THE BULWARK SIX™

A program health assessment is a structured, time-boxed diagnosis of whether a defense contract is actually on track — measured against the contract, not against the program team's own optimism. Done well, it answers one question with evidence: where is this contract exposed, in dollars and in schedule, and what has to happen in the next 90 days to fix it. Here is what a 30-day assessment examines, what it produces, and when to commission one.

This is general guidance, not legal advice. The point of the assessment is to surface risk while it is still cheap to fix — before it shows up in a cure notice or a CPARS rating.

What a program health assessment actually is

It is not an audit, and it is not a status briefing. It is an independent read on execution health across every dimension the government uses to judge you, performed by someone who has sat on the government side of that judgment. The deliverable is a quantified risk picture and a recovery plan with named owners — not a slide that says "yellow."

The discipline that separates a real assessment from a status update is independence. Program teams are structurally optimistic about their own programs; an outside assessor measures what is, against what the contract requires.

The dimensions a 30-day assessment examines

Cost and labor health

Actual labor burn reconciled to the bid model, by CLIN. Where the burn exceeds the model, the variance is isolated to a specific cause — scope creep, rework, an under-bid task, or attrition — and quantified in annual-burn dollars.

Schedule health

Milestone performance against the baseline, slipped deliverables, and — critically — whether a documented recovery plan exists for each slip. A slip without a plan is a performance finding, not just a schedule event.

Performance and quality

Deliverable acceptance, rework and defect rates, and whether the work product actually meets the statement of work as modified — not as the team remembers it.

CPARS trajectory

Where the rating is heading across Quality, Schedule, Cost Control, and Management, and whether the contractor has been building the contemporaneous evidence needed to support an above-Satisfactory narrative.

Compliance posture

FAR/DFARS clause compliance, flowdown integrity to subcontractors, and any gap between how the work is being executed and what the current contract and its modifications require.

The government relationship

Open COR concerns, surveillance trends, and unanswered government communications — the leading indicators that a contracting officer's confidence is eroding on the record.

What you get at the end

• A risk register in dollars and schedule — every finding with quantified cost and time impact, not a color-coded heat map.
• Root causes, isolated — problems traced to specific process failures rather than blamed on the workforce.
• A 90-day corrective action plan — named owners, milestone dates, and completion standards.
• A CPARS-ready narrative posture — the evidence base to protect the rating in the current period.

When to commission one

Commission a program health assessment when burn is outrunning the bid model with no clear cause, when milestones are slipping, when a CPARS rating is softening, when COR surveillance is increasing, or simply before a recompete where past performance will decide the award. Each of those is a moment when the gap between perceived and actual health is widest — and most expensive to discover late.

Agentic diagnosis is the use of AI agents to continuously watch a defense contract's performance signals and surface risk early — before a cure notice, a CPARS downgrade, or a margin breach makes the problem the government's to act on. It does not replace acquisition judgment; it accelerates the part that is slow and human-expensive: noticing, in time, that something has started to drift.

Here is how agentic diagnosis works in a federal contracting context, what it monitors, where the human stays firmly in the loop, and the guardrails that keep it responsible. This is general guidance, not legal advice.

Why continuous beats annual

Most contractors learn their program is in trouble at three moments: the annual CPARS evaluation, a government concern in writing, or a cure notice. All three are lagging indicators — by the time they arrive, the contract file already documents the problem. The signals that precede them, though, are visible months earlier in the data. The constraint has never been that the signals are hidden; it is that nobody has the bandwidth to watch all of them, all the time. That is exactly the gap agents fill.

What the agents watch

• Labor burn versus the bid model — flagging the moment actuals diverge from the staffing plan you priced, by CLIN.
• Schedule variance — milestone slippage and the absence of a documented recovery plan.
• Deliverable and quality signals — acceptance, rejection, and rework patterns trending the wrong way.
• CPARS trajectory inputs — the performance evidence (or its absence) that will drive the next rating narrative.
• Government engagement — rising surveillance activity and unanswered concerns that signal eroding confidence.

Where the human stays in the loop

Agents are good at watching and flagging. They are not the decision-maker. In Bulwark's model, every agent-surfaced finding is validated by a CFCM-credentialed acquisition professional who decides what it means, whether it is real, and what the contractor should do about it. The phrase to hold onto: agents do the watching; a credentialed advisor owns the judgment. A flag is a prompt for expert review, never an automated action against your contract.

The guardrails that make it responsible

No classified or controlled data into models

Classified information and CUI never go into general-purpose models. Agentic diagnosis works on the performance and contract-execution signals a contractor already holds, handled in appropriate environments.

Human validation before any conclusion

An agent flag is an input to expert analysis, not a finding on its own. Nothing reaches a client — or a contracting officer — without acquisition-professional review.

