GovTech Lingo

GovTech Market Structure

GovTech and Civic Tech

GovTech generally means technology purchased, operated, or sponsored by government to perform public functions. Civic tech more often describes technology that enables public participation, community problem-solving, government transparency, or interaction between residents and institutions. A permitting platform sold to a county is clearly GovTech. A community-built tool for analyzing council votes is more likely civic tech.

The boundary is porous. A resident-reporting application may begin as a civic project and later become an official government service. Practitioners usually use the distinction to signal who controls the product, who funds it, and whether formal procurement, security, accessibility, and records requirements apply.

SLED and FedCiv

SLED means state, local, and education, usually including state agencies, counties, municipalities, school districts, and public higher education. FedCiv means federal civilian government, generally excluding the Department of Defense and the intelligence community. The exact segmentation varies by company, particularly for agencies with national security missions.

These are not merely sales territories. They imply different contract vehicles, buying calendars, security regimes, funding sources, and implementation patterns. A solution positioned for FedCiv may need FedRAMP authorization and federal acquisition expertise. A SLED route may depend more heavily on state term contracts, cooperative purchasing, grant calendars, and jurisdiction-specific requirements.

Mission System

A mission system directly supports a government’s statutory or operational purpose, such as determining benefit eligibility, dispatching emergency responders, collecting taxes, issuing licenses, or administering courts. It is distinct from a general back-office platform such as payroll or email.

When someone calls an application mission-critical, the practical message is that downtime, incorrect rules, or failed interfaces can interrupt public services or create legal exposure. Modernizing one is rarely treated as an ordinary software replacement because policy, operational procedure, historical data, and system logic have often become thoroughly entangled.

System of Record

A system of record is the officially recognized repository for a particular class of government records or transactions. It is the place whose contents control when multiple systems disagree. An eligibility platform might be the system of record for benefit determinations, while a separate identity service is authoritative for verified identity attributes.

Newcomers often interpret the term as meaning the system contains the best or most complete data. It may instead mean that the organization has formally designated it as controlling. A system can be authoritative for one field and merely consume another, which is why practitioners ask, “System of record for what?”

Legacy Modernization

In GovTech, legacy modernization means changing an aging mission system, its architecture, or its operating model without losing statutory logic, historical records, integrations, or continuity of service. It may involve replacement, re-platforming, incremental decomposition, interface modernization, or wrapping existing functions with newer services.

The term does not automatically mean a complete rewrite. “Modernize the legacy” may describe a careful migration of a forty-year-old rules environment that still processes payments correctly every night. The old system is often criticized until someone proposes switching it off.

COTS, GOTS, and MOTS

Commercial off-the-shelf (COTS) software is developed for a broader commercial market. Government off-the-shelf (GOTS) software is developed by or for government and may be reusable across agencies. Modified off-the-shelf (MOTS) refers to a packaged product altered for a particular implementation.

The classification affects implementation risk, data rights, upgradeability, support, and procurement strategy. A heavily modified COTS platform may retain the commercial label while behaving economically like custom software. Practitioners therefore look beyond the label and ask how much code, configuration, and policy logic diverges from the vendor’s standard release.

Government Shared Service and QSMO

A government shared service provides a common capability to multiple agencies or organizational units rather than requiring each to operate its own instance. Examples include identity, payroll, grants management, financial management, and cybersecurity services. At the U.S. federal level, a Quality Service Management Office (QSMO) helps shape standards, marketplaces, and migration approaches for designated shared-service areas.

Shared service does not necessarily mean one monolithic platform. It may involve approved providers, common standards, or a marketplace. In meetings, a shared-service proposal usually raises questions about tenant separation, funding, service authority, migration sequencing, and which agency gets to say no to a requested customization.

Public Procurement

FAR and Agency Supplements

The Federal Acquisition Regulation (FAR) is the primary rule set governing procurement by U.S. federal executive agencies. Agencies add supplements, such as the Defense Federal Acquisition Regulation Supplement, to address agency-specific authorities and requirements.

FAR language controls solicitation procedures, contract clauses, cost treatment, competition, and contract administration. State and local governments operate under their own procurement codes, even when federal grant conditions influence a purchase. Saying “the FAR requires it” in a city procurement is therefore not persuasive unless a federal term has actually been incorporated.

Sources Sought, RFI, RFP, RFQ, and IFB

These documents occur at different points and request different responses:

• Sources Sought: Market research used to identify capable providers, often with particular attention to small-business availability.
• Request for Information (RFI): Seeks market input before final requirements or acquisition strategy are settled.
• Request for Proposals (RFP): Solicits proposals for evaluation and potential contract award, commonly allowing technical and price tradeoffs.
• Request for Quotations (RFQ): Requests pricing and related information under a simplified or ordering procedure. Under the FAR, a quotation is generally not itself an offer.
• Invitation for Bids (IFB): Supports sealed bidding, with award generally based on responsiveness, responsibility, and price.

Responding to an RFI does not guarantee access to the eventual competition, but it can influence how the requirement is framed. An RFP signals that the government is asking for a binding proposal, not merely admiring the market’s slideware.

Sections L and M

In many federal RFPs, Section L contains instructions to offerors, while Section M explains the evaluation factors and basis for award. Section L tells bidders what to submit. Section M tells them how the government intends to judge it.

A technically elegant response can still fail if it ignores page limits, file structures, required volumes, or submission instructions in Section L. Likewise, devoting half the proposal to a feature that receives little evaluation weight is a Section M problem. Experienced capture teams read these sections together and build a compliance matrix before writing prose.

Best-Value Tradeoff and LPTA

Under a best-value tradeoff, the government may choose a higher-priced proposal when its technical, management, or past-performance advantages justify the premium. Under lowest price technically acceptable (LPTA), evaluators first determine whether an offer meets the stated acceptability threshold and then generally select the lowest-priced acceptable offer.

LPTA does not mean the government may disregard the specification, and best value does not mean price is irrelevant. The distinction shapes proposal strategy. In a tradeoff procurement, discriminators matter. In LPTA, exceeding requirements may simply produce a more expensive acceptable bid.

Set-Aside

A set-aside limits competition to eligible businesses within a designated category. Federal examples include small business, 8(a), women-owned small business, HUBZone, and service-disabled veteran-owned small business programs. Similar preference programs exist in state and local procurement, with jurisdiction-specific certifications.

Set-aside status affects teaming, subcontracting, proposal eligibility, and performance obligations. A bidder cannot safely treat a certified prime as a decorative front for another company. Limitations on subcontracting and similarly situated entity rules can determine who must actually perform the work.

