Federal procurement regulations are the rules executive agencies follow when they buy goods and services, and the core rulebook is the Federal Acquisition Regulation (FAR), codified in Title 48 of the Code of Federal Regulations across 53 parts.1eCFR. 48 CFR 1.103 – Authority The FAR is issued and maintained jointly by the Secretary of Defense, the Administrator of General Services, and the NASA Administrator, and it sets uniform policies so contractors face broadly consistent rules no matter which agency issues the solicitation.2Acquisition.GOV. Federal Acquisition Regulations System Individual agencies can layer on supplements — the Defense Federal Acquisition Regulation Supplement (DFARS) is the most prominent — but a supplement cannot contradict the underlying FAR.3Acquisition.GOV. Defense Federal Acquisition Regulation Supplement
What follows is the working knowledge a contractor actually uses: how to become eligible, how awards get made, how you get paid, how you challenge a bad decision, and what compliance looks like after you win.
Register in SAM Before You Do Anything Else
You cannot receive a federal contract without an active registration in the System for Award Management at SAM.gov. Registration is free and produces a Unique Entity ID, which replaced the old DUNS number as the government’s primary contractor identifier.4SAM.gov. Entity Registration A full prime-contractor registration requires banking information, business size, and the NAICS codes covering your industry.
Two practical points get overlooked. First, activation can take up to 10 business days, so registering after you find a solicitation is often too late. Second, your registration expires 365 days after activation, and an expired record makes you ineligible for award.4SAM.gov. Entity Registration Put the renewal on a calendar.
How Award Decisions Get Made
Full and Open Competition
Federal law requires contracting officers to promote and provide for full and open competition when soliciting offers.5eCFR. 48 CFR 6.101 – Policy Agencies must publish solicitations broadly enough that any qualified firm can compete, with narrow exceptions for national security or documented sole-source situations. That is why active monitoring of solicitation databases outperforms relationship-only strategies.
Best Value
Lowest price does not automatically win. The FAR directs agencies to seek best value, which can mean weighing technical approach, past performance, and management capability against cost. Some solicitations use lowest-price-technically-acceptable, where price decides among proposals meeting the technical floor. Others use a tradeoff process, where stronger technical quality can justify a higher price. Read the evaluation section of a solicitation before you invest in a proposal; it tells you which game the agency is playing.
Contractor Responsibility
Even the highest-scoring proposal cannot receive award unless the contracting officer separately finds your firm “responsible.” The general standards require adequate financial resources, a satisfactory performance record, integrity and business ethics, the necessary organizational and technical capability, and the production equipment or facilities needed to perform.6Acquisition.GOV. 9.104-1 General Standards A new company with no track record is not automatically non-responsible on that ground alone, but shaky financials or a pattern of poor performance on prior contracts can sink you.
Contract Types and Buying Methods
The method the government uses turns largely on dollar value and how well the work can be defined upfront. The FAR runs from purchase-card buys at the low end to multibillion-dollar indefinite-delivery vehicles at the top.
Micro-Purchases
At or below $15,000, contracting officers can use a government purchase card without soliciting competitive quotes. The threshold rose from $10,000 effective October 1, 2025, and climbs to $25,000 for contingency operations and $40,000 for defense support missions.7Acquisition.GOV. Threshold Changes Micro-purchases are distributed equitably among qualified suppliers where possible, which makes them a realistic entry point for small firms.
Simplified Acquisition
Above the micro-purchase threshold and at or below the Simplified Acquisition Threshold (SAT), agencies use streamlined procedures that cut paperwork on both sides. The SAT rose from $250,000 to $350,000 effective October 1, 2025, and reaches up to $1 million for contingency contracts performed inside the United States and $2 million overseas.8Federal Register. Federal Acquisition Regulation – Inflation Adjustment of Acquisition-Related Thresholds
Fixed-Price
When the work can be clearly defined and priced with reasonable confidence, the government prefers fixed-price. Under a firm-fixed-price contract, you deliver for a set amount; overruns are yours, savings are yours. That is the default for well-defined commercial buys and construction.
