DLH Holdings wins NIH cyber order worth up to US$19.1M
The three-year ceiling includes options; DLH did not disclose the funded base period or update its US$408.5M June 30 backlog.
Julian Okafor
A federal cybersecurity order lands as its contractor tries to replace sales lost when older government work moved elsewhere. DLH Holdings Corp. NASDAQDLHC, an Atlanta provider of digital, engineering and scientific services to U.S. health and defence agencies, disclosed the award on Sept. 28. The National Institutes of Health order covers cybersecurity operations at its Center for Information Technology and has a ceiling of US$19.1 million, DLH said.
DLH shares traded at US$3.49 on Nasdaq at 10:06 a.m. EDT on Sept. 28, according to the NASDAQDLHC quote. The NASDAQDLHC quote at 10:06 a.m. EDT Sept. 28 showed a 1.69 per cent decline.
The Sept. 28 US$19.1 million award is a potential value covering a base period and multiple options across three years, according to DLH. The company did not give the base period's dollar value, the amount initially funded or a revenue schedule. The full ceiling therefore cannot be treated as money already earned or as the value of the funded initial term.
At June 30, 2026, DLH's backlog stood at US$408.5 million, according to its July 29 quarterly results. It had been US$514.3 million on Sept. 30, 2025. Revenue fell to US$44.2 million in the June quarter from US$83.3 million a year earlier, which the company attributed chiefly to legacy programs moving to small-business set-aside contractors. The Sept. 28 announcement did not update backlog; the next dated accounting cut-off is its Sept. 30 fiscal year-end.
The New Work Spans NIH Cyber Operations
The NIH Center for Information Technology supplies infrastructure for the agency's research community. DLH's order covers security assessment and authorization, vulnerability management and incident response. It also covers cloud security, architecture, privacy, compliance, training and program management, but the release assigns no price to any individual service.
DLH says the work will support federal cybersecurity requirements and NIH priorities around zero trust, cloud modernization, automation and responsible use of artificial intelligence. Its Sept. 28 announcement does not give a starting level for cyber incidents, authorization times or operating costs against which those intended benefits could later be measured. Nor does it specify when the first service will begin.
"This award expands DLH's support for NIH as the organization strengthens resilience, reduces operational risk, and maintains mission continuity in an evolving cyber landscape," DLH president and chief executive Kathryn JohnBull said in the Sept. 28 release.
DLH said it formed a delivery team with other technology services providers, but it did not name them or disclose their shares of the work. That omission also limits what a holder can infer about the revenue and margin DLH itself could earn from the maximum over three years. The release identifies the order as new work, separate from its existing NIH support.
Backlog Had Fallen Before the Award
DLH's July 29 results put its June-quarter adjusted EBITDA at US$3.4 million, down from US$8.1 million a year earlier. The company reported a US$16.8 million net loss for the quarter, compared with US$0.3 million in profit a year earlier. The loss included a US$10.4 million valuation allowance against deferred tax assets.
Debt stood at US$128.7 million on June 30, down from US$132.7 million at the end of the previous quarter, according to that same report. JohnBull said in July that DLH expected fourth-quarter revenue to come entirely from technology-powered solutions after legacy programs ended. The new order fits that stated business mix, though its release does not say what DLH can bill before the Sept. 30 quarter closes.
A separate Sept. 16 company announcement described an NIH National Heart, Lung, and Blood Institute IT-services follow-on award valued at up to US$43.7 million. Its headline value, like the new cyber order's, is a ceiling. Neither announcement reports a new consolidated backlog balance, so they cannot simply be added to DLH's June 30 figure.
A Previous NIH Order Also Carried Options
DLH announced on Aug. 14, 2025 a separate NIH Office of Information Technology order worth up to US$46.9 million. Its base period and options spanned three years, and the work covered enterprise IT management, cybersecurity, software development and cloud computing for about 7,000 end users. The new Center for Information Technology task order covers cyber risk management and operations; the releases do not say that one replaces the other.
Telos Corporation NASDAQTLS, an Ashburn, Virginia, cyber risk and identity-software provider, announced a separate US$13.7 million HHS task order on Sept. 28 for its Xacta tools and services over 18 months. The HHS cyber order covered earlier by Mugglehead involves a different federal office and a specified term, illustrating why an award ceiling and the period over which it may be earned have to travel together.
Read more: Telos Corporation wins US$13.7M HHS cyber risk management task order (Sept. 28)
DLH's fiscal year ends Sept. 30, two days after it announced the NIH order. Its subsequent results will be the first reported backlog and revenue checkpoint after the award, against June 30's US$408.5 million backlog and US$44.2 million quarterly sales. The company has not disclosed when the initial cyber work begins or how much of its ceiling is funded.