Evidence, not opinion

The output is the same standard a good human assessment produces: quantified exposure, isolated root cause, and a corrective action plan — now surfaced earlier because the watching never stopped.

The bottom line for contractors

The contractors who avoid default and protect their ratings are not the ones with no problems — they are the ones who see the problem first and document the plan before the government has to force one. Agentic diagnosis is how you make "seeing it first" a standing capability instead of a matter of luck.

A cure notice rarely arrives without warning. By the time a contracting officer issues one under FAR 49.607, the performance signals have usually been visible for one to three months — in the burn rate, the schedule, and the surveillance record. The contractors who avoid default are the ones who read those signals early and document a response before the government has to force one.

Below are the five indicators that most reliably precede a cure notice on DoD services and engineering contracts, why each one matters to a contracting officer, and what to do the moment you see it. This is general guidance, not legal advice — but it reflects how performance actually deteriorates on the contracts we've watched from the government side.

1. Labor burn exceeding the bid model with no documented cause

When your actual labor hours run ahead of the staffing model you priced — and nobody can explain why in writing — you have both a margin problem and a performance-narrative problem. The CO doesn't see your P&L, but they see deliverables slipping while your invoices climb. That pattern reads as a contractor that has lost control of its own execution.

What to do: reconcile actuals to the bid model by CLIN, isolate the variance to a specific cause (scope creep, rework, under-bid task, attrition), and write it down. A documented root cause you surfaced yourself is a fundamentally different conversation than one the government discovers.

2. Missed milestones without a recovery plan on file

A single slipped milestone is a schedule event. A slipped milestone with no documented recovery plan is a performance event. Contracting officers are trained to look for the plan — its absence is what converts a delay into a deficiency in the contract file.

What to do: for every slip, file a short recovery memo: the cause, the corrective action, the new completion date, and the responsible person. Even an imperfect plan submitted proactively changes how the slip is documented.

3. A CPARS trajectory bending toward Marginal

CPARS ratings move before cure notices do. A drift from Satisfactory toward Marginal in Quality, Schedule, or Management is the government telling you, on the record, that confidence is eroding. Under FAR 42.15 that record follows you into every future source selection.

What to do: treat a softening rating as the early-warning system it is. Reverse-engineer the QASP, build a contractor self-monitoring rhythm, and prepare your narrative input before the evaluation period closes — not after.

4. Increasing COR surveillance or unanswered government concerns

When the Contracting Officer's Representative starts asking more questions, requesting more documentation, or putting concerns in writing, the contract file is being built. Concerns that go unanswered don't disappear — they become the evidentiary basis for a cure notice or a negative rating.

What to do: answer every documented government concern in writing, on time, with evidence. Silence is the single most damaging response. A pattern of responsive, accountable communication is itself a defense.

5. A growing gap between operations and the actual contract requirements

On long contracts, teams drift toward how the work has always been done and away from what the SOW and its modifications actually require. The gap is invisible day to day — until an audit, an option exercise, or a recompete exposes it all at once.

What to do: periodically re-baseline operations against the current contract and every modification. A FAR/DFARS flowdown and requirements audit catches drift while it's still cheap to fix.

What a cure notice actually requires

If a cure notice does arrive, the response is structured: acknowledge each cited deficiency, provide a root-cause analysis, present a corrective action plan with specific dates and responsible persons, and demonstrate that every action completes within the cure period. It must be professional, accountable, and evidence-based. The worst responses are defensive or vague; the best ones read like a contractor that already had its arms around the problem.

You cannot rewrite a closed CPARS evaluation — but you can change the trajectory of the next one, and you have more influence over the current rating period than most contractors use. Improving a CPARS rating in 90 days comes down to three things: understanding exactly how you're scored, building evidence in real time, and submitting a contractor narrative that gives the assessing official a reason to rate you up.

Here is a 90-day approach to move a CPARS rating, organized by the time you have left in the period. This is general guidance under FAR 42.15, not legal advice.

How CPARS scoring actually works

CPARS evaluates performance across standard areas — typically Quality, Schedule, Cost Control (where applicable), Management, Small Business utilization, and sometimes Regulatory Compliance — on a five-level scale: Exceptional, Very Good, Satisfactory, Marginal, and Unsatisfactory. Two facts drive everything that follows:

• Ratings must be justified by narrative. An assessing official can't rate you Very Good or Exceptional without a documented basis. If the record is thin, the rating defaults toward Satisfactory regardless of how well you actually performed.
• You get to respond. Under FAR 42.1503, the contractor has 14 calendar days to review and comment on the evaluation. That window is leverage most contractors waste with a perfunctory "concur."

