I think in your case it’s reasonable. Also a $1.5M contract is likely chump change in that realm.

This particular case was in cybersecurity- specifically static analysis of assets, for the purpose of providing a SBOM.