Sole Source and J&A

A sole-source acquisition proceeds without full competition because only one source is permitted or reasonably capable under the applicable authority. In federal contracting, a Justification and Approval (J&A) documents the legal basis, rationale, market research, and required approvals for using an exception to full and open competition.

“The incumbent already knows the system” is not automatically a sufficient justification. The agency usually must explain why switching, delay, technical uniqueness, urgency, or another authorized circumstance supports the approach. Brand-name restrictions can require related but distinct documentation.

IDIQ and Task Order

An indefinite-delivery, indefinite-quantity (IDIQ) contract establishes a framework for an uncertain quantity of supplies or services during a fixed period. Actual work is placed through task orders for services or delivery orders for supplies. The base IDIQ usually specifies a minimum and maximum value, ordering procedures, and contract terms.

A place on a multiple-award IDIQ creates eligibility to compete for orders, not guaranteed revenue beyond the contractual minimum. Practitioners distinguish the vehicle ceiling from the value of funded orders because a very large ceiling can coexist with very little actual work.

BPA

A blanket purchase agreement (BPA) is a simplified arrangement for anticipated recurring needs. Federal agencies may establish BPAs under simplified acquisition procedures or against schedule contracts. Calls or orders placed under the BPA identify the actual purchases.

A BPA is often described as an account or ordering channel rather than a funded commitment. Being selected for one can improve access, but revenue appears only when authorized orders are placed. State and local buyers sometimes use the same acronym for structures that differ legally, so the underlying terms matter more than the label.

GWAC and Multiple Award Schedule

A governmentwide acquisition contract (GWAC) is a federal task-order contract for information technology available across agencies. The Multiple Award Schedule (MAS), administered by the General Services Administration, offers commercial products and services under pre-negotiated schedule contracts.

Both are routes to market, but neither eliminates the need for an ordering agency to define its requirement, evaluate the order, and comply with ordering procedures. “We are on GSA” means the company has a schedule contract. It does not mean every agency can buy any service from it without further competition or scope analysis.

OTA

An Other Transaction Agreement (OTA) is a legally binding instrument used by agencies with specific statutory authority, commonly for research, prototypes, and certain follow-on production. It is not a standard FAR procurement contract, grant, or cooperative agreement.

OTAs permit more flexible terms for intellectual property, payment milestones, and participation by nontraditional contractors. They are not acquisition law in a casual outfit. The agency must still stay within its authority, document the transaction, and satisfy any conditions for a noncompetitive production follow-on.

Cooperative Purchasing and Piggybacking

Cooperative purchasing allows multiple public entities to use a competitively established contract or purchasing program. Piggybacking occurs when one entity uses another public body’s existing contract under legal authority permitting that use.

Availability depends on the original solicitation, contract language, local law, scope, and pricing. A contract advertised as cooperative-ready may still be unusable if the buyer’s jurisdiction requires provisions that are absent. The route can shorten procurement, but it does not suspend public purchasing law.

Bid Protest

A bid protest challenges the conduct or outcome of a public procurement. Federal protests may be filed with the agency, the Government Accountability Office, or the U.S. Court of Federal Claims. State and local protest forums and deadlines vary considerably.

Protests usually concern solicitation defects, evaluation errors, unequal treatment, organizational conflicts, or failure to follow stated criteria. They are not simply appeals by disappointed bidders. Timing can affect whether performance is stayed, so a seemingly small debriefing issue may quickly become a schedule issue for the entire program.

Contract Structure and Funding

SOW, PWS, and SOO

A Statement of Work (SOW) describes work the contractor must perform, sometimes with detailed methods. A Performance Work Statement (PWS) emphasizes required outcomes, standards, and measurable results. A Statement of Objectives (SOO) states the government’s high-level objectives and asks offerors to propose their approach, often including a proposed PWS.

People sometimes use SOW and PWS interchangeably, but the distinction matters when responsibility for the method is disputed. A prescriptive SOW gives the buyer more control over how work is done. A performance-based document gives the contractor more design latitude, along with more accountability for the result.

CLIN and SLIN

A Contract Line Item Number (CLIN) identifies a separately priced, funded, delivered, or accounted-for component of a government contract. A Subline Item Number (SLIN) further divides a CLIN, often by funding source, period, location, or deliverable.

CLIN architecture affects invoicing, funding, acceptance, and financial reporting. If software licenses, implementation services, cloud usage, and operations are mixed into one poorly designed line item, the accounting consequences arrive later, usually after everyone who designed the structure has moved to another meeting.

FFP, T&M, and Cost-Reimbursement

Firm-fixed-price (FFP) places most cost risk on the contractor for delivering the defined result. Time-and-materials (T&M) pays specified labor rates and material costs, usually subject to a ceiling. Cost-reimbursement contracts reimburse allowable costs and may add a fee under the selected structure.

Contract type is an allocation of risk, not a synonym for delivery methodology. FFP works best when scope can be defined and priced. T&M is flexible but requires labor-hour oversight. Cost-reimbursement supports uncertain work but brings cost accounting, allowability, and surveillance obligations that many commercial software firms underestimate.

Ceiling and NTE

A ceiling or not-to-exceed (NTE) amount limits what may be ordered, incurred, or paid under the relevant contract provision. The term may apply to an entire vehicle, a task order, a T&M line item, travel, or a specific change.

A ceiling is not the same as committed funding, expected revenue, or permission to spend freely. When someone cites a billion-dollar vehicle ceiling, the useful follow-up is how much has been obligated to the contractor’s actual orders.

Base Period and Option Year

The base period is the initial contract performance period. An option year is a potential extension the government may exercise under the contract’s option clauses, subject to continuing need, available funding, acceptable performance, and required determinations.

Option value is commonly included in total contract value, but options are not guaranteed revenue. Vendors may price an attractive base period expecting years of renewal, while buyers retain a structured off-ramp. Whether the transition can realistically occur before the next option deadline is often the less comfortable question.

QASP and AQL

A Quality Assurance Surveillance Plan (QASP) explains how the government will monitor contractor performance against a PWS. An Acceptable Quality Level (AQL) defines the tolerated level of error or minimum performance for a measured service.

The QASP is the government’s surveillance plan, while the contractor may maintain a separate quality-control plan. An AQL of 95 percent does not always mean five percent of transactions may fail without consequence. Critical failures, sampling methods, service credits, and corrective-action requirements may operate separately.

CPARS

The Contractor Performance Assessment Reporting System (CPARS) records federal contractor performance evaluations across areas such as quality, schedule, cost control, management, and regulatory compliance. The information becomes part of the government’s source-selection record for future procurements.

