What NAICS 519210 covers and what agencies buy under it
NAICS 519210 covers data processing, hosting, and related services. The SBA's definition includes businesses that provide data entry, data storage, data processing, and information retrieval services. Cloud infrastructure, managed hosting, colocation, data center operations, and disaster recovery services all fall here.
Federal agencies buy a wide range of services under this code:
- Cloud infrastructure (IaaS, PaaS, SaaS platform hosting)
- Government data center operations and modernization
- Backup, archival, and disaster recovery services
- Managed database services
- High-performance computing (HPC) for scientific agencies
- Data processing for benefits, tax, and grants systems
The biggest buyers are agencies with large transaction-processing needs: the IRS, Social Security Administration, Department of Veterans Affairs, Department of Defense, and Department of Homeland Security. NASA and NOAA also spend heavily here for scientific computing and satellite data processing.
Federal spend and trend direction
USASpending.gov shows federal prime contract obligations under NAICS 519210 running well above $8 billion annually as of FY2023, with year-over-year growth driven by the federal cloud migration mandate that started with OMB M-19-17 and accelerated through the Cloud Smart strategy. That mandate isn't slowing down. The General Services Administration projects cloud spending across the federal government continuing to grow through at least FY2028.
The DoD alone has awarded multi-billion-dollar cloud contracts under JWCC (Joint Warfighter Cloud Capability), with task orders flowing to AWS, Microsoft Azure, Google Cloud, and Oracle. JWCC task orders run under several NAICS codes; 519210 captures a meaningful share.
The IRS Modernization program, VA's EHR migration, and multiple agency data center consolidation efforts are all active. Each generates solicitations at the prime and subcontract level.
Set-asides most commonly used under this code
The data matters here. Pull historical awards on USASpending.gov filtered to NAICS 519210 and you'll see a breakdown across set-aside types:
8(a): The most commonly used small-business set-aside in this NAICS. Sole-source 8(a) awards are possible up to $4.5 million for services, which means a well-positioned 8(a) firm can capture a direct award without competing against hyperscalers. SBA-negotiated 8(a) competitive awards happen regularly in this space, particularly at USDA, HHS, and civilian agencies.
HUBZone: Used less often than 8(a) but present, particularly for data center colocation services in HUBZone-eligible areas. Some agencies run HUBZone set-aside task orders off GWACs.
WOSB/EDWOSB: Growing in use. WOSB is eligible across most service categories, and women-owned firms with FedRAMP-authorized offerings are increasingly competitive.
SDVOSB: VA is the primary user of VOSB/SDVOSB set-asides, and VA spends heavily on IT services including hosting and data processing. If you're pursuing this path, VA's Technology Acquisition Center (TAC) is the contracting office to watch.
Unrestricted full and open: The largest awards in this space are unrestricted, going to AWS, Microsoft, Google Cloud, and large systems integrators. These create subcontracting opportunities.
Key contract vehicles
You cannot win federal cloud and hosting work without being on the right vehicles. Here are the ones that matter most:
GSA Multiple Award Schedule (MAS), SIN 518210C — formerly SIN 132-40. This SIN specifically covers cloud computing services. Getting on Schedule is the baseline. Without a GSA Schedule contract, many agencies simply won't engage with you for small purchases.
GSA Alliant 2 — the flagship GWAC for IT services. The current Alliant 2 base runs until 2027, and GSA is developing Alliant 3. Watch for on-ramp opportunities. Large IT service firms use Alliant 2 heavily for cloud task orders.
CIO-SP4 (NIH) — the National Institutes of Health's government-wide IDIQ, used across civilian agencies. Cloud and hosting services are within scope. On-ramp solicitations occur periodically.
SEWP V (NASA) — Solutions for Enterprise-Wide Procurement. Primarily hardware and products, but managed services including hosting fall within scope. A faster on-ramp process than Alliant 2.
OASIS+ (GSA) — launched in 2023 as a professional and technical services GWAC. Cloud-adjacent managed services and consulting fall here. On-ramps for small business pools are available.
Agency-specific IDIQs — VA's T4NG II, DHS EAGLE II successor vehicles, DoD ITES-SW3 for software and hosting. These are harder to get on but generate high-volume task orders.
SBA size standard
The SBA size standard for NAICS 519210 is $34 million in average annual receipts (revenue), measured over three years. This is a revenue-based standard, not employee headcount.
