Aranda & Co. / Who we work with

AI for small government and defense contractors

This page is for the owner of a government or defense contractor with 10 to 200 people: a capture lead, a proposal manager, a contracts administrator, project managers delivering on task orders, and someone who owns the system security plan on the side. You've probably been pitched by now. Proposal platforms promise a first draft in minutes and a higher win rate, carry a row of compliance badges that don't say which tier or hosting boundary they cover, show aggregate dollars won across all their customers, and put the price behind a demo. From the other side, compliance firms sell private AI as the safe version of the same thing.

We start smaller than either of those. We sit with the people who write, bid and deliver until we know where the hours go, and we draw the boundary around covered defense information before anyone pastes anything into a tool.

Book 20 minutes How it runs here

What owners ask us for

Proposal first drafts from your own library

We'd begin by cleaning and tagging your library of approved past-performance write-ups and boilerplate. Owners want a tool that reads the solicitation and drafts sections from past proposals, which is what most of the platforms sell, and when we set one up, a named reviewer traces every claim and citation back to a document before the section goes into the volume. We'd count reviewer hours per section and the unsupported claims caught before submission.

Requirements pulled into a compliance matrix

Section L, section M and the PWS get read by several people. Something still gets missed. A tool can extract the requirements into a matrix, and the capture lead checks it against the solicitation before anyone writes a sentence. The scorecard shows how long each matrix took to build and how many requirements color review caught that the matrix missed.

Opportunity search and go or no-go

Someone on your team spends part of every day reading notices on SAM.gov and agency feeds, and we'd start by tracking those hours each week. The platforms sell agents that score the pipeline for you. What we'd build is a filtered daily digest by NAICS, set-aside and agency, with a short note on each item. The owner still makes the call, and each decision gets recorded, so we can count how many bids that reached a decision came through the digest.

Keeping covered defense information inside the boundary

The first draft of this boundary is a written policy. It says what counts as covered defense information in your contracts and which tools may touch it, and it sets a check before any new tool is adopted. In most shops people already use a free chatbot, so the open question is what they've pasted into it so far. We'd note which tools are in use and whether every person has acknowledged the policy, and over time we'd count how many questions come to us before someone pastes instead of after.

Status reports and deliverables assembled from your systems

Monthly status reports, CDRLs and invoice backup get rebuilt by hand from timesheets, tickets and email every period. The draft can come together from the systems you already have. A project manager edits it and signs it. We'd judge it by the hours to close a reporting period and how many deliverables go out late.

Drafting help for the system security plan

We'd limit any drafting tool to the narrative, because several vendors now draft the system security plan and suggest a score, and that is where an owner can end up signing something nobody checked. Your IT lead gathers the evidence for each control, and the score comes from an assessment a person stands behind. We'd measure progress by how many controls have evidence attached against how many are only described.

How it runs here

AI assessment

In a contractor the assessment runs two to three weeks and starts with the people who bid and deliver: the capture lead, the proposal manager, the contracts administrator, the project managers on your largest task orders, and whoever owns the system security plan and the cyber score. We follow one recent bid from notice to submission and one recent reporting period from timesheet to invoice, and we ask where the nights and weekends went. On the data side we look at the proposal library as it stands, the pipeline spreadsheet, the deliverable calendar, the list of AI tools people already use and what has gone into them, and how covered defense information is marked and handled today. At the end you get your top five uses for AI ranked by payback and a 90-day plan with a shortlist of tools and builders, and the plan is yours whether or not we keep working together.

Weeks 1 to 3

The 90-day plan

The 90-day plan in a contractor almost always starts with the boundary: what counts as covered defense information, which tools may touch it, and a short AI-use policy everyone signs. Next comes the proposal library, because a drafting tool is only as good as what it draws from, and then one drafting or extraction workflow with a named reviewer and a log. The opportunity digest and reporting-period assembly usually follow once those hold. What gets left for later is anything that would put covered defense information into a new tool before the boundary is proven, agents that make go or no-go calls on their own, and vendor platforms whose attestation we haven't read in the contract.

Yours to keep

Fractional Chief AI Officer

Week to week the retainer is the scorecard: each priority, who owns it, when it's due, and whether it's on track, with a monthly leadership review. In a contractor a lot of the work is vendor and policy work. We read the FedRAMP claim for the tier and the hosting boundary it covers, get the retention and no-training terms into the contract, and ask the vendor to log which model, from which developer, touched which part of a deliverable so you can answer when a solicitation asks. We write the scopes for any outside builder, train the proposal staff on the review step that traces each citation before it goes out, and keep the AI-use policy current as new contracts bring new markings. When something slips you hear about it that week.