A CPARS rating is not merely a customer satisfaction score. It can affect the contractor’s competitiveness across federal opportunities. Contractors may comment on evaluations, but a thoughtful contemporaneous record is more useful than discovering at year-end that both sides remember the implementation differently.

OCI

An Organizational Conflict of Interest (OCI) arises when a contractor’s other activities may create biased ground rules, impaired objectivity, or unequal access to nonpublic information. Typical examples include helping draft requirements and later competing to perform them, or evaluating technology in which the evaluator has a financial interest.

OCI concerns can require avoidance, mitigation, disclosure, or exclusion from an acquisition. They are distinct from personal conflicts of interest. In GovTech ecosystems, the issue often appears when advisory, integration, platform, and independent-assurance roles are offered by related entities.

Price Reasonableness and Price Realism

Price reasonableness asks whether a price is too high relative to competition, market information, historical prices, or another valid basis. Price realism asks whether a proposed price is so low that it suggests misunderstanding, performance risk, or an unrealistic technical approach.

Reasonableness protects the government from overpaying. Realism examines whether the bidder can plausibly perform at the proposed price. In fixed-price competitions, realism analysis generally must be authorized and described by the solicitation. A low price may be attractive, strategically aggressive, or evidence that the bidder has not counted the interfaces.

Constructive Change

A constructive change occurs when government action or inaction effectively requires work beyond the contract even though no formal change order was issued. Examples can include informal direction, defective specifications, accelerated performance, or an interpretation that expands scope.

The contractor must usually provide timely notice and preserve supporting records. Quietly performing months of extra work and later labeling it a constructive change is a weak position. For government staff, the term is a reminder that seemingly helpful technical direction may carry contractual consequences.

Technical Data and Computer Software Rights

Government technology contracts distinguish ownership from license rights. Depending on funding, development history, commercial status, and applicable FAR or defense clauses, the government may receive unlimited rights, government-purpose rights, restricted rights, limited rights, or negotiated rights in technical data and software.

The label “custom-developed for the government” does not by itself settle the issue. Rights in source code, interfaces, documentation, training materials, configuration, and pre-existing vendor components may differ. This becomes critical when the agency wants a new integrator to maintain the system or reuse components elsewhere.

Award, Obligation, and Outlay

An award creates the contractual or assistance instrument. An obligation records the government’s legally binding commitment of funds. An outlay occurs when money is actually disbursed. These figures can differ substantially at any point in time.

Market reports often quote announced award value, including options and ceilings, as though it were realized spending. Practitioners examining actual economics ask what has been obligated, what remains available, and how quickly obligations convert into outlays.

Color of Money

Color of money is federal shorthand for the purpose, period of availability, and legal restrictions attached to an appropriation. Funds designated for research, procurement, operations, or another purpose are not freely interchangeable merely because they support the same technology program.

The related bona fide needs rule generally requires time-limited appropriations to be used for a legitimate need arising during their period of availability. When a team says the money is the wrong color, it usually means the program has funding in the abstract but not funding legally usable for that particular requirement.

Digital Public Services

Digital Service Standard

A digital service standard is a government-defined set of criteria for designing and operating public digital services. Common requirements cover user needs, accessibility, privacy, security, multidisciplinary ownership, performance measurement, open standards, and continuous improvement.

Some jurisdictions use formal service assessments before a service may progress from alpha to beta or public operation. The standard is broader than a visual design guide. A polished interface can fail assessment if the service still requires unnecessary evidence, excludes assisted channels, or cannot be sustainably operated.

HISP and Designated Service

A U.S. federal High-Impact Service Provider (HISP) is an organizational unit designated because it delivers services with substantial public reach or impact. A designated service is a specific service journey subject to federal customer-experience measurement and improvement requirements.

HISP conversations focus on measures such as trust, satisfaction, completion, burden, and service-level performance across channels. The designation elevates a service from a website concern to an agency management concern, which is usually when several systems discover they are part of the same customer journey.

Life Event

A life event organizes services around something happening to a person or organization, such as having a child, losing a job, starting a business, surviving a disaster, or retiring. It contrasts with organizing services around agency boundaries and program names.

Life-event design exposes handoffs among agencies, identity systems, eligibility rules, and evidence requirements. The user may experience one event while government operates seven programs. GovTech architecture is increasingly expected to bridge that difference without pretending the laws have also become one.

Digital Front Door

A digital front door is the primary online entry point through which residents discover, apply for, track, and manage government services. It may combine a portal, common identity, notification services, status tracking, content, and routing across multiple back-end systems.

The term does not necessarily mean every service runs on one platform. A credible front door hides unnecessary institutional complexity while preserving the correct systems of record. A portal that merely links to forty unrelated forms is technically a door, although perhaps not the one implied by the presentation.

No Wrong Door

No wrong door is a service-delivery principle under which a person can begin through any supported channel or agency touchpoint and still be routed to the appropriate programs. In benefits administration, it may also imply screening for multiple forms of assistance from a shared intake process.

This is an operating and policy commitment, not just a portal feature. It requires referral rules, interoperable data, trained staff, and clear accountability for handoffs. Without those, “no wrong door” can become several correct doors followed by the same waiting room.

Once-Only Principle

The once-only principle holds that people and businesses should not repeatedly provide information government already possesses and is legally permitted to reuse. It is prominent in European digital-government policy and increasingly influences service design elsewhere.

Implementation depends on authoritative sources, consent or another lawful basis, data quality, interoperability, and correction mechanisms. It does not authorize unrestricted data sharing. The practical design question is not simply whether government has the information, but whether this agency may rely on it for this purpose.

Assisted Digital

Assisted digital refers to support for people who cannot independently complete a digital service because of access, skills, disability, language, complexity, or circumstance. Assistance may be provided by telephone, in person, through community partners, or by staff using the same underlying service.

It is different from maintaining a completely separate manual process. Mature designs let staff assist without creating a second set of rules or an invisible queue. Usage of assisted channels is also diagnostic: unusually high demand may reveal that the digital journey is failing, not that users require more encouragement.

USWDS

The U.S. Web Design System (USWDS) provides design principles, accessible components, tokens, patterns, and implementation guidance for federal websites and digital services. State and local teams also reuse it, although they may adopt other design systems.

Using USWDS can reduce duplicated accessibility and interaction work, but it does not make a service compliant by itself. Teams can assemble approved components into an inaccessible workflow with surprising efficiency.

Administrative Burden and Time Tax

Administrative burden is the learning, compliance, and psychological cost imposed on people when accessing government programs. Time tax is practitioner shorthand for the hours spent understanding requirements, gathering evidence, waiting, correcting errors, or repeating information.

These concepts change how teams evaluate service quality. A transaction may cost the agency little while imposing substantial uncompensated effort on residents. Burden reduction therefore examines form fields, documentation, renewals, notices, channel switching, and avoidable contacts, not just page-load time.

