those certifications are verified and reflected accurately in your SAM.gov profile. CMS contracting officers search the system for socioeconomic designations when deciding how to set aside a requirement.
SBA certifications for 8(a) and HUBZone are managed through the SBA, while WOSB and EDWOSB self-certification has been replaced by a certification requirement through an SBA-approved third party or the SBA itself. Get this completed before you approach CMS. Contracting officers will not wait.
The CMS small business office
CMS has a dedicated Office of Acquisition and Grants Management (OAGM) that houses its small business function. The Small Business Specialist at OAGM is your primary contact for understanding upcoming procurements, getting questions answered about socioeconomic set-aside policies, and identifying which program offices have budget for your services.
You can reach the small business function through the CMS website at cms.gov, where the OAGM publishes contact information, small business forecasts, and procurement resources. The agency also publishes a procurement forecast on the HHS forecast tool, which lists anticipated acquisitions by program office, contract type, and socioeconomic category. Reviewing that forecast quarterly gives you a 6-to-12-month window on where new dollars are expected to move.
Do not cold-email program managers. The right sequence is: find the opportunity on SAM.gov or the HHS forecast, reach out to the OAGM small business office, and ask who the cognizant contracting officer is. That sequence keeps you from burning goodwill.
Set-aside and diversity opportunities at CMS
CMS is subject to the same governmentwide small business goals as every federal agency. HHS as a whole has historically been one of the better-performing departments for 8(a) and WOSB utilization. CMS mirrors that pattern.
Set-aside types you will see on CMS solicitations include total small business set-asides, 8(a) sole-source and competitive awards, WOSB and EDWOSB set-asides, HUBZone set-asides, and SDVOSB set-asides. The agency also issues 8(a) sole-source awards for requirements valued below the competitive threshold (currently $4.5 million for services), which is one of the fastest paths to a first award if you hold an 8(a) designation.
Subcontracting plans are required on large prime contracts above simplified acquisition thresholds. That creates a structured pipeline for diverse small businesses to enter as subcontractors. When a large contractor is bidding on a CMS IT modernization contract, they are required to show how small and disadvantaged businesses will participate. Find who the large prime contractors are at CMS by searching USASpending.gov for awards over $5 million, then approach their business development teams directly.
Getting onto CMS vehicles
CMS uses several governmentwide acquisition contracts (GWACs) and HHS-specific vehicles that act as on-ramps.
CIO-SP4, administered by NIH on behalf of HHS, is the primary IT vehicle for health IT work across the department, including CMS. If you are in IT services, qualifying for CIO-SP4 as a small business, 8(a), or HUBZone firm gives you access to task orders across multiple HHS agencies, CMS included.
The HHS-IDIQ vehicles for professional services and program support are other vehicles worth monitoring. Check the HHS Acquisition Resource Center for current on-ramp opportunities.
One practical tip for your first CMS contract
Attend the CMS Small Business Industry Day. CMS hosts periodic industry outreach events, typically announced through SAM.gov and the CMS website, where program offices present upcoming requirements and contracting staff are available for one-on-one sessions.
These events are not purely ceremonial. Program managers attend because they genuinely need to find vendors. If you can speak directly to a program manager about a requirement that fits your past performance, you have created a relationship that survives the formal solicitation process. Contracting officers talk to program managers. That conversation shapes how a requirement is scoped and, in some cases, whether it gets set aside for a socioeconomic category.
Come prepared with a one-page capability statement that leads with your NAICS codes, your UEI, your socioeconomic certifications, and two or three specific past performance examples with dollar values and client names. CMS program managers are reviewing dozens of vendors at these events. Concrete specifics cut through.
Where to start today
Pull the HHS procurement forecast and filter for CMS requirements in your primary NAICS codes. Cross-reference active solicitations on SAM.gov. If you have an 8(a), check whether any CMS requirements are currently in the SBA pipeline as 8(a) referrals. Contact the OAGM small business office to introduce your firm and ask about the forecast.
CMS is a large, stable federal buyer with durable budget authority tied to statutory programs. That means the pipeline does not dry up when discretionary budgets tighten. For a diverse small business with health IT or consulting capabilities, it is one of the better long-term relationships you can build in the federal market.
