Private Equity in Government Contracting: The M&A Diligence Playbook

Private equity in government contracting is not new, but the regulatory landscape has grown more complex in recent years. New cybersecurity certification programs, tighter telecommunications bans, and evolving small business verification rules all add layers that did not exist a decade ago. Getting any one of them wrong can delay closings, void set-aside eligibility, or trigger compliance violations that follow the portfolio company for years. Let’s work through each layer.

When one company acquires another, the government needs to know who is performing its contracts going forward. The Federal Acquisition Regulation (FAR) — the master rulebook for federal procurement — addresses this in FAR Subpart 42.12 ^[1]. The key question is whether the deal changes the legal entity that holds the contract.

In a stock purchase, the buyer acquires shares of the contractor’s parent or holding company. The contractor itself — the legal entity with the contract — remains the same. In most stock deals, no novation is required because, from the government’s perspective, it is still contracting with the same entity. In an asset purchase, however, the buyer creates or uses a different legal entity to receive the seller’s contracts, employees, and assets. That new entity is not the one the government signed a contract with, so a novation agreement under FAR 42.1204 is typically required ^[1].

A novation is a three-party agreement among the government, the original contractor (the “transferor”), and the new entity (the “transferee”). The contracting officer (CO) — the government official authorized to bind the agency — will approve it only if the transfer is “in the Government’s interest” ^[1]. Expect to provide the signed novation agreement itself, a list of every affected contract and task order, evidence of the asset transfer, and legal opinions on the successor entity’s ability to perform.

If the deal merely changes the contractor’s legal name — a common post-close rebranding move — you need a change-of-name agreement under FAR 42.1205 instead ^[1]. This is simpler but still requires CO coordination.

One area practitioners sometimes underestimate is General Services Administration (GSA) Multiple Award Schedule (MAS) contracts. GSA processes novations and name changes for Schedule contracts under GSAM Subpart 542.12 ^[14], and this runs in parallel with — not instead of — agency-level novations. Build that lead time into your integration plan. If you are evaluating whether a target’s GSA Schedule is even worth novating, GovBidLab’s free GSA Eligibility Calculator can help you assess MAS strategy before or after the transaction.

A critical practice tip: continue performing on all contracts during CO review. The government does not pause its mission because your deal is pending, and stopping work without authorization creates default risk.

For many PE transactions targeting government contractors, small business status is both the crown jewel and the most fragile asset. Understanding the Small Business Administration’s (SBA) affiliation rules is essential to knowing whether that status will survive the acquisition.

The SBA determines size based on either average annual receipts or number of employees, depending on the North American Industry Classification System (NAICS) code assigned to each contract. But the SBA does not look at the contractor in isolation. Under 13 C.F.R. 121.103 ^[6], it aggregates the receipts or employees of affiliated entities — and affiliation can be triggered by the power to control, even if that power is never exercised. This includes “negative control” rights such as veto provisions over budgets, hiring of key executives, or major contracts. These veto rights are standard in PE deal documents, and they can be enough to affiliate the portfolio company with the fund and every other company the fund controls.

If the deal results in a change of ownership, the contractor must recertify its size within 30 days under 13 C.F.R. 121.404(g)(2) ^[7]. If the recertification shows the company is now “other than small,” here is the nuance many people miss: existing set-aside contracts are not automatically voided. Under 13 C.F.R. 121.404(g)(1) ^[7], the loss of small status applies prospectively — meaning it affects new orders placed against existing contract vehicles and the exercise of future options, but work already on contract generally continues. This distinction matters enormously for deal valuation. A revenue stream from existing task orders may have a shorter remaining life than the contract’s period of performance would suggest.

Programs layered on top of basic size — 8(a) Business Development (13 C.F.R. part 124) ^[8], Women-Owned Small Business (WOSB) (13 C.F.R. part 127) ^[8], HUBZone (13 C.F.R. part 126) ^[8], and Service-Disabled Veteran-Owned Small Business (SDVOSB) (now certified under 13 C.F.R. part 128 by the SBA as of January 1, 2023) ^[9] — all impose strict ownership and control requirements. Some, like the 8(a) program, require SBA pre-approval before any ownership change ^[8]. All require prompt recertification or updates when control shifts. If your PE thesis depends on preserving HUBZone, WOSB, or SDVOSB certification, you must structure transaction rights so that the qualifying individual owner maintains day-to-day management control and long-term decision authority as defined by the relevant regulation — not just nominal equity.

To verify that NAICS codes and associated size standards are correctly aligned across every contract in the portfolio, use GovBidLab’s free NAICS Code Lookup tool. After closing, confirm that SAM.gov (the government’s System for Award Management) entity records are current using the UEI Lookup tool — the Unique Entity Identifier replaced the old DUNS number and is now the key to every registration and representation in the federal marketplace.

If the target holds classified contracts or works with sensitive defense information, national security review adds an entire parallel diligence workstream. There are three distinct regimes to understand.