Digital Identity and Eligibility

ICAM, PIV, and CAC

Identity, Credential, and Access Management (ICAM) is the government discipline for establishing identities, issuing credentials, and controlling access to resources. A Personal Identity Verification (PIV) card is the federal civilian smart credential established under federal standards. The Common Access Card (CAC) serves a comparable role for Department of Defense personnel.

ICAM covers people, devices, services, and increasingly non-person entities. PIV and CAC are credentials within that larger architecture, not synonyms for identity management. A public-facing benefits portal usually needs a different credential model from the workforce systems its caseworkers use.

Identity Proofing, Authentication, and Authorization

Identity proofing establishes that a claimed real-world identity belongs to the applicant. Authentication determines whether the current user controls the recognized credential. Authorization determines what that authenticated identity may access or do.

These stages answer different questions: Who are you? Can you prove control of the credential? What are you allowed to do? A successful login does not mean an applicant is eligible for a program, and a verified identity does not automatically authorize access to another person’s case.

IAL, AAL, and FAL

NIST digital identity guidance defines three assurance dimensions. Identity Assurance Level (IAL) addresses confidence in identity proofing. Authenticator Assurance Level (AAL) addresses confidence in authentication. Federation Assurance Level (FAL) addresses protections around federated assertions passed between identity providers and relying parties.

The dimensions are selected according to transaction risk rather than as one universal “security level.” A service may need stronger authentication without requiring stronger proofing. Requiring the highest level everywhere can exclude legitimate users and add cost without reducing the relevant risk.

Integrated Eligibility

An integrated eligibility system supports eligibility determination across multiple public-assistance programs through shared intake, data, rules, workflows, or case-management capabilities. Programs commonly involved include Medicaid, nutrition assistance, cash assistance, and child-care support.

Integrated does not necessarily mean the programs share identical rules or one database. The value lies in reusing verified information, coordinating renewals, and reducing duplicate work while preserving program-specific legal determinations. Implementations become difficult where similar policy words have subtly different statutory definitions.

Categorical Eligibility

Categorical eligibility allows eligibility for one program, status, or service to establish or simplify eligibility for another under governing rules. It can reduce duplicate verification and support coordinated enrollment.

The connection is rule-specific, not an assumption that “eligible once means eligible everywhere.” Practitioners must identify which program determination is controlling, whether the category is automatic or expanded, and which additional conditions still apply.

Ex Parte Renewal and Redetermination

An ex parte renewal determines continuing eligibility using reliable information already available to the agency, without first requiring the beneficiary to submit a renewal form. Redetermination or recertification is the broader process of reassessing eligibility at a required interval or after a triggering change.

Ex parte does not mean no decision occurs. The system still evaluates current data, applies rules, documents the basis, and issues required notice. If an ex parte decision cannot be completed, the case may move to a beneficiary-response workflow.

Presumptive Eligibility

Presumptive eligibility provides temporary program access based on preliminary information while a full eligibility determination is pending. It is used in specified programs and by qualified entities under applicable law.

The technology must distinguish temporary status, effective dates, final determination, and potential transitions. Treating presumptive approval as final eligibility can produce payment, notice, and reporting errors that are difficult to unwind.

Rules Engine and Rules as Code

A rules engine executes configured logic for decisions such as eligibility, fees, routing, or compliance checks. Rules as code is the practice of expressing authoritative policy logic in machine-consumable form, ideally with traceability to legal sources and reusable test cases.

These concepts overlap but are not identical. A rules engine is a technical component. Rules as code is a policy-development and governance approach. The hard problem is rarely writing an if statement; it is proving that the statement accurately represents current law, handles exceptions, and changed on the correct effective date.

Program Integrity and Improper Payment

Program integrity encompasses controls intended to ensure public funds and services reach eligible recipients in the correct amount while preventing, detecting, and correcting error, abuse, and fraud. An improper payment is a payment that should not have been made, was made in the wrong amount, or lacks required supporting evidence under the applicable definition.

Improper does not automatically mean fraudulent. Agency error, outdated data, recipient error, and documentation failures can all contribute. GovTech discussions often concern the tradeoff between stronger controls and the administrative burden or exclusion those controls may create.

Government Data Exchange

NIEM

The National Information Exchange Model (NIEM) provides a common vocabulary, modeling approach, and governance framework for information exchange across government domains. It is widely associated with justice, public safety, emergency management, human services, and cross-agency exchange.

NIEM is not a central database or a complete application architecture. It helps parties describe exchanged information consistently. Adopting NIEM vocabulary does not eliminate the need to define business rules, transport, security, timing, and responsibility for each exchange.

IEPD

An Information Exchange Package Documentation (IEPD) set describes a specific NIEM-based exchange. It typically identifies business context, data components, schemas, constraints, examples, and implementation artifacts.

The IEPD converts a broad information model into something implementers can build and test. If a team says an interface is “NIEM-compliant” but cannot produce the exchange specification, the compliance claim may be more aspirational than operational.

Syntactic and Semantic Interoperability

Syntactic interoperability means systems can exchange data in a compatible structure or format. Semantic interoperability means they interpret the exchanged data with the same meaning.

Two systems may both accept a field called status while one means application status and the other means person status. The message can pass every schema check and still be wrong. Syntax gets the data through the door; semantics determines whether it entered the correct room.

Master Person Index and Record Matching

A Master Person Index (MPI), sometimes called a master client index, links records believed to represent the same person across systems. Deterministic matching uses exact or rule-based agreement on selected attributes. Probabilistic matching assigns weights and likelihoods to imperfect matches.

False positives can expose one person’s information to another case. False negatives can duplicate benefits, notices, or records. Match thresholds are therefore policy and risk decisions, not merely data-science settings. Names, addresses, and household structures also change, which is inconvenient but apparently unavoidable.

Privacy-Preserving Record Linkage

Privacy-Preserving Record Linkage (PPRL) allows organizations to identify likely matching records while reducing exposure of direct identifiers. Techniques may include cryptographic transformations, secure computation, trusted intermediaries, or tokenization.

PPRL lowers certain disclosure risks but does not make governance unnecessary. The match purpose, error rate, legal authority, re-identification risk, and permitted downstream use still require decisions. An encrypted bad match remains a bad match.

Authoritative Source

An authoritative source is the recognized origin against which a particular data element is validated or controlled. A tax authority may be authoritative for a filing status, while a licensing agency is authoritative for license standing.

Authority is usually attribute-specific. No single system is authoritative for every fact about a person, property, or organization. Naming the source helps resolve conflicts, design update workflows, and determine what evidence supports an automated decision.

