Short Answer
New SEWP VI contract holders need to complete NASA's onboarding checklist, submit a Cybersecurity Supply Chain Risk Management (C-SCRM) plan within 60 days of award, load their catalog, publish a website and ordering guide, and name a trained program manager. All of it needs to be in place before agencies start submitting SEWP VI requests for quotes on November 1, 2026.
Winning a SEWP VI contract is the start, not the finish. Before you can quote your first order, NASA requires a series of onboarding steps, plans and setup tasks, several on firm deadlines. With agencies able to submit SEWP VI requests for quotes starting November 1, 2026, the window is short.
We're working with SEWP VI contract holders across categories through onboarding right now. Here's what the process involves.
Start with NASA's onboarding materials
NASA's SEWP VI website hosts the core onboarding materials:
- Post-award orientation (July 2026)
- Deep-dive training sessions (August 10 to 14, 2026), with recordings
- Contract Holder User Manual, the governing guide for day-to-day operations
- Onboarding checklist
- C-SCRM attestation form
- Official labor category list
- Technology refresh template for loading your catalog
- Example website and example ordering guide
If no one on your team attended the orientation or training, start with the recordings and the user manual. They answer most of the questions contract holders ask.
The C-SCRM plan
The Cybersecurity Supply Chain Risk Management (C-SCRM) plan is one of the most important onboarding deliverables. It's due within 60 calendar days of award and must be updated annually.
The plan must align with NIST SP 800-161 and address supply chain risks such as:
- Malicious code and tampering
- Insider threats
- Third-party and supplier risks
- Counterfeit components
- Gaps in security controls
It also has to fit how your company actually operates. A reseller's supply chain risks look very different from a services company's. A value-added reseller in Category A needs to focus on authorized sourcing, counterfeit prevention and prohibited products, such as the Section 889 telecommunications restrictions. A Category C services company focuses more on its own systems, personnel and subcontractors.
Beyond the plan, contract holders must report C-SCRM incidents to the SEWP program office within 72 hours and submit a corrective action plan within 30 days.
Your catalog
On SEWP, you can only quote what's on your contract. Every product, service and labor category has to be loaded before an agency can buy it.
- Products are added through technology refresh uploads, using NASA's template.
- Labor categories for services draw on SEWP's official labor category list.
- Items must fall within SEWP's in-scope product and service codes.
- Manufacturer relationships are recorded as authorized or subset reseller relationships and must be kept accurate. False information can result in a performance strike.
A complete, accurate catalog is also how agencies find you. Storefronts and search results are built from catalog data, so gaps limit what you can win.
Website, ordering guide and people
Contract holders must also:
- Publish a SEWP VI website within a month of award. NASA provides an example.
- Publish an ordering guide before your first order, and update it within 10 business days of any contract change.
- Name a program manager dedicated to your contract, plus a deputy, and have the program manager trained within six months.
- Use named individual email addresses on your company's domain for SEWP contacts. Aliases aren't allowed.
- Meet Section 508 accessibility requirements.
Ongoing requirements
Once you're live, SEWP runs on tight operational standards:
- Order handling: mark orders received within one business day, report status changes within two business days, and don't begin fulfilling an order until SEWP assigns its control number.
- Payment: accept electronic funds transfer and government purchase cards for any order size.
- Fees: remit the administrative fee, up to 0.34%, quarterly, with a fees-collected report.
- Annual reporting: by October 30 each year, a subcontracting report for large businesses, or a limitations on subcontracting certification for small businesses.
- Quoting discipline: all quotes and questions go through SEWP's tools. Quotes outside the tools aren't tolerated.
Where contract holders fall behind
The most common problems we see:
- No one attended the training, so the team is working from assumptions instead of the user manual
- The C-SCRM plan is started late, leaving little time before the 60-day deadline
- The catalog is incomplete, so the company can't quote on requirements it could otherwise win
- Labor categories built from scratch instead of from SEWP's official list
- The website and ordering guide aren't ready when agencies start looking
Where to go from here
The contract holders who get fully set up before November 1 will be quoting on day one while others are still onboarding. If you've won SEWP VI and need help with the C-SCRM plan, your catalog, labor categories or the website and ordering guide, we can help you get there on time. See What Is SEWP VI? for an overview of the contract.
Frequently Asked Questions
When is the SEWP VI C-SCRM plan due?
Within 60 calendar days of contract award, then updated annually. It must align with NIST SP 800-161 and address risks such as malicious code, insider threats, third-party risks and counterfeit components.
Can I quote products that aren't on my SEWP VI catalog?
No. Every item has to be on contract before it can be quoted. Products are added through technology refresh uploads, which is why catalog setup during onboarding is critical.
Do I need a website for SEWP VI?
Yes. Contract holders must publish a SEWP VI website and an ordering guide, and keep the ordering guide updated within 10 business days of any contract change. NASA published examples of both.
What happens if there's a supply chain security incident?
C-SCRM incidents must be reported to the SEWP program office within 72 hours, followed by a corrective action plan within 30 days.
Is there training for new contract holders?
Yes. NASA held a post-award orientation and a week of deep-dive training sessions in August 2026. Recordings and materials are posted on the SEWP VI website for contract holders who missed them.
Written by Kurt Karslioglu, Director of Sales
Kurt leads business development at Pera Inc. and guides small businesses through GSA MAS offers, OASIS+ submissions, and federal construction and defense proposals.
Related Guides
What Is NASA SEWP VI? A Guide for IT Contractors
NASA SEWP VI explained: the three categories, who won, how agencies order, the 0.34% fee, the move from SEWP V, and GSA's planned takeover.
Contract VehiclesWhat Is a GWAC? Government-Wide Acquisition Contracts Explained
What a GWAC is, how it differs from IDIQs, MACs and the GSA Schedule, which GWACs are active in 2026, and why OASIS+ isn't technically one.
Winning ProposalsHow to Build a Proposal Compliance Matrix
What a proposal compliance matrix is, how Sections L, M and the statement of work fit together, and the compliance mistakes that eliminate proposals.