VA Veterans First and the Rule of Two: Why the VA Buys From SDVOSBs First

What is the Veterans First Contracting Program?

It’s the VA’s statutory mandate to award contracts to veteran-owned firms ahead of everyone else. The program rests on two sections of Title 38 enacted in the Veterans Benefits, Health Care, and Information Technology Act of 2006: 38 U.S.C. § 8127, which sets the VA’s veteran contracting goals and the sole-source and set-aside authorities, and 38 U.S.C. § 8128, which establishes the priority itself. Because the program lives in statute rather than regulation, it can’t be undone by a Federal Acquisition Regulation rewrite — a durability that matters in 2026, as discussed below.

It’s implemented in VAAR Subpart 819.70, “The VA Veterans First Contracting Program,” which spells out the eligibility rules, the order of priority, the set-aside procedures, and the sole-source authorities. The operative engine is § 8127(d): a contracting officer “shall award contracts on the basis of competition restricted to” SDVOSBs when they reasonably expect two or more to bid at a fair and reasonable price.

Why is the VA’s order of priority different from every other agency?

Because at the VA, veteran-owned firms sit at the top of the hierarchy, not alongside the other categories.

At a non-VA agency, FAR 19.203 tells the contracting officer to consider the socioeconomic set-aside programs — 8(a), HUBZone, SDVOSB, WOSB — before general small business, but with no order of precedence among them. The CO has discretion to pick which preference to use. At the VA, VAAR 819.7005 imposes a mandatory sequence: SDVOSB first, then other veteran-owned small business (VOSB), and only then the FAR Part 19 socioeconomic programs and full-and-open competition. The VA’s own regulations make explicit that meeting annual goals, or using a governmentwide vehicle or the Federal Supply Schedule, does not relieve the CO of this duty.

That inversion is the whole game. Everywhere else, an SDVOSB competes for the CO’s discretionary attention against three other preference programs. At the VA, the SDVOSB is the first door the CO is required to open.

What did Kingdomware actually decide, and why does it matter?

It turned the word “shall” from an aspiration into an enforceable command.

In Kingdomware Technologies, Inc. v. United States, 579 U.S. 162 (2016), decided unanimously on June 16, 2016 in an opinion by Justice Thomas, the VA had argued that § 8127(d)‘s Rule of Two was essentially a goal-setting tool — that once the VA met its annual SDVOSB targets, it could buy through the Federal Supply Schedule without applying the rule. The Court rejected that flatly: the statute is “mandatory, not discretionary,” it requires the VA to apply the Rule of Two to all contracting determinations, and it applies even to orders placed under the Federal Supply Schedule.

Before Kingdomware, the VA’s veteran preference was effectively optional in practice — the agency could route work through the Schedule and treat the rule as a target. After Kingdomware, every VA acquisition above the micro-purchase threshold must clear a Rule-of-Two determination, and a passed-over SDVOSB has an enforceable cause of action at GAO and the Court of Federal Claims. Later decisions sharpened the edges: Spur Design (GAO 2016) confirmed the rule reaches task orders on multiple-award IDIQs, and Richard Group LLC (GAO 2025) held that SDVOSB status must be maintained at both offer and award for VA procurements — a procedural trap for a firm whose certification lapses mid-procurement.

How does the VA Rule of Two actually work?

Step by step, here’s the sequence a contracting officer follows.

First, the CO identifies the requirement and its NAICS code — for AI consulting, typically 541512 (Computer Systems Design Services), 541511 (Custom Computer Programming), or 541519 (Other Computer Related Services). Then the CO conducts market research sufficient to form a “reasonable expectation”: searches of SAM.gov, the SBA Dynamic Small Business Search and VetCert database, capability statements, and responses to a posted sources-sought notice or RFI. If that research shows two or more verified, capable SDVOSBs will likely bid at a fair and reasonable price, the CO must set the acquisition aside for SDVOSBs. If the SDVOSB test fails, the CO runs the same test for VOSBs next. Only if both fail does the CO drop to other small-business set-asides — still ahead of full-and-open competition.

Two mechanics are worth knowing. The VA permits tiered (cascading) set-asides — a single solicitation with SDVOSB as tier one and VOSB as tier two, evaluated in sequence to avoid re-solicitation delay. And the “fair and reasonable price” prong is a genuine check: if the SDVOSB prices that come in aren’t fair and reasonable, the CO can convert to a broader set-aside. The Rule of Two is a duty, not a blank check.

How does this apply to task orders on T4NG2 and SPRUCE?

This is the link between the statute and the vehicles. Under Spur Design and the VA’s own implementing guidance, the Rule of Two applies at the task-order level on multiple-award IDIQs — not just when the vehicle is first awarded. That’s why the VA’s purpose-built SDVOSB IT vehicles are structured the way they are: T4NG2, the ~$60.7B IT services IDIQ whose 33 primes were finalized when the Court of Federal Claims denied the last protests in March 2026, and SPRUCE, the $2.4B, 100%-SDVOSB digital-services IDIQ, both run their task-order competitions as SDVOSB-only. Recent SPRUCE task orders show the AI demand directly — an AI-enabled VA.gov chatbot support task (~$15M) and a disability-application modernization task (~$43M), each competed among a handful of SDVOSB bidders.