Open Data and Machine-Readable Data

Open data is government data made available for public reuse under terms and formats that support access and redistribution. Machine-readable means the format can be processed programmatically, such as structured CSV, JSON, or geospatial data rather than a scanned document.

Open data is not synonymous with public records disclosure. Some records are legally obtainable only through a request process, while some published datasets are proactively released and de-identified. A PDF table may be public, but practitioners will hesitate to call it genuinely open data.

Data Use Agreement

A Data Use Agreement (DUA) specifies permitted purposes, users, security controls, retention, redisclosure, incident handling, and disposition for shared data. It may sit alongside an interagency agreement, memorandum of understanding, business-associate agreement, or technical interface agreement.

The DUA answers what may be done with the data, not merely how the interface operates. Technical access before the agreement is complete is not a shortcut. It is an incident report waiting for a date.

Security Authorization

FISMA and RMF

The Federal Information Security Modernization Act (FISMA) establishes federal agency information-security responsibilities and oversight. The NIST Risk Management Framework (RMF) provides a structured lifecycle for preparing, categorizing, selecting controls, implementing controls, assessing, authorizing, and continuously monitoring systems.

FISMA is the statutory and governance context. RMF is the operating framework commonly used to produce an authorization decision. Contractors encounter both because a hosted or operated solution may fall within an agency’s security responsibilities.

FIPS 199 Impact Level

FIPS 199 categorizes a federal information system as low, moderate, or high impact based on the potential harm from loss of confidentiality, integrity, or availability. The overall categorization generally follows the highest impact assigned to any of those objectives.

The impact level drives the initial security-control baseline and assurance effort. “Moderate data” is common shorthand, but the formal analysis concerns consequences, not how sensitive the data feels. Availability can drive a high categorization even when confidentiality is relatively modest.

ATO

An Authorization to Operate (ATO) is a formal decision by an authorizing official to accept the documented risk of operating an information system under stated conditions. It follows review of the system boundary, controls, assessment evidence, residual findings, and operating environment.

An ATO is neither permanent nor a general certification that a product is secure everywhere. It applies to a defined system and environment for a stated period or ongoing authorization regime. Material changes, serious findings, or changed risk can trigger reassessment.

FedRAMP

The Federal Risk and Authorization Management Program (FedRAMP) standardizes security assessment, authorization, and continuous monitoring for cloud services used by U.S. federal agencies. Cloud offerings are evaluated against designated baselines and documented in reusable authorization packages.

A FedRAMP-authorized cloud service can reduce duplicated assessment, but an agency still must address its own implementation, integrations, responsibilities, and ATO. “FedRAMP-ready” has no equivalent authorization status. It usually means the provider would like the next conversation to involve a substantial budget.

Authorization Boundary

The authorization boundary defines the components, services, interfaces, data, and responsibilities included within a system’s security authorization. It determines what is assessed and where dependencies cross into separately authorized environments.

Boundary design materially affects scope, inherited controls, evidence, and change management. Moving one component outside the diagram does not remove the risk if the system still depends on it. Assessors tend to notice architectural optimism.

SSP and Control Inheritance

A System Security Plan (SSP) describes the system, environment, architecture, roles, data, and implementation of required security controls. Control inheritance occurs when the system relies on controls provided by another authorized service, such as a cloud infrastructure provider or agency enterprise capability.

Inherited does not mean ignored. The system owner must identify the provider, understand the implementation, satisfy customer responsibilities, and retain evidence. Many findings arise in the gap between what the provider supplies and what the application team assumed it supplied.

POA&M

A Plan of Action and Milestones (POA&M) records identified security weaknesses, planned corrective actions, responsible parties, resources, milestones, and expected completion dates. It is pronounced by spelling the letters or as “poam.”

A POA&M is not a miscellaneous backlog. Findings may affect authorization, continuous monitoring, contractual reporting, and risk acceptance. Repeatedly moving a milestone without addressing root cause tends to attract the kind of attention no dashboard color can soothe.

3PAO and SAR

A Third Party Assessment Organization (3PAO) is an independent assessor qualified to evaluate a cloud service for FedRAMP purposes. The resulting Security Assessment Report (SAR) documents testing, evidence, findings, and the assessor’s analysis.

The 3PAO assesses; it does not grant the authorization. The provider prepares substantial evidence, the assessor evaluates it, and the government makes the risk decision. Confusing those roles can produce very optimistic project plans.

Continuous Monitoring

Continuous monitoring, commonly shortened to ConMon, is the recurring collection and review of security evidence after authorization. It includes vulnerability scanning, patch status, incident reporting, control changes, inventory, and periodic assessments.

Authorization is therefore the start of an operating obligation, not the finish line. Cloud providers and agencies must maintain evidence on prescribed cycles and manage findings within required time frames. A product that can pass an initial assessment but cannot sustain ConMon is not operationally authorization-ready.

CUI

Controlled Unclassified Information (CUI) is government information that requires safeguarding or dissemination controls under law, regulation, or government-wide policy but is not classified national-security information. The CUI Registry identifies categories and handling authorities.

When CUI resides in nonfederal systems, requirements such as NIST SP 800-171 and contract clauses may apply. Marking, transmission, storage, subcontractor flow-downs, and incident reporting all matter. Calling information “sensitive” informally does not establish whether it is legally CUI.

CJIS Security Policy

The Criminal Justice Information Services Security Policy establishes safeguards for criminal justice information accessed through FBI CJIS systems and connected environments. It addresses areas such as personnel security, access control, authentication, encryption, auditing, and incident response.

Cloud and software providers serving law enforcement often hear “CJIS compliant,” but implementation and approval involve the relevant CJIS Systems Agency and contractual environment. CJIS is not a single universal product certificate that automatically transfers across every state.

GovRAMP

GovRAMP, formerly known as StateRAMP, provides standardized cloud-security verification intended for state, local, education, and other public-sector buyers. It uses common control frameworks, independent assessment, and continuous monitoring to reduce duplicated review.

GovRAMP and FedRAMP are related in purpose but are not interchangeable approvals. Acceptance, required status, and reciprocity depend on the purchasing entity. Vendors should verify the buyer’s actual requirement rather than treating every word ending in “RAMP” as the same mountain.

Accessibility, Privacy, and Records

Section 508

Section 508 of the Rehabilitation Act requires U.S. federal agencies to make information and communications technology accessible to people with disabilities, subject to defined exceptions. Its standards apply to websites, software, electronic documents, hardware, support materials, and other covered technology.

State and local entities may face different but overlapping obligations under the Americans with Disabilities Act, state law, funding conditions, and procurement rules. Section 508 is therefore not a universal name for all accessibility law, although practitioners often use it as shorthand.

