Compass Federal Consulting LIMITED Liability Company

Compass Federal Consulting LIMITED Liability Company, doing business as Compass Federal Consulting, is a for-profit limited liability company based in Shamong, New Jersey that delivers Risk Management Framework (RMF) assessment, authorization, continuous monitoring, and cybersecurity compliance services to federal civilian agencies as a prime contractor on 86% of recent awards and as a subcontractor on select defense and civilian IT programs. The vendor competes predominantly full-and-open on GSA Schedules and agency BPAs rather than under SBA set-asides; recent awards carry no set-aside designations across the portfolio.

Compass Federal's customer base is heavily concentrated in the Department of Health and Human Services' National Institutes of Health. The National Heart, Lung, and Blood Institute (NHLBI) accounts for ten awards and $101.9 million in combined potential value — roughly 86% of the vendor's total federal pipeline. The Smithsonian Institution Office of the Chief Information Officer represents the secondary customer with eight awards and $4 million in potential value, while the NIH National Institute of Environmental Health Sciences, the NIH Office of the Director, and the NIH Center for Scientific Review round out the top five. This concentration in NIH-affiliated customers reflects Compass Federal's specialization in federal cybersecurity and compliance frameworks rather than broad IT services.

The vendor's primary vehicle is the GSA Multiple Award Schedule, which carries 18 task orders with $114 million in combined potential value. Compass Federal also holds position on the NIH Office of the Chief Information Officer Risk Management Framework BPA, a multiple-award vehicle serving all NIH institutes, with twelve task orders totaling $25.6 million. A single-award Indefinite Delivery Contract with Smithsonian OCIO (IDC 33330223DF0010348) has generated seven delivery orders worth $4 million. Representative prime work includes a $4.95 million BPA call from NIH's Office of the Director for system security documentation and technical support (ultimate completion September 2027), a $7.46 million NHLBI BPA call for cybersecurity risk management framework services including security assessments and vulnerability management (September 2026), a $1.9 million Total Small Business set-aside delivery order from the National Institute of Environmental Health Sciences for RMF assessment and continuous monitoring through 2031, and a $399 thousand CPSC delivery order for governance, risk, and compliance support migrating from NIST SP 800-53 Revision 4 to Revision 5. Across Smithsonian work, Compass Federal has fielded labor-hour delivery orders for ISSO services, security training and awareness, vulnerability support, supply chain risk management, and security engineers, with individual orders ranging from $264 thousand to $798 thousand.

Activity has remained relatively stable at six to seven awards per year from 2022 through 2024, declining to two or three annually in 2025 and 2026. Six awards with combined potential value of $11.9 million reach ultimate completion within the next twenty-four months and face recompete risk. SCI-reported invoicing was $6.2 million across FY2022–FY2025, with peak activity in FY2024 ($5.3 million across 21.8 FTEs). Government-paid hourly rates on SCI-reportable prime contracts span a median of $118/hr, with the 10th percentile at $88/hr and the 90th percentile at $144/hr, reflecting a labor portfolio anchored in mid-career security engineers and project managers. GSA Schedule labor categories span Information Security Analyst through Information Security Subject Matter Expert roles, ranging from $90.93/hr for junior positions to $239.29/hr for senior SME roles; no security-cleared positions are offered.

Compass Federal operates primarily as a self-performing prime, with subcontractors representing only 4% of total contractor hours across SCI-reportable prime contracts. The vendor names seven subcontractors in that dataset; recent sub-award work includes cybersecurity operations services as a subcontractor to Axle Informatics (June 2026), attack surface management services under General Dynamics Information Technology (September 2024), and unified communications and collaboration professional support under Deloitte & Touche (February 2024). This sub-engagement pattern suggests Compass Federal is a supplemental capability provider to larger defense and IT systems integrators rather than a feeder organization; the vendor's federal footprint is anchored in its own RMF and compliance delivery.

Compass Federal Consulting provides Information and Cyber Security and Program Management Office services to federal and commercial clients. We specialize in FISMA Compliance, including all aspects of the Risk Management Framework (RMF) and have expertise with NIST 800 Series and FIPS document compliance. We perform independent Security Control Assessments (SCA) and offer independent Penetration Testing and Vulnerability Management Services.