Telos wins Xacta GRC contract with Commerce Department OIG
Telos Corporation (NASDAQ: TLS) has secured a 12-month contract with the U.S. Department of Commerce Office of Inspector General (OIG) to deploy its Xacta cyber governance, risk and compliance (GRC) platform. The deal covers three components of the Xacta suite and includes implementation, integration, configuration and training services from Telos.
The contract is notable for relying on the FedRAMP Class D (High) authorisation that Telos holds for Xacta, a certification tier required for handling the most sensitive unclassified federal data. FedRAMP High is among the more demanding accreditations in the federal procurement landscape, and relatively few commercial SaaS GRC tools carry it.
What Xacta will do for Commerce OIG
Under the agreement, the OIG will use three distinct modules. Xacta 360 will manage the NIST Risk Management Framework lifecycle, covering control implementation, assessment workflows and the authorisation-to-operate (ATO) documentation chain. Xacta.io will aggregate security data to support continuous monitoring and remediation tracking, moving the agency toward the persistent, near-real-time posture visibility demanded by recent Office of Management and Budget guidance on FISMA modernisation. Xacta.ai will assist security staff with control-narrative drafting, evidence analysis and documentation review, applying AI assistance to the labour-intensive prose elements of compliance work.
John B. Wood, chairman and chief executive of Telos, said the platform "combines decades of federal risk management experience with practical AI assistance in a secure SaaS environment," positioning it as a tool for managing ongoing risk rather than simply producing point-in-time compliance documents.
A building federal pipeline
The Commerce OIG award follows a run of similar Xacta wins that Telos has announced in recent months, including contracts with the Department of Health and Human Services, the National Archives and Records Administration, the Office of Naval Intelligence and the Air Force Intelligence Community. Taken together, the wins span civilian, defence and intelligence customers, suggesting the platform has achieved meaningful cross-agency traction rather than being concentrated in a single department.
Federal GRC software is a competitive but relatively enclosed market, shaped by the FedRAMP authorisation barrier. ServiceNow, IBM OpenPages and Archer GRC (a Resonant product) each hold federal customer bases, but the combination of a FedRAMP High SaaS authorisation and deep NIST RMF workflow integration narrows the competitive field for agencies with strict data-handling requirements. Smaller specialist vendors such as Steampunk and Appian also pursue ATO-workflow automation, though typically without a single integrated AI-assisted narrative layer at this stage.
Regulatory tailwinds
The timing is favourable for Telos. The White House's 2024 OMB Memorandum M-24-04 pushed agencies to move from manual, annual FISMA reporting toward automated, continuous monitoring. Xacta.io's continuous-monitoring functionality is directly aligned with that mandate, and the addition of Xacta.ai addresses a persistent capacity constraint: federal security teams routinely cite documentation burden as a bottleneck in scaling GRC programmes.
Contract value for the Commerce OIG award was not disclosed. Investors watching Telos will be looking for aggregate annual recurring revenue from the federal GRC book and evidence that the multi-agency pipeline translates into multi-year renewals, not just initial 12-month awards.