WCAG

The Web Content Accessibility Guidelines (WCAG) define testable success criteria organized around content being perceivable, operable, understandable, and robust. Conformance levels are A, AA, and AAA, with AA commonly used in legal and procurement requirements.

A product does not become accessible merely by satisfying automated checks. Many criteria require manual testing, keyboard navigation, screen-reader evaluation, focus-order review, and judgment about meaning. Version and conformance level matter, so “WCAG compliant” is incomplete without both.

VPAT and ACR

A Voluntary Product Accessibility Template (VPAT) is a standard format used to document how a product addresses accessibility criteria. Once completed for a product, it becomes an Accessibility Conformance Report (ACR).

Practitioners frequently call the completed document a VPAT, but technically the VPAT is the template. Buyers should examine the tested version, evaluation methods, dates, and explanations behind “supports with exceptions.” A beautifully formatted ACR can still disclose substantial barriers, which is why reading beyond the first page is considered fashionable.

Privacy Impact Assessment

A Privacy Impact Assessment (PIA) analyzes how a system collects, uses, shares, secures, retains, and disposes of personally identifiable information. In the federal context, PIAs are associated with statutory requirements for information technology and electronic information collections.

A PIA is broader than a cybersecurity review. A system may secure personal data extremely well while collecting more than necessary or using it for an insufficiently disclosed purpose. Privacy asks whether the processing should occur and under what conditions, not only whether attackers can reach it.

System of Records and SORN

Under the federal Privacy Act, a system of records is a group of records under agency control from which information is retrieved by a person’s name or other identifying particular. A System of Records Notice (SORN) publicly describes the system, categories of individuals and records, routine uses, safeguards, retention, and access procedures.

This legal definition is narrower than the ordinary technology use of “system of record.” A database can be operationally authoritative without being a Privacy Act system of records, and retrieval practice can matter as much as what fields are stored.

PRA and OMB Control Number

The federal Paperwork Reduction Act (PRA) governs many information collections directed to ten or more persons outside the federal government. Covered collections generally require review by the Office of Management and Budget and display a valid OMB control number with an expiration date and burden statement.

Changing a federal form, adding a required field, or introducing a recurring survey may therefore involve more than a design release. Teams should determine whether an existing approval covers the change. The PRA has a talent for entering the conversation immediately after someone says, “It is only one question.”

FOIA and Segregability

The Freedom of Information Act (FOIA) gives the public a right to request federal agency records, subject to statutory exemptions. State public-records laws serve comparable functions under jurisdiction-specific rules. Segregability requires releasable portions of records to be provided when exempt material can reasonably be separated.

GovTech systems must support search, export, review, redaction, and defensible retention. A database is not exempt merely because exporting from it is inconvenient. Architecture that mixes releasable and protected information without clear metadata can make every request a custom forensic exercise.

Records Schedule and Disposition Authority

A records schedule identifies record categories and specifies how long they must be retained and when they may be destroyed or transferred. Disposition authority is the legal authorization permitting that treatment.

Retention is not simply a storage setting chosen by the application team. Records may be subject to schedules, litigation holds, audits, investigations, or permanent archival requirements. “Delete after seven years” is not a policy until someone identifies which records, which authority, and which event starts the clock.

Algorithmic Impact Assessment

An Algorithmic Impact Assessment (AIA) evaluates the purpose, data, affected population, potential harms, explainability, oversight, appeal mechanisms, and monitoring associated with an automated or algorithm-assisted decision system. Requirements vary by jurisdiction and use case.

AIAs are increasingly relevant to benefits, employment, fraud detection, public safety, and resource allocation. They are not merely model-accuracy reports. A highly accurate model may still create unacceptable due-process, bias, transparency, or administrative-law concerns.

Civic Operations Platforms

311

311 is a non-emergency channel for local government information and service requests. A 311 platform typically combines telephone, web, mobile, knowledge-base, routing, case status, geographic data, and departmental work-order integrations.

The number is shorthand for an operating model, not just a call center. Metrics often include first-contact resolution, request closure, duplicate requests, transfer rates, and service-level performance by request type. Closing the ticket because it reached another department is not the same as resolving the pothole.

PSAP and NG911

A Public Safety Answering Point (PSAP), increasingly called an emergency communications center, receives and processes emergency calls. Next Generation 911 (NG911) replaces legacy circuit-switched infrastructure with standards-based IP networks capable of supporting richer location data, text, images, video, and interoperable routing.

NG911 is not merely the ability to text 911. It affects call routing, geographic information, cybersecurity, logging, continuity, and interfaces with dispatch systems. Jurisdictions may be at very different migration stages even when they use the same terminology.

CAD

Computer-Aided Dispatch (CAD) software supports call intake, incident classification, unit recommendation, dispatch, status tracking, location, and responder coordination. It is central to police, fire, emergency medical, and other field-response operations.

CAD uptime and latency are operationally critical. Interfaces commonly connect CAD with NG911, geographic information systems, mobile terminals, records systems, and automatic vehicle location. If CAD is functioning but unit status or location is stale, the system is technically up in a way dispatchers may not appreciate.

RMS and NIBRS

A public-safety Records Management System (RMS) manages incident reports, arrests, evidence references, investigations, approvals, and related records. The National Incident-Based Reporting System (NIBRS) is the FBI’s detailed standard for reporting crime incidents and associated attributes.

RMS is the operational platform; NIBRS is a reporting framework the platform may support. A report can be complete for local investigative purposes yet fail NIBRS validation because a required relationship, code, or circumstance is missing.

GIS and Parcel Fabric

A Geographic Information System (GIS) manages spatial data, analysis, and mapping used across planning, emergency response, utilities, public works, taxation, and service delivery. A parcel fabric is a structured representation of land parcels, boundaries, measurements, and related survey or cadastral information.

GIS is often an operational dependency rather than a display layer. Incorrect address points can misroute emergency calls; stale parcel geometry can affect permitting or taxation. Practitioners distinguish the map people see from the governed datasets and topology underneath it.

CAMA

Computer-Assisted Mass Appraisal (CAMA) systems support property assessment by managing parcel characteristics, ownership, valuation models, sales, exemptions, and assessment history. Assessors use them to value large populations of property consistently.

CAMA is distinct from tax billing and collection, although the systems exchange data. A valuation change may originate in CAMA, pass through appeals and certification, and only later affect a tax bill. Confusing assessed value with tax due skips several legally important steps.

PLCE

Permitting, Licensing, and Code Enforcement (PLCE) refers to platforms that manage applications, plan review, inspections, approvals, licenses, violations, fees, and enforcement activity. Vendors may also call this land management, community development, or regulatory management software.