Monthly

What you get

Your top five uses for AI, ranked by payback
A 90-day plan with a shortlist of tools and builders
A plain-English AI-use policy that names the covered-information boundary
Written scopes for any outside builder we bring in
A one-page weekly scorecard with owner, due date and status
A monthly leadership review

Fixed fee for the assessment, agreed before we start. Monthly retainer after, if it fits.

Where it goes wrong

Invented citations get the whole protest thrown out

In September 2025 GAO dismissed three bid protests by a Las Vegas small business as an abuse of its process after the filings cited decisions that do not exist and misdescribed a real one. GAO wrote that the errors bear the hallmarks of the use of a large-language model or other artificial intelligence without adequate verification.

Source: GAO decision, Oready, LLC, B-423649 et al., September 25, 2025

Covered defense information in a consumer AI tool breaks DFARS 252.204-7012

The clause requires any external cloud service provider used to store, process or transmit covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline. It does not name AI tools. A free chatbot tier is an external cloud service, so covered defense information pasted into it has to meet that bar (our reading).

Source: DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (acquisition.gov)

A self-attested compliance score is a False Claims Act case if it is wrong

In June 2026 an Alabama defense contractor paid $507,144 to settle allegations that it knowingly submitted false claims on two Navy contracts while it had not implemented required NIST SP 800-171 controls; a government assessment scored it at -170 out of a possible 110. A product that drafts the system security plan and fills in the score does not change who signs.

Source: DOJ: Alabama defense contractor agrees to pay $507,144 to resolve False Claims Act liability relating to cybersecurity requirements

Questions to ask any vendor, including us

Show us how a reviewer traces every citation and past-performance claim in a generated section back to a document in our library.
Which tier and hosting boundary carries your FedRAMP status, is it Authorized, equivalent or in progress, and will you put the attestation in the contract?
Can your platform log which model, from which developer and country, touched which part of a deliverable, for when a solicitation asks?

Questions owners ask

can we use chatgpt for government proposals

It depends on what goes in. Solicitation text that is public and your own boilerplate are one thing; covered defense information under DFARS 252.204-7012 has to be stored with a cloud provider that meets the FedRAMP Moderate equivalent bar, and on our reading a free consumer tier doesn't. The first job is to write down which documents fall on which side, then pick tools for each side. Whatever the tool, a person traces every citation before it goes out.

is AI proposal software worth it for a small contractor

Sometimes, and the answer comes from your own numbers. We look at how many proposals you write a year, how many hours each takes, and how clean your library is, because the drafting tools are only as good as the past proposals they draw from. A messy library plus a fast tool can produce confident drafts with the wrong past performance in them. If the library needs work first, we say so and the platform waits.

what does a fractional chief ai officer cost

The assessment is a fixed fee, agreed in writing before any work starts, and it runs two to three weeks. If you want us to run the plan after that, the fractional Chief AI Officer retainer is monthly. We won't quote a number before the 20-minute call because the scope depends on how many people and contracts we need to cover. You'll have a written scope and the fee before you commit to anything.

do you write our proposals for us

No. We're not a proposal shop and we don't pretend to be your capture team. We set up the library, the drafting workflow and the review step so your proposal manager has a record of where every claim came from. If a build needs more hands than one, we bring in an outside builder on a written scope and test the work against that scope before it reaches your team.

do I have to tell the government I used AI on a proposal

Some solicitations and some agencies have started asking, and the clauses vary, so read each one. What makes the question easy to answer is a log of which tool touched which part of the deliverable, which is something we ask vendors for and set up on your side. Our view is that the signature on the proposal is yours either way, so the reviewer step matters more than the disclosure line.

is this cmmc or nist 800-171 compliance consulting

No. We're not a certified assessor and we don't score your controls. Our job is to keep the AI work inside the boundary your compliance people set, and to make sure nobody uses a drafting tool to fill in a score someone hasn't verified. If your system security plan needs real help, that is a separate engagement with a specialist, and we'll say so in the assessment.

Start with twenty minutes.

If there's a proposal or a reporting period eating your evenings, bring it to a 20-minute call. It ends with the one thing we'd look at first, or with the name of the kind of compliance assessor you need instead.

Book 20 minutes