A federal cyber rule could lock small Alaska firms out of survey work

A new federal cybersecurity rule could shut small and rural Alaska firms out of up to $9.5 million in government survey work — a quiet barrier buried in an otherwise routine contracting notice.

The U.S. Army Corps of Engineers is looking to hire three firms for five years of survey and mapping work across Alaska — topographic, hydrographic, LiDAR, boundary, and GPS surveys, in task orders from $10,000 to $300,000. On its face it's the kind of steady public work Alaska survey companies compete for regularly.

The catch is a requirement that has nothing to do with surveying. Every firm bidding must have a federal cybersecurity score on file and achieve a certification called CMMC Level 2 before it can win an award. Any firm without that score is automatically disqualified. The rule reflects a broader Defense Department push to tighten cybersecurity across its contractors — but as the U.S. Small Business Administration's own advocacy office has noted, these standards can fall hardest on small and rural businesses, which often lack the staff and money to meet them. In a state where survey firms are frequently small, family-run outfits, that's a real threshold: the work is open to companies of any size, but only if they've cleared a federal cyber bar first.

The Corps says it still wants small firms in the mix, setting participation goals including 10% small business and targets for disadvantaged, HUBZone, woman-owned, and veteran-owned firms. Whether small Alaska companies can actually meet the cybersecurity requirement to reach those goals is the open question.

This is a pre-solicitation for qualifications, not yet a request for bids — no projects are authorized and no work is guaranteed. Awards are expected in late 2026 or early 2027. Firms should note the notice lists conflicting submission deadlines, July 31 and Aug. 1, and watch the federal solicitation system for a correction.