The SDVOSB Capability Statement That Actually Wins VA AI Work

What is a capability statement actually for?

It answers four buyer questions in about thirty seconds: What do you do? For whom? Why are you low-risk? How do I buy from you? It is not a brochure, a slide deck, or a proposal — it’s a one-page resume for your business, and a contracting officer or small-business specialist may scan dozens in a sitting. VA OSDBU teaches a five-section model — Core Competencies, Past Performance, Differentiators, Company Data, and Pertinent Codes (NAICS/PSC) — and the eye moves across the page in a Z pattern, so your name, certifications, NAICS, and contact details belong in the corners where the scan lands. The design rules that come up repeatedly: one page, a text-searchable PDF under about 1 MB, 10–12 pt minimum, bullets not paragraphs, two or three colors, no agency logos (VA forbids use of its seal in vendor marketing), no pricing, and a clean filename like Truvisory_Capability-Statement_VA_2026-05.pdf rather than cap_v7_final_FINAL.pdf.

A 2026 wrinkle worth building for: more federal offices now run capability statements through AI to summarize and surface vendors, so the PDF must be genuinely text-searchable (not a flattened image) with keywords that match the agency’s own language.

What goes in the company-data block in 2026?

This is the block where stale templates quietly disqualify you. The current, correct version.

The rest of the block: legal business name exactly as registered in SAM.gov (not your DBA); CAGE code (Truvisory: 0HPQ0); SAM.gov status: Active with the renewal year; primary + 3–5 secondary NAICS with size standards; 3–6 PSC codes; accepts Government Purchase Card (Yes); and a named point of contact with a direct phone and a real work email — not a generic inbox.

Which NAICS and PSC codes belong on an AI/automation statement?

Keep it tight — three to five NAICS, not thirty. The working set.

For PSC codes — which classify what is bought, distinct from NAICS’ who sells it — the current AI/automation set is DA01 (application development support, labor), DA10 (the same as SaaS/subscription), DE01/DE02 (end-user IT), DF01 (IT management), and DJ01 (security and compliance). The old D302/D316 ADP codes are end-dated — if they’re on your statement, you’re showing market research that stopped in 2020.

How do I write competencies and differentiators when I’m Cloudflare-native?

The trap every technical founder falls into is writing in tool-speak (“Cloudflare Workers, R2, D1, Vectorize”) or vendor-speak (“synergistic AI-driven solutions”). Neither maps to how a CO searches. They’re looking for mission keywords that match VA’s own vocabulary. So translate. Five competencies that read in the buyer’s language: document automation for benefits and clinical workflows; RAG-based policy and SOP assistants grounded in VA directives with citation enforcement; claims and Automated Decision Support tooling that augments — never replaces — the human adjudicator; AI governance and compliance enablement aligned to M-25-21; and Cloudflare-native secure delivery inside the FedRAMP Moderate boundary.

Differentiators are where a new solo SDVOSB actually beats an incumbent on the page, because they don’t depend on a contract history:

• SBA-certified SDVOSB — qualifies for VA’s Vets First priority under 38 U.S.C. § 8127.
• Combat-veteran founder as the single accountable technical POC — the person on the proposal is the person on the keyboard; no layered subcontracting.
• Fixed-scope, 90-day delivery — calibrated to VA pilot budgets and ATO timelines, which reduces a CO’s execution risk.
• Cloudflare-native, FedRAMP-aware, VAEC-ready and ATO-literate — builds inside VA reference architectures, not around them.
• M-25-21-aligned — impact-assessment and human-in-the-loop artifacts as standard deliverables.

One thing not to claim: CMMC certification. CMMC is a DoD-only program and is not required for VA civilian work — implying you hold it is a credibility-killer with an informed CO. The honest line, “FedRAMP-aware, not CMMC (CMMC is DoD-only),” is itself a differentiator over DoD-focused vendors who don’t know the civilian stack. The full argument lives here.

