Inside the 2026 Pentagon 8(a) review: what tribal contractors need to know

The 8(a) program audit tribal contractors are facing in 2026 is unlike anything the program has seen in its 47-year history. Within weeks of taking office, Defense Secretary Pete Hegseth ordered a line-by-line review of every sole-source 8(a) contract worth more than $20 million, calling it “the oldest DEI program in the federal government.” The Small Business Administration ran a parallel audit that resulted in roughly 1,000 firms being suspended after a December data call. Treasury opened its own review of preference-based contracting. And only 65 new 8(a) firms were approved in 2025, compared with more than 2,100 the prior year.

For tribal GovCons, the math is uncomfortable. Almost every contract in the spotlight is one that only tribal entities, Alaska Native Corporations, and Native Hawaiian Organizations can hold. The oversight wave is, in practice, a tribal contracting wave.

This post breaks down what is actually happening, who is most exposed, and the practical steps tribal finance and operations leaders are taking right now to protect their contracts and stay audit-ready.

Key takeaways

• The Pentagon is conducting a line-by-line review of every 8(a) sole-source contract above $20 million, with authority to examine smaller awards as well.

• The $20 million threshold means tribal entities, Alaska Native Corporations, and Native Hawaiian Organizations are the population being reviewed. Individually owned 8(a) firms cannot receive sole-source awards at that size.

• The SBA suspended roughly 1,000 of 4,300 active 8(a) firms after its January 2026 compliance data call, and only 65 new 8(a) firms were approved in 2025 versus more than 2,100 the prior year.

• Pass-through scrutiny is central to both reviews. Tribal firms are expected to demonstrate that the 8(a) entity performs the primary and vital contract work itself.

• • Audit readiness now depends on a single source of truth across entities, DCAA-ready timekeeping, defensible indirect rates, and complete documentation that can be produced on demand. Defense-oriented tribal contractors face a separate CMMC Phase 2 deadline on November 10, 2026, with limited C3PAO assessor capacity remaining.

Timeline of the 2026 oversight wave 

 Image alt text: Visual timeline of the 2026 tribal 8(a) oversight wave, from the August 2025 SBA approval pause through the November 2026 CMMC Phase 2 deadline.

What the Pentagon is actually reviewing

On January 16, 2026, Hegseth posted a video on X announcing that the Department of War would conduct a line-by-line review of every 8(a) sole-source contract above $20 million, with smaller awards subject to examination as well. He described the program as “a breeding ground for fraud” and said the review would target two things specifically: whether the contracts contribute to military readiness, and whether 8(a) firms are performing the work themselves rather than passing it through to larger consulting firms. Both Federal News Network and HSToday have covered the Pentagon’s review framework in detail.

The structural fact Native-owned firms need to internalize is this: the only firms that can receive 8(a) sole-source contracts above $20 million are entity-owned 8(a)s. That category includes tribally owned companies, Alaska Native Corporations, and Native Hawaiian Organizations. As former GSA Administrator Emily Murphy explained in a Federal News Network interview, “The only companies getting $20 million sole source awards through the 8(a) program are Alaska Native corporations, Native Hawaiian organizations, tribally-owned organizations.” Congress raised the tribal sole-source threshold to $100 million in 2020, well above the $5.5 million to $8.5 million ceiling that applies to individually owned 8(a) firms.

So when the Pentagon scopes a review to contracts above $20 million, the math is direct. Tribal entities are the population being reviewed.

The tribal contracting wave is baked into the threshold itself. A $20 million floor is, in practice, a tribal-only filter.

How the SBA audit fits in

The Pentagon review sits on top of an even broader SBA audit that started months earlier. In December 2025, SBA Administrator Kelly Loeffler sent compliance letters to all 4,300 active 8(a) firms requiring three years of financial records, payroll, bank statements, and subcontracting agreements by January 5, 2026. Firms that missed the deadline faced suspension, and roughly 1,000 of them lost active status. Tribal Business News reported that the SBA is examining five areas: compliance with subcontracting limits, mentor-protégé performance, owner withdrawals, benefit distributions to Native communities, and indicators of bribery or kickbacks.

The downstream effect is already visible in the approval pipeline. Industry analysts cited in Washington Technology’s coverage note that the SBA approved fewer than 70 new 8(a) firms in 2025, a more than 95 percent drop from the prior year. New tribal firms have not been added to the program since August 2025, according to attorneys working with Alaska Native and tribal entities.

