FY2025 obligations by the NAICS code on the award
38% of the $1.6B obligated under DJ01 in FY2025 went to awards coded NAICS 541512.
- 541330 Engineering Services$144.9M
FY2025 federal contract obligations, USAspending.gov
PSC DJ01 is the federal cybersecurity services code, and it carries the sharpest exclusion in the D family. The manual scopes it as support for security policies and controls, compliance measurement against legal requirements including Section 508, breach response, continuous diagnostics and mitigation, vulnerability scanning, firewall management, intrusion prevention, security information and event management, and disaster recovery policy, failover facilities, and testing. FY2025 obligations were $1.61 billion.
What DJ01 is not
The manual states that implementation actions defined by compliance policy, giving multi-factor authentication rollout as its example, are not part of the compliance tower and belong to whichever tower performs the work: compute, storage, network, application, or end user. A vendor deploying MFA across an agency is doing DE01, DG01, or DA01 work, not DJ01. Note also that Section 508 accessibility compliance is inside the cybersecurity code, which surprises most people.
Where the money goes
Computer Systems Design Services (541512) took $617 million, Other Computer Related Services (541519) took $484 million, 541511 took $158 million, engineering services 541330 took $145 million, and Computer Facilities Management Services (541513) took $131 million.
The PSC names the requirement while the NAICS code names the industry of the work, which is why no cybersecurity-specific NAICS code appears in this top five: there isn't one.
PSC DJ01 FAQ
What does PSC DJ01 cover?
Security and compliance support labor: security policy and control support, compliance measurement including Section 508, breach response, continuous diagnostics and mitigation, vulnerability scanning, firewall and intrusion prevention management, SIEM operations, and disaster recovery planning and testing.
What NAICS codes win DJ01 work?
Computer Systems Design Services (541512) at $617 million and Other Computer Related Services (541519) at $484 million lead FY2025. There is no dedicated cybersecurity NAICS code, so contracting officers assign general IT services codes.
Is deploying a security control coded DJ01?
No. The manual pushes implementation actions out to the tower where the work happens. Rolling out multi-factor authentication is end user, network, or application work depending on where it lands.
Where does Section 508 compliance work get coded?
Inside DJ01. The manual names Section 508 among the legal and compliance requirements measured under the security and compliance tower.