What do I put in “Past Performance” when I don’t have any?

First, rename it. Calling the section “Relevant Experience” lets you mix commercial, founder, and pilot work honestly without overclaiming a federal record you don’t have. Leaving it blank is the worst move — it signals you don’t understand the market. The honest playbook, in order of credibility: commercial work rewritten in government scope language with a measurable result (“designed a HIPAA-aligned document-classification pipeline processing ~25,000 records/month; cut manual triage ~65%; delivered fixed-scope in 11 weeks”); founder past performance clearly labeled as such; subcontract or teaming experience; micro-purchases under $10,000 — which are roughly 70% of all government procurement transactions and the fastest way to earn a citable government past-performance line; and pilots, demos, or open-source repos you can link to.

Your strongest structural lever is VAAR 819.7008(h), which requires VA COs to consider a first-tier subcontractor’s past performance when an SDVOSB prime’s own record doesn’t independently show capability. Cite it explicitly when you pitch T4NG2 or SPRUCE primes to add you to a team — it’s the regulation that makes a no-CPARS firm worth carrying.

How do VA buyers and primes actually use the document?

Distribution beats polish. The proven 2026 loop: tune your SBS profile so your SDVOSB status, AI/automation NAICS, and the capability-statement link all show; attach a tailored statement to every fitting Sources Sought / RFI on SAM.gov, because that’s the stage where set-aside decisions get made under the Rule of Two; hand it to Procurement Decision Makers at VA OSDBU’s Direct Access Program events; email named small-business specialists at VA OIT, VHA’s National AI Institute, and your regional VISN; and send subcontractor-framed variants to T4NG2 and SPRUCE primes. Two current-events notes: the VA’s flagship NVSBE event was discontinued for 2025 with no 2026 date announced, so the de facto industry replacement is the NVSBC VETS26 Conference, June 1–4, 2026 in New Orleans; and SBA reported in November 2025 that it cleared the VetCert backlog and cut processing to about 12 days, so if your certification is pending it should move quickly.

A one-page template you can build from

• Header band: logo + legal name + a one-sentence offer (“Fixed-scope, 90-day AI and automation delivery for VA — document automation, RAG policy assistants, claims-support tooling, ATO-literate, M-25-21-aligned”); certification badge “SBA-Certified SDVOSB (VetCert)” top-right.
• Core Competencies (left column): 4–6 mission-language bullets, each tied to an outcome.
• Relevant Experience (right column): 2–4 entries — client or sector, scope, measurable result, dates — labeled honestly (“Commercial – Healthcare,” “Founder prior role,” “Pilot – Open-source”).
• Differentiators (full width): the bullets above, including “FedRAMP-aware (not CMMC; CMMC is DoD-only).”
• Company Data + Pertinent Codes (footer): Legal name · UEI · CAGE · SAM Active · SBA-Certified SDVOSB · NAICS 541512 / 541511 / 541519 / 541611 · PSC DA01, DA10, DE01, DF01, DJ01 · Accepts Purchase Card: Yes · named POC, direct phone, work email, site.

Then work it: confirm VetCert and SAM are clean, get a free APEX Accelerator review (the highest-ROI hour for a new SDVOSB), pursue two or three micro-purchases to seed real government past performance, and refresh the statement quarterly.

Working with Truvisory

Truvisory is an SBA-verified SDVOSB founded by a combat veteran — fixed-scope, 90-day AI delivery on a Cloudflare-native, FedRAMP-aware architecture.

If you’re a fellow veteran founder building your first VA-facing capability statement, the template above is the one we use; if you’re a VA contracting officer or a prime building a team, ours is on the federal page and our credentials are verifiable in SAM.gov and SBA’s VetCert. Get in touch. For the procurement paths a strong statement opens, see Veterans First, teaming on T4NG2, T4NG2, and SPRUCE; for what you’ll actually build, document automation, the RAG policy assistant, and claims automation.