The National Industrial Security Program Operating Manual (NISPOM), codified at 32 C.F.R. part 117 ^[12], requires cleared contractors to report any changes in ownership that could introduce foreign ownership, control, or influence. This is overseen by the Defense Counterintelligence and Security Agency (DCSA). PE funds commonly have foreign limited partners (LPs), and even a minority foreign LP interest can trigger FOCI concerns. Mitigation measures range from board resolutions to Special Security Agreements (SSAs) or, in more extreme cases, proxy boards that wall off foreign influence from classified operations ^[12]. Pre-brief DCSA on anticipated changes before closing — surprises in this area can freeze facility clearances and halt classified work.

Separately, certain transactions involving foreign persons may trigger jurisdiction under the Committee on Foreign Investment in the United States (CFIUS), governed by 31 C.F.R. part 800 ^[11]. CFIUS reviews transactions for national security risks and can impose conditions or, in rare cases, block deals entirely. Even if a PE fund is U.S.-domiciled, the presence of foreign LPs with certain governance rights can create a filing obligation. Voluntary notice is generally advisable when the target is in a sensitive sector; for certain critical technology or critical infrastructure transactions, mandatory declarations may apply.

For Department of Defense (DoD) contractors that handle Controlled Unclassified Information (CUI) — a broad category of sensitive but unclassified data — DFARS 252.204-7012 ^[13] has mandated compliance with NIST Special Publication 800-171 security controls and cyber incident reporting since it came into widespread use in 2017. Diligence should assess the target’s actual compliance posture, not just its self-attestation.

The Cybersecurity Maturity Model Certification (CMMC) program is being phased in by DoD to add third-party verification to these self-assessments. Map the target’s current practices to expected CMMC levels during diligence so the integration plan can budget for remediation. GovBidLab’s free CMMC Calculator can help benchmark your cybersecurity posture against DoD requirements.

One more national-security-adjacent rule that catches PE portfolios off guard: Section 889 of the FY2019 National Defense Authorization Act (NDAA) ^[3], implemented at FAR Subpart 4.21 and clauses 52.204-24, -25, and -26. It prohibits two things:

After a roll-up, Section 889 representations must be harmonized across every portfolio company. A single security camera from a covered manufacturer in one subsidiary’s lobby can create a representation problem for the entire enterprise. Survey early and remediate before closing or immediately after.

Acquiring a government contractor — especially one that transitions from “small” to “other than small” — can trigger new regulatory obligations in cost and pricing. Here are the key thresholds:

For a company that was previously small and exempt from many of these rules, crossing the size threshold means standing up new compliance infrastructure: a CAS disclosure statement, an adequate estimating system, an acceptable accounting system per DFARS 252.242-7006, and a subcontracting plan with goals and reporting. These are not optional, and agencies audit them. Factor the cost into your integration budget.

Truthful Cost or Pricing Data (TCoPD) — the obligation to disclose accurate, complete, and current cost or pricing data when negotiating contracts above $2 million ^[4] — is especially consequential. Submitting defective pricing data can result in price reductions and penalties. PE portfolio companies that previously competed primarily on a lowest-price-technically-acceptable (LPTA) basis may not have robust cost data systems; diligence should test this.

Organizational Conflicts of Interest (OCI) under FAR Subpart 9.5 ^[10] are one of the most underappreciated risks in PE roll-up strategies. An OCI arises when a contractor’s existing work gives it an unfair competitive advantage or impairs its objectivity on another contract. The three classic types are:

In a single-company context, these risks are manageable. In a multi-company portfolio where the PE fund is acquiring advisory firms, systems integrators, and test-and-evaluation contractors, OCI conflicts can proliferate rapidly and bar portfolio companies from competing on lucrative new work without an approved mitigation plan ^[10]. Build an internal “OCI map” before pursuing new business — chart every portfolio company’s contracts, roles, and access against every anticipated opportunity. This is not a theoretical exercise; COs can and do disqualify offerors for unmitigated OCIs, and competitors protest aggressively on OCI grounds.

Knowing the rules is half the battle. Executing across a portfolio of government contractors — where dozens of contracting officers, multiple agencies, and overlapping regulatory regimes intersect — requires a disciplined post-close integration plan. Here is a practical sequence:

After rebranding or restructuring, you will likely need updated marketing materials. GovBidLab’s free Capability Statement Generator can help you quickly produce professional capability statements that reflect the post-acquisition entity’s positioning and set-aside status.

These steps reduce surprises and keep growth on track — essential for any PE thesis focused on how to win government contracts at scale. The firms that treat regulatory integration as a value-creation lever, rather than a box-checking exercise, are the ones that realize the full potential of their government contracting platforms.

If you are evaluating a government contractor acquisition or managing a post-close integration, start by building a contract-by-contract regulatory map: list every active vehicle, its set-aside status, its NAICS code and size standard, whether it involves classified or CUI data, and what novation or recertification action it requires. That single document will drive your entire integration timeline and surface the issues that need attention before they become problems. GovBidLab’s free tools suite can accelerate several of those data points. Understanding these regulatory layers is not a distraction from your investment thesis — it is your investment thesis in government contracting.