How can small businesses bid or subcontract on the Navy’s new PAEs for aviation, mission systems, and munitions? 2026

According to GSA guidelines, contractors must be fully registered in SAM.gov and maintain active, current representations and certifications to appear on Navy opportunity lists; this paragraph explains immediate actions for small businesses to be visible to the new PAE offices. The Navy’s March–May 2026 reorganization created portfolio acquisition executives for aviation, mission systems, and munitions to centralize requirements, accelerate sourcing, and reduce acquisition stovepipes, according to the Department of the Navy press release. The reorganization affects prime contractors, subcontractors, and small businesses seeking set‑aside awards or subcontract packages on IDIQs and spot buys. The SBA remains the certifier for 8(a), HUBZone, WOSB, and SDVOSB status, so small firms must ensure their SBA profiles are current and their SAM entity is linked to those SBA certifications. Under OMB M-25-21, agencies will prefer cloud services with FedRAMP authorization for hosted capabilities, so small software firms should validate FedRAMP readiness quickly. DoD's CMMC framework requires cybersecurity maturity appropriate to contract CUI handling; ask primes which CMMC level applies for a PAE task order and budget accordingly.

Per FAR 19.502, small businesses can receive awards through set‑asides, partial set‑asides, and subcontracting plans under prime contracts, and this paragraph details how those FAR mechanisms operate within the PAE structure. The Navy will allocate portfolio tasking and issue solicitations from centralized PAE offices; small firms should monitor the Navy contracting portals and contract award notices. The SBA reports that 78% of federal subcontracting opportunities for specialty manufacturing and software are sourced through primes; therefore, building prime relationships is essential to access PAE pipeline work. According to GSA guidelines, teams should prepare capability statements and past performance narratives tailored to aviation, mission systems, or munitions portfolios, emphasizing production scaling and quality control. Under OMB M-25-21, agencies will require clear cloud and data protection plans when proposals include hosted analytics or AI; include FedRAMP status or a migration plan. DoD's CMMC framework requires specific cyber controls when proposals involve Controlled Unclassified Information (CUI), so plan security investments early.

According to GSA guidelines, firms must prepare three immediate deliverables to compete under the PAE model: a concise capabilities statement aligned to aviation, mission systems, or munitions; a current, active SAM.gov registration tied to SBA certifications; and a cyber posture plan addressing CMMC and FedRAMP expectations. This paragraph outlines required documentation and typical timelines: SAM.gov registration takes 12–21 days for a clean submission but allow 30 days to resolve entity validation issues; SBA certification updates can take 30–60 days depending on supporting evidence. DoD's CMMC framework requires firms to identify the assessment level in proposals when CUI is involved; many PAE task orders will require CMMC Level 2 or higher for suppliers handling program test data. Per FAR 52.212‑1 and FAR subcontracting plan clauses, primes must subcontract to small businesses when required; develop a subcontracting pitch that maps your capability to prime risk reduction and schedule acceleration. Under OMB M-25-21, any cloud component must be FedRAMP authorized or include a credible FedRAMP pathway; include that timeline in proposals.

The SBA reports that 78% of small business wins in defense-related procurement involve teaming or subcontracting onto prime IDIQs, so relationship building is an essential tactical step. This paragraph details outreach tactics and metrics: identify five primes per portfolio (aviation, mission systems, munitions), secure introductory meetings within 30 days, submit capability packages to prime capture leads within 45 days, and agree on teaming terms within 90 days. Per FAR 19.702, primes may use partial set‑asides or direct subcontracting to satisfy small business goals; quantify how your work helps primes meet subcontracting plan percentages. According to GSA guidelines, include a one‑page risk‑reduction plan showing how you shorten prime schedule risk by X weeks and reduce cost by Y% based on past performance. DoD's CMMC framework requires documented POA&Ms if immediate compliance gaps exist; present a funded remediation schedule with dollar amounts and milestones in teaming agreements.

Per FAR 19.502 and related FAR parts, small businesses must track solicitation set‑aside language, comply with FAR flow‑downs, and ensure subcontracting plans if serving as a large‑business prime. This paragraph focuses on implementation steps for compliance: create a template subcontract flow‑down matrix for CMMC, quality standards, and delivery milestones that primes can incorporate immediately; primes expect this during capture. Under OMB M-25-21, agencies will require cloud security and data governance plans, so include FedRAMP timing and costs in proposals. According to GSA guidelines, include a concise risk register tied to past performance examples that quantify schedule and cost reductions (e.g., reduced lead time by 30% or saved $200K). The SBA reports that 78% of small business awards are through prime-team arrangements; when negotiating teaming agreements provide guaranteed capacity numbers, lead times, and acceptance criteria. DoD's CMMC framework requires documented controls and often independent assessment — budget for that separately and describe remediation timelines in months and dollars.

According to GSA guidelines, primes and subcontractors should set clear acceptance metrics for test articles and production lots, especially in munitions where quality gates are nonnegotiable; provide sampling plans with defect rate thresholds (for example, <0.5% failure) and lead‑time guarantees in the teaming agreement. Per FAR 52.204‑21 and FAR 52.212‑5, include cybersecurity representations and incident reporting commitments in proposals. The Navy’s PAE offices will issue rolling task orders; expect accelerated source selection timelines of 30–90 days, according to the Department of the Navy. DoD's CMMC framework requires a continuous monitoring posture for systems handling CUI; include a funded Plan of Action with Milestones (POA&M) specifying dollar and time commitments. Under OMB M-25-21, plan to demonstrate FedRAMP boundary and authorization progress for hosted components within 120 days if not already authorized.