Only 65 new 8(a) firms were approved in 2025, compared with more than 2,100 the prior year. That is a more than 95 percent drop, and tribal entities have not been approved at all since August.

For tribal CFOs, this is not an abstract policy story. It is a direct signal that audit response capacity, documentation discipline, and a single source of financial truth are now competitive differentiators.

Who is most exposed

Not every tribal firm carries the same level of risk in this oversight wave. Risk concentrates by contract size, defense exposure, and entity structure. The table below is a working risk profile based on what is in scope across the Pentagon, SBA, and Treasury reviews.

The pattern is clear. Defense exposure plus entity-owned 8(a) status plus contract size above $20 million is the highest-risk combination, and it is where audit-readiness investment should be concentrated first.

Why this is hitting Native-owned firms hardest

A few structural realities of the tribal 8(a) program 2026 oversight environment make this period uniquely hard for Native-owned firms.

Tribal entities, ANCs, and NHOs were granted expanded program authorities by Congress for a specific reason. They do not have to prove individual social disadvantage, they can hold multiple 8(a) companies under a single tribal parent, and they have access to higher sole-source thresholds. Those authorities exist because of the federal government’s trust and treaty obligations to Native nations, not because of a diversity preference. Quinton Carroll, executive director of the Native American Contractors Association, has been clear about this distinction, telling reporters that “Native participation in the SBA 8(a) Program is not a DEI initiative. It is grounded in the unique political and legal status of Tribal Nations under U.S. law.”

Senator Lisa Murkowski reinforced the same point in a February 2026 Senate Committee on Indian Affairs hearing, where Alaska Native corporation leaders defended the program’s record. Katherine Carlton, president of Chugach Alaska Corporation, told the committee her corporation delivered $32.6 million in community and shareholder benefits in the prior year, most of it funded by 8(a) work.

The legal and political defense is sound. But it does not change the practical reality that tribal firms are now expected to produce three years of detailed records on demand, demonstrate that they perform their own contract work, and prepare for additional reviews on top of standard annual SBA reviews. That is a documentation and financial systems challenge.

What tribal CFOs are doing right now

Tribal contracting leaders we have heard from are converging on a similar short list of priorities. None of these are new ideas. They are simply being executed with more urgency than at any point in the program’s history.

Centralizing financial data across entities. Tribal enterprises with multiple 8(a) subsidiaries, joint ventures, and community programs often operate on a patchwork of MIP, QuickBooks, Oracle, and spreadsheets. When the SBA asks for three years of clean financials in 30 days, that patchwork becomes the bottleneck. Firms with a single source of truth across entities respond faster and with fewer reconciliation errors.

Tightening cost accounting and indirect rate discipline. Pass-through allegations are a central theme of the current review cycle. Demonstrating that the 8(a) entity performs the primary and vital contract work requires clean direct-versus-indirect cost segregation, defensible labor distribution, and documented subcontracting limits.

Strengthening incurred cost reporting (ICE) and timekeeping. DCAA-compliant timekeeping with full audit trails is no longer just a contract requirement. It is the evidence base that protects an 8(a) firm during a line-by-line review.

Preparing for CMMC Phase 2. Tribal defense subcontractors face a separate compliance deadline on November 10, 2026. Cherokee Nation Aerospace & Defense, Choctaw Defense Manufacturing, Akima, ASRC Federal, and Diné Development are among the named tribal players with significant defense exposure. CMMC Phase 2 will require third-party C3PAO certification for contracts involving CUI, and there are only about 80 authorized C3PAOs serving the entire defense industrial base.

Documenting community reinvestment. Native-owned firms have a defensible, mission-aligned story that no other 8(a) participant can tell. The reinvestment of contract revenue into housing, healthcare, education, and tribal services is the program’s economic justification. That story belongs in proposal narratives, capability statements, and, increasingly, in audit response packages.

What to watch next

Three things are worth tracking through the rest of 2026.

The first is the pace of new 8(a) approvals. If the 2025 freeze continues into late 2026, tribal enterprises will need to lean harder on existing certifications and look at adjacent paths like GSA MAS, HUBZone stacking on tribal lands, and joint ventures.

The second is whether Congress acts. Murkowski, Sullivan, and Schatz have publicly defended the program, and the Native American Contractors Association is engaged. Legislative protection of tribal-specific authorities would change the trajectory of the current oversight wave significantly.