That $34 million ceiling means mid-sized regional managed service providers and cloud brokers can qualify as small businesses. You can grow a meaningful federal practice and still maintain small-business status under this code.
Verify your size before any proposal. Size is self-certified and challenged by competitors. Use SBA's Size Standards Tool at sba.gov to confirm the current threshold, as SBA updates standards periodically.
Certifications that give a competitive edge
FedRAMP Authorization is the single most important credential in this market. The Federal Risk and Authorization Management Program sets the security baseline for cloud services sold to federal agencies. Without FedRAMP, you cannot sell cloud infrastructure or hosting to most federal buyers. Getting authorized takes 12 to 18 months and costs $250,000 to $500,000 or more, but it creates a durable barrier to entry.
Two paths to FedRAMP: sponsor-first (an agency agrees to sponsor your authorization) and the newer FedRAMP Marketplace Ready route for SaaS. The Joint Authorization Board (JAB) path is harder and reserved for higher-priority offerings.
StateRAMP is the state-government equivalent of FedRAMP. Not directly relevant to federal contracts, but it expands your addressable market to state and local government.
SOC 2 Type II — not a federal requirement per se, but contracting officers at civilian agencies increasingly ask for it as evidence of security controls. Get it before you're deep in proposal season.
8(a) Business Development Program — if you're minority-owned or socially disadvantaged and have under $4 million in personal net worth, apply now. The 8(a) program offers sole-source award authority and preferential treatment in competitive bids. The application process runs 90 to 120 days through the SBA. The nine-year term starts the day you're certified, so apply early.
ISO 27001 — international information security management standard. Required by some DoD contracts and increasingly referenced in civilian RFPs. Pairs well with SOC 2 Type II.
Finding active solicitations
beta.SAM.gov is the authoritative source for federal solicitations. Use the advanced search:
- NAICS: 519210
- Set-aside type: filter by 8(a), HUBZone, WOSB, or SDVOSB
- Award type: solicitation
- Date range: active (not archived)
Set up email alerts in SAM.gov for your NAICS code so you're notified when new solicitations post.
Beyond SAM.gov:
Agency forecast sites publish planned acquisitions before they hit SAM. Key ones: GSA Forecast of Contracting Opportunities (forecast.gsa.gov), DoD's procurement forecast (acqnotes.com aggregates many), VA's planned acquisitions posted on VAP (vendor.va.gov).
USASpending.gov for competitor intelligence. Search awards in NAICS 519210, filter to small business set-asides, and see who's winning, at what agencies, under which vehicles. That's your competitive landscape in a single export.
GovWin IQ (Deltek) and BGov (Bloomberg Government) are paid tools that aggregate forecasts and provide earlier intel than public SAM postings. Worth the subscription if you're serious about pipeline development.
Realistic path for a new entrant
The honest version: you will not beat AWS on a full and open $500 million cloud migration contract. That's not the play.
The first contract for most new entrants in this NAICS looks like one of three things:
Subcontract to a large prime. AWS, Microsoft, Accenture Federal Services, and Leidos all have subcontracting plans with diversity spend requirements. Their supplier diversity contacts are listed in SAM.gov as part of their contractor profiles. A realistic first step is qualifying as a subcontractor, performing work, and building past performance. Past performance is the single hardest barrier for new federal entrants — subcontracting solves it.
Sole-source 8(a) award. If you're 8(a)-certified and have a FedRAMP-authorized product or a niche service (say, data migration from a specific legacy platform), an agency program officer can award you a sole-source contract up to $4.5 million without competition. This requires relationship-building with agency contracting officers in advance. Attend agency industry days, respond to RFIs, and make yourself known before solicitations drop.
Small IDIQ task order. Get on GSA Schedule SIN 518210C, then respond to small task orders from agencies with established cloud budgets. GSA eBuy posts requests from agencies to Schedule holders. Task orders under $250,000 can move quickly. Use these to build past performance.
Budget 12 to 24 months for the first award if you're starting from zero. FedRAMP authorization plus 8(a) certification plus GSA Schedule = roughly 18 to 24 months of parallel workstreams. Starting them concurrently is the only way to compress that timeline.
The subcontracting path is faster. If you have the technical capability, go find a prime contractor's subcontracting plan and call the contact listed.
Federal data processing and hosting contracts reward staying power. The agencies that buy here have multi-year budgets, renewal cycles, and contract vehicles designed for recurring spend. Get in small, perform well, and expand from there.