Cost-Reimbursement
When requirements or performance uncertainties defeat accurate cost estimation, the FAR permits cost-reimbursement contracts. The government reimburses allowable costs, usually plus a fee. Your accounting system has to be adequate to track costs applicable to the contract, which typically means passing a Defense Contract Audit Agency (DCAA) review before award.9Acquisition.GOV. Subpart 16.3 – Cost-Reimbursement Contracts Research and development, prototyping, and complex services are the usual fits.
Time-and-Materials
Time-and-materials contracts pay fixed hourly labor rates plus actual material costs. A contracting officer can use T&M only when the extent or duration of the work cannot be estimated with enough accuracy for any other contract type, and must document in writing why nothing else works. Every T&M contract carries a ceiling price the contractor exceeds at its own risk, and the government must actively monitor performance because the structure gives the contractor no built-in efficiency incentive.10Acquisition.GOV. 16.601 Time-and-Materials Contracts
Indefinite-Delivery/Indefinite-Quantity
IDIQ contracts are among the most common vehicles in federal work. An IDIQ establishes a framework for an indefinite quantity of supplies or services, within stated minimum and maximum limits, over a fixed period; the government then issues task orders (services) or delivery orders (supplies) as needs arise.11Acquisition.GOV. Subpart 16.5 – Indefinite-Delivery Contracts The guaranteed minimum has to be more than nominal so the arrangement binds both sides, and the maximum should reflect a reasonable estimate from market research. Many large IDIQs use multiple awardees who then compete for individual orders. Winning an IDIQ gets you a seat at the table; it does not guarantee revenue.
GSA Multiple Award Schedule
The General Services Administration runs the Multiple Award Schedule (MAS) program, offering long-term governmentwide contracts with commercial firms at pre-negotiated volume discount pricing.12GSA. Multiple Award Schedule Federal, state, local, and tribal buyers can order from schedule holders without a full competitive procurement from scratch. Getting on schedule takes upfront work in pricing negotiations and ongoing reporting compliance, but it shortens the sales cycle substantially.
Small Business Set-Asides
The federal government has a standing goal of awarding at least 23% of prime contracting dollars to small businesses.13U.S. Small Business Administration. Biden-Harris Administration Awards Record-Breaking $183B Federal Contracts to Small Businesses Contracting officers reach that goal through set-asides that restrict competition to small firms. The core mechanism is the Rule of Two: a purchase is set aside for small businesses when the contracting officer has a reasonable expectation that at least two responsible small firms will submit offers at fair market prices. For purchases above the micro-purchase threshold and at or below the SAT, the set-aside is essentially automatic unless the contracting officer affirmatively determines two qualified small firms cannot be found.14Acquisition.GOV. FAR 19.502-2 – Total Small Business Set-Asides
Several targeted programs sit on top of the general set-aside:
- 8(a) Business Development, for small businesses owned by socially and economically disadvantaged individuals that have been in business at least two years.15U.S. Small Business Administration. 8(a) Business Development Program
- HUBZone, for businesses located in historically underutilized business zones.
- Service-Disabled Veteran-Owned Small Business (SDVOSB), for firms owned and controlled by service-disabled veterans.
- Women-Owned Small Business (WOSB), for women-owned firms in industries where they are underrepresented.
SBA Mentor-Protégé
The SBA Mentor-Protégé Program pairs an experienced firm with a smaller one for structured business development in areas like accounting, strategic planning, and procurement navigation, and it allows financial support through equity investments or loans. The competitive edge comes from joint ventures: a mentor and protégé can form a joint venture that qualifies as a small business for any small business contract as long as the protégé individually meets the size standard, and the JV can pursue set-asides across 8(a), SDVOSB, WOSB, and HUBZone.16U.S. Small Business Administration. SBA Mentor-Protege Program SBA reviews these relationships to make sure the mentoring produces real developmental gains rather than serving as a workaround for a large company to capture set-asides.
Getting Paid: Prompt Payment Rights
Under the Prompt Payment Act, an agency must pay a proper invoice within 30 days of receipt, or another date the contract specifies. Miss that deadline, and the agency owes interest automatically. You do not have to request it.17Acquisition.GOV. 32.907 Interest Penalties
Interest also runs when the government improperly takes a prompt-payment discount, accruing from the day after the discount period ended through the date payment actually happens. The one carve-out: no interest is owed when the delay stems from a genuine dispute over amount, contract compliance, or amounts properly withheld under the contract.17Acquisition.GOV. 32.907 Interest Penalties
Bid Protests
If a solicitation is flawed or an award decision looks improper, you have three forums to challenge it: the contracting agency, the Government Accountability Office (GAO), or the U.S. Court of Federal Claims (COFC).
