Frequently asked.

Yes — OCEANS is actively registered in SAM.gov. CAGE and UEI are on our current capabilities statement, which we share on request to keep them out of public scraping. Use the contact form and we'll send it within two business days.

Primary: 541330 (Engineering Services). Secondary: 541715 (R&D in the Physical, Engineering, and Life Sciences) and 541512 (Computer Systems Design). Most program offices write to one of these — if yours uses a different code, tell us and we'll confirm fit.

We perform as direct support subcontractors through teaming agreements on GSA MAS, OASIS+, SeaPort-NxG, and similar IDIQs. OCEANS complies with all DCAA Accounting Standards for auditing purposes. For specific vehicle access, ask — we'll tell you straight what we hold and what we can reach through teaming.

OCEANS is a Service-Disabled Veteran-Owned Small Business (SDVOSB), small under the SBA size standard for NAICS 541330. We pursue SDVOSB and small-business set-aside opportunities where they're a fit; we won't go after work we can't deliver well, regardless of socioeconomic category.

Most engagements run 36+ months. We also do shorter surge engagements (~90 days) when a program needs targeted help with a specific decision or deliverable. Use the Scope an Engagement tool to see what a typical project of your shape would look like.

Our principals hold active clearances appropriate to the federal customers we support; specific levels are shared under standard need-to-know with program security officers. For unclassified work we operate at the controlled-unclassified-information (CUI) level by default.

We follow NIST SP 800-171 controls for any CUI we touch. Our IT environment is built around that baseline rather than retrofitted to it — encrypted devices, MFA, conditional access, audit logging, and we don't process customer data on consumer cloud services.

We track CMMC requirements and align our control implementations to Level 2 expectations for the work we do. We can map our controls to your program's specific CMMC posture during scoping.

No. OCEANS is wholly US-owned with no foreign control or financial dependencies. We've completed the standard FOCI mitigation questionnaires for engagements that required them.

A 30-minute call. We confirm the scope, run a sanity check on the assumptions, and tell you honestly whether we're the right fit. If we're not, we'll say so and (usually) point you at someone who is. If we are, we send a one-page success agreement before any contracting paperwork moves.

Yes — for any pre-contract discussion of sensitive program details. We have a standard NDA we can send, or we'll sign yours after counsel review. Either way, fast.

All three. Most engagements have a mix — periodic on-site for stakeholder alignment, design reviews, and operational test events; remote for analysis and documentation. We deliver from anywhere we have safe network access and the appropriate authorization for the data involved.

Standard rates by labor category, published to customers under our contract vehicles. We don't do hourly-billing surprises — engagements are scoped to a not-to-exceed ceiling with a clear breakdown of phases. Specifics shared after a scoping call.

Yes — for scopes where the deliverable is well-defined upfront (e.g., a specific assessment report, a CONOPS, a defined architecture package). For T&E and exploratory work where the scope evolves with discovery, time-and-materials with a ceiling protects both sides better.

We tell you. Then we either team with a partner who has them, or recommend you go to someone else for that part. OCEANS is deliberately narrow — systems engineering, T&E, mission data, requirements. We don't pretend to be a one-stop shop.

Yes for engagements where the primary work falls within our practice areas, with subcontracted teaming for adjacencies. For broader scopes we usually team under a larger prime so the core work isn't diluted.

We don't pretend to fix a re-baseline overnight. The first 30 days are usually stop-gap controls + a root-cause read, then 60 days on a recovery plan with restructured milestones. The Scope an Engagement tool walks through this pattern under 'Re-baseline.'

The case studies on /experience are public-sanitized. Full read-outs — methodology details, quantitative findings, lessons learned — are available upon request consistent with applicable disclosure restrictions. Use the contact form.

Jacksonville, Florida. We deliver to customers across the US and FVEY allies.

Two business days for substantive replies. Same-day acknowledgment if you flag something urgent.

Yes — FVEY (UK, Canada, Australia, New Zealand) and selected allied partners. International engagements run under the appropriate authorizations and disclosure frameworks for the data involved.