VA SPRUCE for SDVOSBs: The $2.4B 100% Set-Aside Vehicle for VA Digital and AI Work

What is SPRUCE, exactly?

SPRUCE — the acronym expands to Secure, Performant, Reliable, and User-Centered Experiences — is a multiple-award, indefinite-delivery/indefinite-quantity (IDIQ) contract with a ceiling of roughly $2.44 billion over a five-year ordering period running October 1, 2024 through September 30, 2029. It is 100% set aside for service-disabled veteran-owned small businesses, carries a $50 million ceiling per task order, and is managed by the VA Technology Acquisition Center (TAC) in Eatontown, NJ, under the Office of Procurement, Acquisition and Logistics. The primary NAICS code is 541519 — Other Computer Related Services, with a $34 million receipts size standard.

The work is organized into five functional areas: software development and operation; technical advising and architecture planning; service design and user research; data science and analytics; and product support operations. The performance work statement requires contractors to follow the U.S. Digital Service Playbook and OMB’s TechFAR Handbook — a tell that this is agile, product-team-shaped work, not traditional waterfall IT services. In practice, a SPRUCE delivery team looks like a modern software product squad: product and delivery managers, software and site-reliability engineers, user researchers and designers, accessibility and content specialists, and increasingly data scientists and AI engineers.

How is SPRUCE different from T4NG2?

This is the distinction a contracting officer makes, and it’s the one to lead with: SPRUCE is the digital-product team lane; T4NG2 is the enterprise-IT-services workhorse.

T4NG2 is a $60.7 billion vehicle built for broad enterprise scope — infrastructure, networks, cybersecurity, operations and maintenance, and large-scale systems integration — over five-to-ten-year programs. SPRUCE is a $2.44 billion vehicle built for agile, human-centered software delivery: 6-to-18-person product squads shipping veteran-facing or VA-employee-facing tools, doing user research, and iterating in production. A VA contracting officer with a 24-month, $15M agile build for VA.gov or the Office of the Chief Technology Officer routes that to SPRUCE; the same CO routes a five-year, $250M enterprise operations program to T4NG2. The two are deliberately complementary, not redundant — and several firms (IronArch via Peregrine, for one) hold seats on both. The full T4NG2 picture is in the T4NG2 field guide.

For a small, modern AI shop, SPRUCE is often the more natural fit: the product-team orientation, the playbook-driven agile delivery, and the explicit AI/automation task orders map closely to fixed-scope, 90-day software builds.

Where did SPRUCE come from, and why does the timing matter?

SPRUCE is the successor to CEDAR — Customer Experience, DevOps, and Agile Releases — a $247 million SDVOSB IDIQ awarded in March 2021 to four primes: Agile Six, Coforma, MO Studio, and Oddball. CEDAR’s last ordering date is March 28, 2026, and it’s now in tail-only execution — VA has moved new digital work onto SPRUCE. SPRUCE roughly 10x’d the ceiling ($247M to $2.44B), raised the per-order ceiling from $10M to $50M, expanded from four primes to ten, and broadened the functional areas to include data science and AI.

The timing matters because the transition is happening now: as CEDAR winds down, the digital-modernization work it carried — VA.gov product teams, benefits crews, identity services — is reflowing onto SPRUCE task orders, and the ten primes are actively building delivery teams to staff them. Notably, unlike the heavily protested T4NG2, no IDIQ-level protest of the SPRUCE awards has been publicly identified, so the vehicle has been issuing task orders without the multi-year legal delay that held up T4NG2.

Who are the 10 SPRUCE primes?

These are your teaming targets. Of the ten, the ones building AI, chatbot, data, and identity work are the highest-value approaches for an AI/automation sub:

• Agile Six Applications — SDVOSB, CEDAR incumbent; deep VA.gov benefits and cross-benefits product work.
• Aquia Nava II LLC — an SBA Mentor-Protégé JV pairing Aquia (SDVOSB protégé, named HHS’s 2024 SDVOSB of the Year) with Nava PBC (mentor, ~8 years of VA digital pedigree); cloud, cybersecurity, and the disability-application form.
• MO Studio (Magnum Opus) — SDVOSB, CEDAR incumbent; OCTO support, login.gov verification, the VA flagship mobile app.
• Rise8 — SDVOSB; DevSecOps, continuous ATO, and the Lighthouse developer-experience platform; founded by ex-Kessel Run leadership.
• Coforma — SDVOSB (8(a)), CEDAR incumbent; human-centered design, accessibility, benefits content.
• Peregrine Digital Services — an SBA Mentor-Protégé JV of Ad Hoc (mentor) and IronArch (SDVOSB protégé); VA.gov, My HealtheVet, Ask VA, agile product design. The same IronArch JV holds a T4NG2 seat.
• Oddball (fielding most task orders as Oddcore JV with Wilcore Technologies) — SDVOSB, CEDAR incumbent; the highest-velocity awardee on the vehicle, with the VA.gov AI Chatbot, VoiceBot, identity services, and design-system work.
• AVB Digital II — a JV of Bixal and Vaultes (with Blue Guardian IT); design thinking plus cybersecurity.
• One Phoenix Solutions — a JV including OneGlobe and Phoenix Cyber; holds the AI Pilot Teams task order.
• Bravo Communications Services — an SDVOSB JV of American Communications Solutions and By Light; cybersecurity and digital transformation.