The third is the CMMC Phase 2 deadline on November 10, 2026. Defense-oriented tribal firms that have not yet engaged a C3PAO are running out of runway, and the assessor capacity gap means waiting until late summer is no longer a viable plan.  

How Unanet helps tribal GovCons operate under federal scrutiny

Audit readiness is fundamentally a disconnected-systems problem. The entity-owned 8(a) firms moving through the current review cycle with the least disruption are the ones with one trusted view of contracts, projects, labor, costs, indirect rates, and documentation—so they can produce three years of clean, consolidated, DCAA-ready financials without rebuilding the data in spreadsheets first.

Unanet ERP GovCon, part of Unanet for GovCon, is built for that reality. Tribal enterprises use it to run multi-entity project accounting across parent governments, holding companies, 8(a) subsidiaries, and joint ventures from a single platform. DCAA-ready timekeeping, direct-versus-indirect cost segregation, indirect rate calculations, incurred cost reporting, and full audit trails are built into everyday workflows rather than bolted on after a data call arrives. For Native-owned firms with defense contracts, Unanet’s FedRAMP-aligned cloud and CMMC-supporting architecture help reduce security and compliance scramble as CUI requirements move into contracts.

The result is the operating posture tribal CFOs and compliance leaders need now: the same numbers, the same documentation, and the same audit trail available every day, not just in the 30 days after a compliance letter arrives.

To go deeper, download the Tribal GovCon Compliance & Audit Readiness Guide and Audit-Readiness Toolkit. If your team is already preparing for a data call, CMMC assessment, or multi-entity audit response, schedule a GovCon Lifecycle Review and we’ll map your current structure, documentation gaps, and next steps across finance, contracts, and compliance.

Frequently asked questions

What is the 2026 Pentagon 8(a) review? On January 16, 2026, Defense Secretary Pete Hegseth, leading the rebranded Department of War, posted a video on X ordering a line-by-line review of every 8(a) sole-source contract above $20 million, with authority to examine smaller awards as well. He framed the program as “the oldest DEI program in the federal government” and said the review would assess whether contracts contribute to military readiness and whether 8(a) firms are performing the work themselves rather than passing it through to larger consulting firms. Federal News Network and HSToday have both covered the review framework in depth.

Why does the Pentagon review affect tribal contractors specifically? The Pentagon review affects tribal contractors because only entity-owned 8(a) firms can receive sole-source awards above $20 million. That category includes tribally owned companies, Alaska Native Corporations (ANCs), and Native Hawaiian Organizations (NHOs). Individually owned 8(a) firms cap at $5.5 million to $8.5 million for sole-source awards, while Congress raised the tribal sole-source ceiling to $100 million in 2020. As former GSA Administrator Emily Murphy noted, tribal entities are effectively the entire population of firms eligible for the awards now under review.

How many 8(a) firms have been suspended in 2026? Approximately 1,000 of the roughly 4,300 active 8(a) firms were suspended after the SBA’s January 5, 2026 data call. SBA Administrator Kelly Loeffler’s compliance letters required three years of financial records, payroll, bank statements, and subcontracting agreements, with the agency examining five areas: subcontracting limits, mentor-protégé performance, owner withdrawals, benefit distributions to Native communities, and indicators of fraud. The approval pipeline has frozen as well, with only 65 new 8(a) firms approved in 2025 versus more than 2,100 the prior year, and no new tribal entities approved since August 2025.

What should tribal CFOs prioritize right now? Five priorities are emerging across tribal contracting leaders. First, centralize financial data across all entities so three years of clean records can be produced from a single source of truth rather than reconciled from MIP, QuickBooks, and spreadsheets. Second, tighten direct-versus-indirect cost segregation and indirect rate discipline to defend against pass-through allegations. Third, maintain DCAA-compliant timekeeping with full audit trails and current ICE submissions. Fourth, engage a C3PAO now for CMMC Phase 2 readiness ahead of the November 10, 2026 deadline. Fifth, document community reinvestment to support the trust-and-treaty framing that NACA and Senate Indian Affairs leaders are using to defend the program.

Where can I learn more about preparing for these audits? The Tribal GovCon Compliance & Audit Readiness Guide walks through the full framework and includes a downloadable Audit-Readiness Toolkit with a 30-day audit response checklist, a document inventory template, an indirect rate calculation worksheet, and a CMMC Phase 2 self-assessment. Companion pieces in the Tribal GovCon series cover the 2026 SBA 8(a) audit, the 30-day compliance checklist, and CMMC Phase 2 readiness for tribal contractors.