DHS Carahsoft BPA: $2.7B Sole-Source Estimate Rests on the Distributor, Not the Software

What the DHS Carahsoft BPA covers and why DHS called it a sole source

The DHS Carahsoft BPA is a five-year, single-award blanket purchase agreement (BPA). It lets DHS components buy commercial software, subscriptions, maintenance and limited services from a list of 76 vendor entries. Orders run through Carahsoft’s GSA schedule contract. DHS puts the estimated value at $2,657,393,210 across five ordering periods, about $2.7 billion, not obligated spend. DHS justified the single award as a sole source. Its stated reason is that Carahsoft is the only authorized distributor for the vendors on the list.

If you run BD for a mid-market software maker, a new entrant or a small business reseller, the stake is new-business capture and channel position. Components can now order from one enterprise acquisition vehicle under common terms. DHS can add vendors during the term, but only under a test that favors products Carahsoft alone holds on schedule.

Is the sole source the software or the distributor?

The sole source is the distributor. DHS cites the schedule-ordering exception for cases where “the products, services, or solutions are unique or highly specialized.” The rationale it then gives in section 4 names no product feature. It calls Carahsoft the “sole authorized distributor/master aggregator” for the listed vendors. It adds that their products “are only directly available through Carahsoft.” DHS concludes that no other vendor can supply them without buying through Carahsoft.

That distinction changes what the label tells other sellers. A sole source built on a unique product says the product has no substitute. This one says the vendor list was drawn around one channel.

The legal route matches. DHS relies on the Revolutionary FAR Overhaul version of FAR 8.401(b) and FAR Class Deviation 25-20 for Part 8. Most contractors hear “sole source” and picture a Part 6 justification and approval. This one is a schedule-ordering justification under Part 8 rules.

• Schedule pricing as the price check: DHS relies on GSA’s existing fair-and-reasonable determination, plus minimum BPA discounts that vary by vendor.
• Order-level work remains: hybrid or non-fixed-price orders “must be justified at the order level,” and DHS says all brand-name requirements will be justified there too.
• Decentralized ordering: components place their own orders under common BPA terms and discount structures.

Did DHS tailor the requirement to fit Carahsoft?

DHS says so itself. The justification states that “the Government has tailored the original requirement to only include OEMs that are solely distributed by Carahsoft.” Original equipment manufacturers (OEMs) are the software makers. DHS set the competition bar by choosing which makers to include.

The same logic governs growth. DHS says the portfolio “includes (but is not limited to)” the 76 entries. They run from Akamai and Atlassian to ServiceNow, Splunk, Okta and Wiz. DHS reserves the right to add vendors “if Carahsoft is the exclusive GSA MAS holder for the relevant software products and services.” A product sold through several schedule holders fails that test as written. A product only Carahsoft holds on schedule passes it.

I treat the roster as self-limiting by design. The vehicle can absorb every maker that already depends on Carahsoft. It has no mechanism for a product that other schedule holders also carry. A maker with several schedule resellers would have to consolidate that schedule channel to qualify.

How much of the $2.7 billion is new money for Carahsoft?

Less than the estimate implies, though the reading needs care. DHS’s Office of the Chief Information Officer ran market research from December 2025 to April 2026. It found Carahsoft “consistently served as the primary distributor for most software licenses acquired by DHS.” That describes the distribution channel. It does not say who held the prime order.

Three terms define the vehicle’s economics:

• Estimated value, not obligated spend: DHS lists a price for each of five ordering periods and obligates nothing at the BPA level. The justification does not say whether the BPA carries a ceiling.
• Component requirements: DHS collected 16 months of them, and they remain requirements until orders are placed.
• Order-level pricing: order-level contracting officers seek additional discounts as appropriate.

The ordering-period table builds in growth of about 53 percent from the first period to the fifth. DHS does not explain the increase. More component purchases moving into the vehicle, vendor additions and subscription price growth would each produce it. Orders will carry the money as components place them.

What a single-award BPA changes is the prime position. Take a reseller that held a DHS order on a covered vendor’s product while buying from Carahsoft. If that order moves to the BPA at renewal, the reseller would lose the prime role. Carahsoft’s distribution volume would stay the same. Those resellers are the exposed group, and DHS does not size it.