Agency-level protests are fastest and least formal. They go to the contracting officer or a designated official, and higher-level independent review is available. Protests based on defects visible in the solicitation itself have to be filed before the proposal deadline. Otherwise, you generally have 10 days from when you knew or should have known the basis for protest.18Acquisition.GOV. 33.103 Protests to the Agency
The GAO is the most-used external forum and typically issues its recommendation within 100 days of filing, or 65 days under an express option.19Acquisition.GOV. Subpart 33.1 – Protests A GAO protest filed within the statutory window triggers an automatic stay: the contracting officer cannot authorize performance to begin, or must direct the contractor to stop work if performance has already started.20Office of the Law Revision Counsel. 31 USC 3553 – Review of Protests; Effect on Contracts That stay is what gives a disappointed bidder real leverage while the dispute plays out.
The COFC handles protests as formal litigation, with longer timelines and higher costs. Filing there does not trigger an automatic stay; a protester has to seek a preliminary injunction. The COFC is generally the choice for high-value protests with complex legal issues or where GAO relief would not be adequate.
Suspension and Debarment
Fraud, bribery, and serious contract violations can get a contractor suspended or debarred from all federal contracting. Suspension is temporary, lasting up to 12 months while the government investigates. Debarment has a fixed term that generally does not exceed three years, though the debarring official can extend it to protect the government’s interests.
The causes are broad. They include conviction or civil judgment for fraud connected to a public contract, antitrust violations, embezzlement, bribery, tax evasion, false statements, and willful failure to perform under a government contract. The list also reaches knowingly failing to disclose credible evidence of fraud or significant overpayments for up to three years after final payment, and delinquent federal taxes over $10,000.21Acquisition.GOV. 9.406-2 Causes for Debarment Debarment requires proof by a preponderance of the evidence; suspension needs only “adequate evidence,” reflecting its temporary nature.
The consequences can extend to affiliates and associated individuals. Excluded contractors appear in SAM.gov’s exclusion records, which contracting officers check before every award.
Audits After Award
Winning is where scrutiny begins. On cost-reimbursement and certain other contracts, the DCAA audits accounting systems, cost estimating systems, and material management practices for compliance with DFARS and contract terms.22Defense Contract Audit Agency. DCAA Contract Audit Manual Chapter 5 DCAA runs both pre-award reviews of your accounting system and post-award audits during performance. Agency Inspectors General separately investigate fraud, waste, and abuse across the contracting lifecycle. Audit rights are built into cost-type contracts and many fixed-price contracts, so clean, well-documented records are a contractual obligation rather than a nicety.
Cybersecurity: CMMC for Defense Contractors
Defense contractors handling government information face mandatory standards under the Cybersecurity Maturity Model Certification program, codified at 32 CFR Part 170.23eCFR. 32 CFR Part 170 – Cybersecurity Maturity Model Certification CMMC applies to DoD contracts above the micro-purchase threshold when the contractor’s systems process, store, or transmit federal contract information (FCI) or controlled unclassified information (CUI). Contracts exclusively for commercially available off-the-shelf items are exempt. Non-DoD procurement does not carry a CMMC requirement.
The program has three levels:
- Level 1: annual self-assessment covering basic safeguarding practices, for contractors handling only FCI.
- Level 2: NIST SP 800-171 compliance for contractors handling CUI, with either self-assessment or third-party assessment every three years, depending on the sensitivity of the information.
- Level 3: reserved for the most sensitive CUI, requiring all Level 2 controls plus 24 additional NIST SP 800-172 controls and a government-led assessment every three years.
Implementation is phased. Through November 10, 2026, Level 1 and Level 2 self-assessments will be required as a condition of award on new contracts that include a CMMC requirement. Starting November 10, 2026, DoD will add Level 2 third-party certification requirements to applicable contracts and may add Level 3 at its discretion. CMMC obligations flow down to subcontractors, so prime contractors are responsible for verifying that everyone in the supply chain holds the certification appropriate to the information shared.