Verify any prime’s current SDVOSB status against SBA VetCert and SAM.gov before approaching — JV structures and statuses change.

How does a new SDVOSB AI shop get on SPRUCE?

You can’t prime it — there’s no announced on-ramp, and the ten-prime pool is the closed pool for the five-year ordering period. The path is subcontracting, and SPRUCE makes that path unusually valuable.

On any SDVOSB-set-aside services order, FAR 52.219-14 limits the prime to subcontracting no more than 50% of the work to firms that are not “similarly situated.” A similarly situated entity is a first-tier subcontractor with the same small-business program status as the prime — another verified SDVOSB, small under the order’s NAICS — and work it performs counts toward the prime’s required 50% self-performance rather than against the subcontracting cap. The mechanics are the same as on T4NG2, detailed in the teaming guide — but they bite harder on SPRUCE for one reason: every single SPRUCE order is SDVOSB-set-aside. On T4NG2, only some orders are. On SPRUCE, the prime needs similarly-situated SDVOSB subs on all of them, and “any small business” won’t do — the sub must be a verified SDVOSB.

A worked example: a SPRUCE prime wins a $5M services task order and must keep self-performance plus similarly-situated SDVOSB work at or above $2.5M. If Truvisory (a VetCert SDVOSB) is a first-tier sub at $1.0M, that full $1.0M counts toward the prime’s similarly-situated tally — expanding the prime’s compliant room to subcontract elsewhere. A focused, credentialed SDVOSB AI specialist isn’t just another vendor on the bench; it’s a compliance asset on every order the prime chases. The longer-term path is an SBA Mentor-Protégé Joint Venture — the route two of the ten primes themselves took — which positions a firm to compete for the 2029 recompete.

What AI and automation work is actually flowing through SPRUCE?

Enough to make the case concrete. Documented FY25 SPRUCE task orders with explicit AI content include:

• VA.gov Chatbot — ~$15M (Oddcore JV), using natural-language understanding and processing to help veterans resolve issues on VA.gov.
• VA VoiceBot (Oddcore JV), a voice self-service solution using NLU/NLP through Genesys Cloud to authenticate users and route context to live agents.
• AI Pilot Teams — ~$6M (One Phoenix Solutions JV), delivering rapid AI prototypes and the cloud infrastructure to enable repeatable, accelerated prototyping for benefits delivery.
• Plus a wave of product-team orders — Disability Benefits Crew (~$43M), OCTO Digital Experience Identity Services (~$21M), the VA Innovation Unit technical team (~$40M), design systems, and My HealtheVet platform work — that increasingly carry AI and automation components.

That demand sits on top of the VA’s broader AI posture: the agency’s 2025 AI use-case inventory, released in late January 2026, detailed 367 use cases, and VA leadership has reported that more than 120,000 employees now use a secure internal generative-AI tool, saving two to three hours a week. For a fixed-scope, 90-day AI shop, the fit is clear: RAG over VA policy and benefits content, AI-assisted document and form automation, internal AI tooling for VBA and VHA workflows, and AI features inside veteran-facing products. Each is a sub-tier scope a SPRUCE prime can carve into a task order without owning the whole product-team build. The broader build-vs-team picture is in the VA pillar.

What does SPRUCE require for security — and is CMMC one of them?

No — and as with T4NG2, getting this right with a contracting officer matters.

A SPRUCE contractor inherits the VA’s stack: a VA Authority to Operate under VA Directive and Handbook 6500, the VA Enterprise Cloud (VAEC) on AWS GovCloud and Azure Government (both FedRAMP High), NIST 800-53 controls, mandatory Section 508 accessibility on every veteran-facing product, and HIPAA/PHI handling for any health-adjacent system like My HealtheVet. Contractor cybersecurity obligations flow through VA Handbook 6500.6 and the clause at VAAR 852.239-73.

CMMC does not apply to SPRUCE. The Cybersecurity Maturity Model Certification is a Department of Defense program, codified under DFARS, that reached its effective contract-clause stage in November 2025 and applies only to contractors handling controlled information on DoD contracts. It is not a VA requirement. For a Cloudflare-native shop, the honest and complete positioning is: FedRAMP-aware, building to FedRAMP High patterns on AWS GovCloud and Azure Government and to VA’s Handbook 6500 series, and not CMMC Level 2 certified — which is no barrier on SPRUCE, because CMMC isn’t a SPRUCE requirement. The full framing is in FedRAMP-aware, not CMMC-certified.

Working with Truvisory

Truvisory is an SBA-verified SDVOSB that builds working AI and automation on a Cloudflare-native, FedRAMP-aware architecture — fixed-scope, in 90 days.

If you’re a SPRUCE prime whose next capture needs verified-SDVOSB depth in RAG, document AI, chatbots, or internal AI tooling — and you want a similarly-situated sub who expands your subcontracting headroom on a 100%-SDVOSB order — start with a scoping call. For the full VA picture, see the VA AI modernization pillar; for the enterprise-services companion vehicle, see the T4NG2 field guide.