The workflows look configurable until local ordinances, review boards, zoning overlays, fee schedules, and inspection sequences are examined. A permit type with the same name in two cities may follow materially different legal and operational paths.

Electronic Plan Review

Electronic plan review, often shortened to ePlan review, manages digital submission, markup, routing, version control, comment resolution, and approval of construction or development plans. It commonly integrates with permitting and document-management platforms.

The challenge is maintaining a defensible review record across disciplines and revisions. Emailing annotated PDFs can be electronic, but it is not necessarily a controlled ePlan process. Review sets, stamps, resubmittals, and approved versions must remain distinguishable.

Case Management and Constituent CRM

Case management organizes work around a regulated matter, person, household, investigation, or proceeding with defined evidence, decisions, and lifecycle states. A constituent relationship management system organizes contacts, inquiries, service requests, communications, and relationship history.

The platforms may overlap, but they answer different questions. CRM asks how government interacted with the constituent. Case management asks what happened to the legally or operationally governed matter. Treating a benefits appeal as a customer-service ticket can lose deadlines, evidence, and due-process controls.

AVL

Automatic Vehicle Location (AVL) uses GPS or related positioning technology to track fleet location and status. Governments use it for transit, snow removal, waste collection, emergency response, inspections, and public works.

AVL data supports dispatch, route adherence, estimated arrival, coverage, and after-action analysis. Location frequency, accuracy, dead zones, device health, and labor or privacy rules affect what the data can reliably prove. A dot on a map is not automatically evidence that the assigned work occurred.

Grant-Funded Technology

NOFO and Assistance Listing

A Notice of Funding Opportunity (NOFO) announces a federal assistance program, its eligibility rules, priorities, application requirements, evaluation method, and award conditions. An Assistance Listing, historically called a CFDA listing, provides the standardized program description and identifying number.

For technology programs, the NOFO determines what activities, periods, recipients, and costs are eligible. A technically suitable purchase may still be unallowable if it does not support the funded purpose or falls outside the approved period.

Uniform Guidance

Uniform Guidance, codified principally at 2 CFR Part 200, establishes federal rules for grants and cooperative agreements, including administrative requirements, cost principles, procurement standards, subrecipient monitoring, and audit obligations.

State and local recipients frequently flow these requirements into technology procurements funded by federal awards. Vendors may therefore encounter documentation, domestic preference, competition, records-access, and termination provisions that are not part of the buyer’s ordinary purchasing template.

Subrecipient and Contractor

A subrecipient carries out part of a federal program and is accountable for programmatic compliance. A contractor provides goods or services for the recipient’s own use under a procurement relationship. Uniform Guidance requires the classification to be based on the substance of the relationship.

The distinction affects monitoring, audit exposure, indirect costs, reporting, and flow-down terms. Calling every technology partner a vendor does not make each one a contractor if it is actually making program decisions and carrying out the award’s public purpose.

Drawdown and Reimbursement

A drawdown requests cash from an authorized federal payment system against an award. Under a reimbursement structure, the recipient first incurs eligible costs and then requests repayment. Advance-payment methods permit earlier access subject to cash-management rules.

Grant award value is not cash sitting in the recipient’s bank account. Timing depends on approved budgets, expenditure documentation, reporting, and payment controls. This can influence a GovTech implementation’s cash flow even when total funding appears secure.

Allowable, Allocable, and Reasonable

A grant-funded cost generally must be allowable under the award and governing rules, allocable to the benefiting program, and reasonable in amount and circumstance. It must also be treated consistently and adequately documented.

A useful platform feature may still fail one of these tests. For example, charging an enterprise-wide upgrade entirely to a small grant can create an allocability problem. Competitive pricing helps demonstrate reasonableness but does not establish program allowability.

Match and Cost Share

Match or cost sharing is the portion of program cost not paid by the federal award. It may be cash or, when permitted, qualifying in-kind contributions. Requirements may be statutory, regulatory, or award-specific.

The percentage alone does not explain the accounting. Teams must know the match base, timing, eligible sources, valuation method, and documentation. Spending local money on the same project does not automatically make it valid match.

Maintenance of Effort and Supplement Not Supplant

Maintenance of Effort (MOE) requires a recipient to sustain a specified level of its own spending or activity. Supplement not supplant requires federal funds to add to, rather than replace, certain state or local resources.

These concepts are related but not interchangeable. MOE compares effort against a required baseline. Supplement-not-supplant analysis asks whether federal funds displaced spending that otherwise would have occurred. A technology modernization can satisfy one requirement and still create issues under the other.

SF-425

The Federal Financial Report, Standard Form 425 (SF-425), reports cumulative federal cash, expenditures, recipient share, unobligated balance, and related financial information for many assistance awards.

The form reconciles what was authorized, drawn, spent, and matched. Disagreement between the grants system, general ledger, procurement records, and SF-425 usually means the project has developed more than one financial reality.

Single Audit

A Single Audit is the organization-wide audit required under Uniform Guidance when a nonfederal entity meets the applicable federal expenditure threshold. It examines financial statements and compliance for selected major federal programs.

Technology procurements can become audit samples for competition, allowability, subrecipient classification, security, reporting, and internal controls. A purchase completed years earlier may need a clear documentary trail long after the implementation team has disbanded.

Program Assurance

IV&V

Independent Verification and Validation (IV&V) provides objective assessment of whether a system is being built correctly and whether it satisfies its intended requirements and business needs. Public programs may require organizational independence from the implementation contractor and, in some cases, from day-to-day program management.

IV&V does not own delivery or replace testing. It examines evidence, plans, risks, architecture, requirements, security, schedule, and readiness. A program can report green internally while IV&V reports red because the two groups are measuring confidence differently.

DDI and M&O

Design, Development, and Implementation (DDI) covers building, configuring, integrating, testing, and deploying a government system. Maintenance and Operations (M&O) covers ongoing production support, corrective maintenance, updates, hosting, service levels, and operational change.

The transition between them affects funding, staffing, acceptance, warranties, and performance measures. Production defects discovered after launch may be disputed as unfinished DDI work or chargeable M&O. The acronym changes faster than the argument.

Modular Contracting

Modular contracting divides a major technology need into smaller, interoperable increments with shorter acquisition and delivery cycles. Federal law and policy encourage the approach for certain major IT investments to reduce risk and improve competition.

Modularity requires architectural boundaries, integration ownership, and coherent product governance. Splitting one large procurement into six contracts without defining the interfaces creates a vendor ecosystem, but not necessarily a modular one.