Who competes with Carahsoft for DHS software orders?

DHS names no competitor, so I describe the field by category. DHS states that makers on the list “do not sell these products directly to the government.” It also says Carahsoft is the exclusive GSA schedule holder for them. Four groups sit around that premise:

• Other schedule holders and direct sellers matter for makers off the list, which still sell to DHS outside this vehicle.
• Small business resellers and value-added resellers serving individual components, who may hold orders on covered products today.
• Schedule holders that carry a listed maker’s product hold evidence that the exclusivity premise is wrong for that product, which affects whether the add-on test and the order-level brand-name justifications hold.
• Systems integrator firms that deploy and configure the software, which the BPA covers only as limited related professional services such as implementation, configuration and enablement.

DHS does not name the prior vehicles its market research reviewed. The rationale and market-research sections describe no reseller-fulfillment mechanism. That leaves open whether independent resellers can fill orders under the BPA.

What the DHS Carahsoft BPA means for makers, resellers and integrators

Each segment has a different next step:

1. Makers on the list: work with Carahsoft on your DHS discount position against the GSA minimum, and map which components renew before July 2031.
2. Makers off the list that sell through several schedule holders: the test as written excludes you. Decide whether consolidating your schedule channel to Carahsoft is worth the other schedule holders you lose, or whether to keep selling to DHS outside this vehicle.
3. Makers not yet selling to DHS: DHS says vendors can be added, but only where Carahsoft is the exclusive schedule holder for your product. Confirm your schedule channels first. Then open a conversation with DHS’s Information Technology Acquisition Center and Carahsoft together.
4. Small business resellers with DHS orders: map which of your open orders are for covered vendors, and note each renewal date. Defend any order you can name; watch the rest.
5. Systems integrators: expect services to attach to license orders rather than stand alone, and position for the implementation and enablement slice.

• List every DHS order you hold or support and mark which are for vendors on the list.
• Record each covered order’s renewal date and the component buyer who owns it.
• Find out whether your maker sells through more than one schedule holder, since that blocks addition.
• Ask Carahsoft whether it supports reseller fulfillment on DHS orders for your maker.
• Note which orders carry brand-name requirements, which DHS says it will justify at the order level.

What to do before the vendor list changes

For makers who want DHS software revenue, the posture is to team. DHS built the vehicle around Carahsoft, and the add-on test rewards makers that rely on it. Build that relationship before a component buyer’s next renewal, not after.

Resellers need a split answer. A reseller that can name a current DHS order for a covered vendor should defend it now. That is the position a single-award BPA can displace when the order renews. A reseller with no such order should watch. The signal that turns watching into defending is a covered renewal moving to the BPA.

No solicitation exists, so nothing here is a bid. The opportunity is a channel decision. Two events would raise the priority: DHS adding vendors by modification, and DHS publishing discount tables. Evidence that components keep ordering covered products through other vehicles would lower it.

FAQ

How big is the DHS Carahsoft BPA?

DHS’s ordering-period table totals $2,657,393,210 over five ordering periods, about $2.7 billion, not obligated spend. DHS says no funding is obligated at the BPA level. The real size depends on component orders.

Why did DHS call it a sole source?

DHS says Carahsoft is the sole authorized distributor and master aggregator for the vendors on the list. The justification cites the unique-or-highly-specialized exception. Its stated rationale rests on Carahsoft’s distributor role, not on any product feature.

Can another software maker be added to the BPA?

Yes, but only where Carahsoft is the exclusive schedule holder for the maker’s products. A product that other schedule holders also carry does not meet the test as DHS wrote it.

Does this lock other resellers out of DHS?

It can, for covered vendors’ orders that components move to this vehicle. DHS components may still buy other software through other vehicles. Whether independent resellers can fulfill orders under the BPA is open.

Which DHS offices decide what gets ordered?

The Office of Procurement Operations awarded the BPA. The Office of the Chief Information Officer ran the market research behind the requirement. Order-level contracting officers at each component place orders and seek extra discounts. Your account work still happens at the component.