Cormac Corporation

Cormac Corporation, a woman-owned small business and HUBZone-certified firm based in Leesburg, Virginia, delivers data analytics, database administration, IT management, and healthcare compliance services to federal civilian agencies as a pure prime contractor (100% of recent awards). Cormac is a Subchapter S corporation with minority ownership (Subcontinent Asian American-owned) and competes predominantly under small-business set-asides — Woman-Owned Small Business, HUBZone, and Total Small Business designations anchor most of its prime work. The company operates across primary NAICS codes 541512 (Computer Systems Design Services) and related IT services categories, with particular depth in healthcare IT and federal compliance data work.

Cormac's customer concentration is dominated by the Department of Health and Human Services. The top five funding agencies account for 95% of recent awards by count, led by CMS (23 awards, $724.7 million combined potential value), FDA (9 awards, $6.7 million), GSA Federal Acquisition Service (6 awards, $45.8 million), AHRQ (2 awards, $23.6 million), and NIH NITAAC (2 awards, $40 billion combined potential value). The rankings diverge sharply on dollar concentration: HHS programs dominate both volume and dollars, but NIH's two awards — both OASIS+ IDIQs — carry $40 billion in combined potential value, anchoring Cormac's total $41.05 billion combined potential value across all 44 awards. That figure is driven by three GSA OASIS+ multiple-award IDIQs: OASIS+ Total Small Business (awarded December 19, 2024, no ceiling specified), OASIS+ Women-Owned Small Business (September 30, 2024, no ceiling specified), and OASIS+ HUBZone (September 30, 2024, no ceiling specified). Cormac also holds a $500 million single-award Blanket Purchase Agreement with CMS under the Data Analytics Supporting Healthcare (DASH) vehicle running through February 2027, and a $249 million Defense Department Basic Ordering Agreement for AI Data Readiness work under the Joint Artificial Intelligence Center framework (March 11, 2022 through March 2027).

Representative capability work includes a $76.7 million BPA call from CMS under DASH (November 25, 2024, extending through October 2029) for quality measure implementation and reporting services with subcontractors including ABT Global, Softcom, Solid Logix, Full Tilt Data, Healthcare Management Solutions, and Kollabio (8(a) certified); a $4.3 million delivery order from CMS on August 10, 2026, for civil money penalty application and reinvestment state plan reviews under the Multiple Award Schedule (ultimate completion August 9, 2029); a $2.6 million delivery order from AHRQ for Medical Examination Program System (MEPS) website redesign under the Strategic Partners Acquisition Readiness Contract (September 23, 2024, completed March 10, 2025); and a $614.8 thousand delivery order from the Federal Maritime Commission for a data lake proof of concept under the Multiple Award Schedule (September 29, 2023, completed September 28, 2025). Across these contracts, Cormac's delivery spans data architecture, database administration, compliance analytics, digital transformation, and health IT services; the company also holds a position on the CIO-SP3 SB GWAC.

SCI-reported invoicing totaled $39.5 million across FY2022–FY2025 (prime contracts above the $150,000 reporting threshold), with $15.7 million invoiced in FY2025 across 55.9 FTEs, up sharply from a low of $3.7 million and 18.7 FTEs in FY2024 — a rebound trajectory consistent with OASIS+ IDIQ mobilization in late 2024. On SCI-reportable prime contracts, Cormac delivered the work itself with minimal subcontractor reliance (4% average sub-hours share across prime contracts), naming 14 total subcontractors. Government-paid rates on SCI contracts ran a median of $120.17 per hour, with a spectrum from $94.65 (10th percentile) to $160.41 (90th percentile). GSA Schedule labor portfolios span 150 categories across a $48.30–$308.33 hourly range, anchored in mid-level IT, health IT development, database analysis, and subject-matter expertise roles, with no security-cleared labor offered.

Within the next twenty-four months, one award totaling $20.9 million reaches ultimate completion, presenting modest recompete exposure. The vendor's recent trajectory shows one award in 2021, three in 2022, two in 2023, five in 2024, and one in 2026 (a partial-year count as of August 2026), with activity accelerating most sharply under OASIS+ vehicles awarded in September and December 2024. Cormac operates as a pure prime contractor with no sub-award footprint in the source data and does not pursue defense work directly; its single DoD relationship is a ten-year-old BOA for data readiness.

CORMAC Corporation is a CMMI ML3 certified company that provides professional data management services, IT services and full Software Development Life-cycle (SDLC) solutions to Federal Government and private sectors.