Days 1–30: Reverse-engineer the QASP and build the evidence file

Start from the Quality Assurance Surveillance Plan. It tells you the exact standards the government is measuring against. For each performance area, set up a simple evidence file and start capturing — on a weekly cadence — the specific facts that support an above-Satisfactory rating: on-time deliverables, defect rates, problems you surfaced and resolved before the government raised them, and value you added beyond the minimum.

The discipline here is contemporaneous documentation. Evidence assembled in real time is credible; evidence reconstructed at the end of the period is not, and assessing officials can tell the difference.

Days 30–60: Close the gaps the government can see

Whatever has been trending toward Marginal, address it visibly now. If schedule is the weak area, get a recovery plan on file and start hitting the revised dates. If management is the concern, tighten communication cadence and document it. The goal is to give the assessing official recent, concrete evidence of improvement that they can point to in the narrative — late-period improvement is exactly the kind of fact that supports a better rating.

Have the conversation early. Ask your COR what they're seeing, in a non-defensive way, before the evaluation is drafted. It is far easier to influence a rating before it's written than to dispute it after.

Days 60–90: Prepare your contractor narrative input

Don't wait for the evaluation to land. Draft your performance narrative now, mapped area by area to the QASP, with specific evidence behind every claim. When the evaluation arrives, you'll be comparing it to a case you've already built rather than scrambling inside the 14-day window.

If the rating undersells your performance, your comments should be factual and evidence-based — never emotional. Cite the deliverable, the date, the metric. A well-constructed contractor response can move a narrative, prompt a re-rating, or at minimum put your side of the record permanently in the file for the next source-selection board to see.

Why the rating period you're in decides the recompete you haven't bid yet

CPARS is past performance, and past performance is often the difference-maker in best-value source selection. A Marginal in this period doesn't just sting now — it sits in the record when you bid the follow-on, and when you bid adjacent work for the same agency. Protecting the rating is protecting pipeline.

Flowdown failures are one of the most common — and most avoidable — sources of compliance risk on defense subcontracts. When a prime fails to flow a required clause to a subcontractor, or flows the wrong version, the exposure runs in both directions: the prime can be in breach of its own contract, and the sub can be bound to obligations it never priced. This checklist walks the flowdown audit we run on prime/sub relationships.

This is general compliance guidance, not legal advice. Always validate specific clause applicability against your prime contract and current FAR/DFARS.

What "flowdown" means and why it bites

Flowdown clauses are provisions a prime contractor is required — or chooses — to pass to its subcontractors so that obligations imposed on the prime are enforced down the supply chain. Some are mandatory by regulation (for example, the clauses listed in FAR 52.244-6 for commercial products and services, and DFARS equivalents); others are prime-specific or program-specific. The risk is that flowdowns are often copied from the last subcontract template and never re-validated against the actual prime contract in hand.

The flowdown audit checklist

1. Start from the actual prime contract — not a template

Pull the executed prime contract and every modification. Flowdown obligations live in the prime's clauses and its incorporated provisions. A subcontract built from a generic template has no reliable relationship to what your specific prime contract requires.

2. Separate mandatory from discretionary flowdowns

Identify which clauses are required to be flowed by regulation, which are required by the prime contract's terms, and which the prime is choosing to flow for risk allocation. Mandatory flowdowns are non-negotiable; discretionary ones are where prime and sub actually have a conversation.

3. Validate clause versions and dates

FAR and DFARS clauses are revised. A flowdown that references a superseded clause version can create a gap between what the prime owes the government and what the sub owes the prime. Confirm each flowed clause matches the version incorporated in the prime contract.

4. Check the "appropriately modified" clauses

Some clauses flow down with substitutions — "Government" may become "Prime Contractor," disputes routes change, and timeframes adjust. Flowing these verbatim without the required modifications is a frequent error that makes the clause unworkable or unenforceable as written.

5. Confirm subcontractor-type applicability

Clause applicability turns on dollar thresholds, commercial-item status, small-business status, and the nature of the work. A clause mandatory on one subcontract may be inapplicable on another. Map applicability per subcontract rather than applying a blanket list.

6. Reconcile against socioeconomic and reporting obligations

Small-business subcontracting plans, reporting requirements, and socioeconomic certifications carry their own flowdown and tracking obligations. Confirm these are both flowed and actually being collected and reported — the obligation doesn't end at signature.

7. Document the flowdown matrix

Maintain a per-subcontract matrix: clause, source (mandatory/prime/discretionary), version, applicability basis, and modification notes. When a question arises — or an audit does — the matrix is your evidence that flowdown was deliberate, not accidental.

When to run a flowdown audit

Run the audit at subcontract formation, at every significant prime-contract modification, before exercising options, and any time you inherit a subcontract portfolio through award or teaming. Each of those is a moment when the gap between your template and your obligations is most likely to have opened.