Requirements Traceability Matrix

A Requirements Traceability Matrix (RTM) links each requirement to its source, design, configuration or code, test cases, results, defects, and acceptance status. In public programs, sources may include statutes, regulations, policy manuals, solicitation provisions, and approved change requests.

The RTM provides evidence that the implemented system addresses the contracted and legally required scope. A requirement marked “tested” is not necessarily accepted, and a passed demonstration does not prove every underlying rule path was exercised.

IGCE and ICE

An Independent Government Cost Estimate (IGCE) is the government’s internal estimate of the expected cost or price of an acquisition. An Independent Cost Estimate (ICE) is a broader independent estimate often used to challenge a program’s cost assumptions, particularly for major investments.

These estimates support budgeting, negotiation, price analysis, and oversight. Independence matters because an estimate built directly from the incumbent’s proposed staffing model may confirm the proposal with admirable precision and limited insight.

EVMS, CPI, and SPI

An Earned Value Management System (EVMS) integrates scope, schedule, and cost to measure program progress. Cost Performance Index (CPI) is commonly calculated as earned value / actual cost. Schedule Performance Index (SPI) is earned value / planned value.

Values below 1.0 indicate unfavorable cost or schedule performance. The measures depend on a credible baseline and objective earning rules. A program can improve its indices by doing valuable work, or by revising the baseline until history becomes more cooperative.

Operational Readiness Review

An Operational Readiness Review (ORR) evaluates whether a system, organization, and support model are prepared for production deployment. It typically examines testing, security authorization, data conversion, training, help desk, monitoring, continuity, rollback, staffing, and unresolved defects.

An ORR is more than a final demonstration. It asks whether the service can be operated safely at expected volume and whether the organization can respond when assumptions fail. Conditional readiness usually means the launch date has survived, but several people have acquired weekend plans.

FITARA

The Federal Information Technology Acquisition Reform Act (FITARA) strengthens federal chief information officer authority over IT budgeting, acquisition, portfolio management, data-center consolidation, and related governance. Public scorecards track agency progress across selected implementation areas.

For vendors and program teams, FITARA can affect who must approve an investment, how duplicative technology is challenged, and whether acquisition strategy aligns with agency architecture. A mission office may sponsor the system, but the CIO organization may still control critical gates.

The Phrase Translator

“It is FedRAMP Moderate, but it still needs an agency ATO.”

It may mean: The cloud service has reusable federal security evidence, but this agency must still assess its configuration, integrations, data, responsibilities, and residual risk before operating it.

“We can buy it off the Schedule, but we still need to compete the order.”

It may mean: The vendor has a GSA MAS contract, which provides an ordering route rather than a blank check. The agency must follow schedule ordering rules and document any exception to competition.

“The incumbent is on the vehicle and owns the interfaces.”

It may mean: The current provider can compete for the next order and has practical control over integration knowledge, documentation, or proprietary components. Data-rights and transition questions are about to become commercially important.

“Make the CLINs map to the funding colors.”

It may mean: Structure the contract line items so each type and period of work can be charged to an appropriation legally available for that purpose and time.

“The ceiling is large, but nothing has been obligated.”

It may mean: The contract vehicle advertises substantial potential value, but the government has not yet committed meaningful funds to actual orders. The pipeline is real in the grammatical sense.

“This should be an ex parte renewal, not another claimant touch.”

It may mean: The agency believes it already has reliable data to determine continuing eligibility and should not require the beneficiary to complete another form or contact the service center.

“The MPI is overweighting address.”

It may mean: The probabilistic matching model gives too much significance to address similarity, potentially merging household members or missing people who recently moved.

“That control is inherited from the CSP, but the POA&M is ours.”

It may mean: The cloud service provider supplies part of the security control, but the agency or application team owns the unresolved weakness and remediation milestone in its environment.

“The VPAT says supports with exceptions.”

It may mean: The product has disclosed at least some accessibility limitations. Someone now needs to read the explanations, reproduce the barriers, and decide whether remediation or an alternative is required.

“We need a J&A if we cannot establish a competitive task-order path.”

It may mean: The team wants a particular provider but must either conduct competition under an available vehicle or document a legally valid exception with the required approvals.

“The grant pays for DDI, not indefinite M&O.”

It may mean: Federal assistance may fund implementation, but the recipient needs a separate and sustainable source for hosting, support, licenses, and operations after launch.

“CAD is up, but RMS is not receiving dispositions.”

It may mean: Dispatch operations continue, but completed incident or unit-status information is not flowing into the records platform. Backlogs, duplicate entry, and reporting problems are accumulating.

“The project is green on SPI and red in the IV&V report.”

It may mean: Earned-value schedule calculations appear acceptable, while the independent assessor doubts the underlying plan, quality, readiness, or evidence. Both statements can unfortunately be true.

“We should piggyback the cooperative instead of issuing our own RFP.”

It may mean: The buyer believes an existing competitively awarded public contract can be used under local authority, potentially reducing procurement time if scope and required terms actually fit.

“The form has an OMB number, so changing one field is not just a UX tweak.”

It may mean: The information collection may be covered by Paperwork Reduction Act approval, and the proposed change needs regulatory analysis before the development team edits the screen.

Net Net

GovTech language is difficult because software architecture, public administration, acquisition law, appropriations, security authorization, program rules, accessibility, privacy, and records obligations all meet inside the same service. A term that sounds technical may control funding, while a term that sounds procedural may determine whether the system can legally launch.

• Which jurisdiction, program, and acquisition rule set give this term its meaning here?
• Are we discussing a contract ceiling, an awarded amount, an obligation, an outlay, or expected option value?
• Which contract vehicle, CLIN, PWS requirement, or ordering procedure governs the work?
• Is the security claim a FedRAMP status, an agency ATO, a GovRAMP status, or only a planned assessment?
• What is the FIPS 199 impact level, and what components sit inside the authorization boundary?
• Which system is authoritative for the disputed attribute, and what matching method links the records?
• Is this eligibility behavior required by law, agency policy, configured rules, or current operating practice?
• Which IAL, AAL, or FAL is required for the transaction, and what risk justifies it?
• What WCAG version and conformance level apply, and what exceptions are disclosed in the ACR?
• Does a PIA, SORN, DUA, records schedule, public-records rule, or OMB control number constrain the proposed change?
• Are the funds subject to match, MOE, supplement-not-supplant, period-of-availability, or cost-allowability restrictions?
• Is the program in DDI, operational readiness, acceptance, or M&O, and which specialist has authority to approve the next gate?

Real fluency does not come from memorizing every acronym. It comes from recognizing whether the conversation is about authority, money, evidence, system behavior, or public impact, then asking the question that makes the controlling rule visible.