Telos Corporation wins US$13.7M HHS cyber risk management task order
The 18-month HHS award covers all three Xacta modules plus integration, training and migration services.
Julian Okafor
An 18-month federal cybersecurity order gives a price to a health agency's effort to automate security approvals across its systems. Telos Corporation NASDAQTLS, an Ashburn, Virginia, provider of cyber risk, identity and secure network tools, said on Sept. 28 that the U.S. Department of Health and Human Services awarded it a US$13.7 million task order for its Xacta software and implementation services.
Telos shares traded at US$4.02 on Nasdaq at 9:39:28 a.m. EDT Monday, according to the NASDAQTLS quote. The same NASDAQTLS page at 9:39:28 a.m. EDT Monday showed a 0.50 per cent decline from the prior close.
The order runs for 18 months and covers the HHS Office of the Chief Information Officer's Office of Information Security. Telos is to deploy Xacta 360, Xacta.io and Xacta.ai, alongside integration, training, data migration and cybersecurity services. Its announcement gives neither a payment schedule nor a split between software and services, so the US$13.7 million award cannot be read as sales already recognized.
"Deploying the full Xacta suite across the HHS enterprise demonstrates the scale and breadth of what our cyber GRC platform can deliver for large, complex federal organizations," Telos chairman and chief executive John B. Wood said in the release.
HHS Order Covers Three Xacta Modules
Xacta 360 is the part Telos says will handle security authorization workflows, control assessments and compliance records for HHS. The same module is meant to support continuous monitoring, while Xacta.io will pull information from security tools into an enterprise view. These are different functions under one task order, which also funds the work of integrating them with the agency's existing processes.
Xacta.ai is the analysis layer in the HHS plan. Telos says it will use AI to reduce manual work in risk and compliance tasks and to generate insights from the information gathered by the other modules. The company did not give a measured reduction in staff time, a starting baseline or a rollout date for each module in its Sept. 28 announcement.
The contract covers an agency process known as Authority to Operate, the security approval work associated with federal information systems. HHS is buying software and services to modernize that process across its enterprise, according to Telos. The award does not say how many HHS systems will use Xacta, how many agency staff will be trained or when a first system will go live.
Xacta Has Held FedRAMP High Since July 2025
The FedRAMP marketplace entry lists Xacta SaaS as certified since July 14, 2025. It identifies the offering's current phase as ongoing certification and its profile as Revision 5, agency path, Class D (High). The listing describes Xacta 360 as the core service and Xacta.io and Xacta.ai as optional components of that certified SaaS package.
The marketplace record is a check on Telos's claim that the cloud product has a High baseline authorization. It is separate from the HHS order: the marketplace describes the software's certification, while the task order describes deployment and support for a particular agency. Neither document reports a measured improvement in HHS's approval times.
A shareholder cannot infer HHS efficiency gains from FedRAMP certification alone. FedRAMP lists the service and its assessed security profile; Telos's release describes what it expects the modules to do once integrated at HHS. The contract value is defined, but the number of systems served, the mix of software and services, and the pace of recognized revenue remain undisclosed in the announcement.
Air Force Task Order Includes Four Annual Options
Telos announced another Xacta task order on Aug. 31, this time for Air Combat Command's Directorate of Intelligence and the Air Force Intelligence Community. That US$34.3 million order includes a five-month base period and four one-year option periods. Its release gives a US$37.775 million ceiling for the underlying contract if every option is exercised.
The Air Force order focuses on Xacta.ai and its use across intelligence security boundaries. HHS, by contrast, selected the full Xacta suite and services for its information-security office. The two awards involve separate federal customers buying work around the same platform, but their headline amounts and periods do not establish the revenue Telos will record in any one quarter.
Mugglehead's Sept. 24 public-safety revenue forecast coverage provides a nearby example of a sales forecast. Telos's Sept. 28 disclosure gives the value and duration of a new task order, leaving its accounting path for later filings.
Read more: Cycurion expects US$843K in 2026 public-safety revenue
Telos posted second-quarter results on Aug. 10, before both the Air Force and HHS announcements. Its investor events calendar shows no announced date for a third-quarter earnings call. That leaves the next quarterly disclosure as the place to look for any updated guidance on when the federal work begins to enter reported sales.
The next dated accounting checkpoint is Sept. 30, the end of Telos's third quarter. With the HHS award announced on Sept. 28, that period contains only two days after the announcement; Telos has not disclosed a start date or revenue schedule for the order. A later quarterly filing will test whether management can put more timing around the US$13.7 million award.