What is VetCert, and why is it the gate?

VetCert is the SBA’s certification program — and without it, none of the Veterans First paths exist.

Certification authority moved from the VA’s Center for Verification and Evaluation to the SBA on January 1, 2023, under the FY2021 NDAA, consolidating veteran certification under one agency. More consequentially, SDVOSB self-certification ended on December 22, 2024 under the FY2024 NDAA: a firm that hadn’t applied to VetCert by that date can no longer be counted toward any agency’s SDVOSB goal or any prime’s SDVOSB subcontracting credit. VetCert verifies veteran status, the service-connected disability rating, at least 51% unconditional veteran ownership, veteran control, and small-business size under the applicable NAICS standard. A contracting officer confirms status through the SBA’s certification database; the legacy VA VIP system has been sunset.

The program had a rough 2024 — processing times spiked to a reported 81-day peak — but the SBA announced in November 2025 that it had cleared the backlog and cut average processing to about 12 days. For an AI vendor, the implication is absolute: an uncertified firm can’t win a Veterans First set-aside or sole-source, and can’t even count as a “similarly situated” SDVOSB subcontractor that helps a prime meet its limitations-on-subcontracting math. VetCert status is the price of entry.

How much does the VA actually award to SDVOSBs?

Enough to make this a mainstream channel, not a niche one.

In FY2024 the VA awarded roughly $10.2 billion — 23.63% of its prime contract dollars — to more than 2,300 SDVOSB firms, earning an “A” on the SBA’s procurement scorecard. Governmentwide, SDVOSB achievement reached 5.14% / $32.8B, clearing for the first time the 5% statutory goal that the FY2024 NDAA had raised from 3%. The VA’s share is roughly 4.6 times the governmentwide rate — the largest agency-versus-government gap of any socioeconomic preference, and the clearest possible signal of where an SDVOSB’s federal business development time is best spent.

Is the program stable in 2026, given all the procurement changes?

Yes — it’s arguably the most durable small-business preference in the federal government.

The September 26, 2025 “Revolutionary FAR Overhaul” rewrote FAR Part 19, and it preserved the small-business Rule of Two above the simplified acquisition threshold while making it discretionary for task orders on non-VA governmentwide vehicles. But that rewrite is a deviation against the FAR — and it cannot override 38 U.S.C. §§ 8127–8128. The VA’s Veterans First hierarchy and the VA Rule of Two are statutory, grounded in Title 38 and affirmed by the Supreme Court, so they sit outside the reach of a FAR amendment. Broader proposals to consolidate socioeconomic preferences circulate in every Congress, but veteran-owned categories are insulated for the same reason: they live in statute, not in the Small Business Act or the FAR. As of mid-2026, the program is stable and growing.

One threshold note: the October 1, 2025 inflation adjustment raised the governmentwide SDVOSB sole-source ceilings, but the VA’s own §8127(c) sole-source authority remains the statutory $5 million for services, because the inflation-adjustment mechanism applies to regulatory thresholds, not statutory caps.

How does a verified SDVOSB AI shop convert this into work?

Four paths, in rough order of speed.

The fastest is a direct sole-source award. Below the simplified acquisition threshold, a VA CO has broad discretion to sole-source to a verified SDVOSB — a 90-day fixed-scope AI pilot is squarely in that lane. Above the threshold and up to $5 million for services, the CO can still sole-source with a justification under VAAR 819.7008. Second, a sources-sought response that shapes the set-aside: monitor SAM.gov for VA RFIs in the AI NAICS codes and respond fast, because a responsive, VetCert-backed capability statement is the documentation the CO uses to justify a Rule-of-Two set-aside — two responsive SDVOSBs trigger the mandatory set-aside. Third, the “similarly situated” subcontractor path: under FAR 52.219-14 and 13 CFR 125.6, a verified SDVOSB sub’s work counts toward a prime’s 50% self-performance floor on an SDVOSB-set-aside order, which is the high-leverage entry point onto T4NG2 and SPRUCE teams — detailed in the teaming guide. Fourth, task-order capture on those existing SDVOSB IDIQs as a sub or JV partner.

The honest compliance note threads through all four: VetCert SDVOSB status is the gate, and the security posture that matters at the VA is FedRAMP and the VA Handbook 6500 series — not CMMC. CMMC is a DoD-only framework; conflating it with VA requirements is a credibility error a contracting officer notices immediately. The correct posture for VA AI work is FedRAMP-aware, building to FedRAMP Moderate or High baselines and VA’s security controls — the framing laid out in FedRAMP-aware, not CMMC-certified.

Working with Truvisory

Truvisory is an SBA-verified SDVOSB founded by a combat veteran, building working AI and automation on a Cloudflare-native, FedRAMP-aware architecture — fixed-scope, in 90 days.

If you’re a VA contracting officer or small-business specialist who needs a VetCert SDVOSB AI vendor to anchor a Rule-of-Two set-aside or a sole-source under $5M — or a T4NG2/SPRUCE prime who needs a similarly-situated SDVOSB sub to satisfy the math — start with a scoping call. For the full VA picture, see the VA AI modernization pillar; for the vehicles this program feeds, see the T4NG2 and SPRUCE guides.