The federal contracting process is the regulated path a business follows to sell goods or services to the U.S. government: register your company, find a posted opportunity, submit a bid or proposal under the Federal Acquisition Regulation, and then perform the work under rules that govern everything from wages to cybersecurity. The FAR, codified in Title 48 of the Code of Federal Regulations, is the rulebook every federal buyer follows and every vendor has to understand.1Acquisition.GOV. Federal Acquisition Regulations System Individual agencies layer on their own supplements, most notably the Department of Defense’s DFARS, which adds military-specific requirements like cybersecurity and weapons-system rules on top of the core regulation.2Department of Defense. Defense Acquisition Regulations System – DFARS/PGI
The Competition in Contracting Act sits underneath all of it, requiring agencies to seek full and open competition whenever they buy.3Office of the Law Revision Counsel. 41 Code 3301 – Full and Open Competition Sole-source awards are the exception, not the rule, and each one requires a formal written justification approved inside the agency.4Acquisition.GOV. FAR Part 6 – Competition Requirements That competitive framework is what creates the opportunity for a new vendor to win.
Register Your Business Before You Bid
You cannot respond to a federal solicitation until several administrative steps are complete. The whole sequence takes weeks, and missing any piece will get an otherwise strong proposal thrown out.
NAICS Codes
Every business needs to identify its North American Industry Classification System codes, the six-digit numbers that categorize what you sell.5Acquisition.GOV. FAR 19.1 – Size Standards The SBA ties its small business size standards to these codes, so your NAICS code decides whether you count as “small” for a given procurement. Most manufacturers with 500 or fewer employees qualify, as do most non-manufacturing firms with average annual receipts under $7.5 million.6U.S. Small Business Administration. Basic Requirements Get the code right. It controls which set-asides you can see and whether your size status will hold up if challenged.
Unique Entity Identifier
You also need a Unique Entity Identifier, a 12-character alphanumeric code issued by the federal government at no cost.7General Services Administration. Implementing the Unique Entity ID The application requires you to verify your legal business name and physical address through official documents like tax records or incorporation papers.
SAM.gov Registration
The longest step is registering in the System for Award Management at SAM.gov.8SAM.gov. Entity Registration This centralized database stores your banking details for electronic payment, ownership information, size certifications, and a stack of Representations and Certifications where you confirm compliance with federal labor, environmental, and tax rules.
Your registration has to be active and fully processed before you can respond to any solicitation. Approval takes several weeks, longer if the government asks for additional identity verification. Renew it every year. A lapsed SAM registration is one of the most common and most avoidable reasons a bid gets rejected on a technicality.
Where Federal Opportunities Are Posted
All federal contract opportunities above a certain dollar threshold are posted publicly on SAM.gov. You can search by NAICS code or keyword and filter for active postings. Agencies use a sequence of notices: presolicitation notices signaling upcoming work, sources-sought notices asking whether capable firms exist, formal solicitations inviting bids or proposals, and award notices announcing the winner.
Experienced contractors watch presolicitation and sources-sought notices closely. Those early announcements are your chance to line up teaming partners, ask questions, and build a technical approach months before the formal Request for Proposal drops. By the time the RFP is public, the likely winners have already been preparing.
The GSA Multiple Award Schedule
The General Services Administration runs a parallel sales channel through its Multiple Award Schedule program. Schedule holders have pre-negotiated pricing with the government, so federal buyers can purchase directly without running a full competitive procurement every time.9General Services Administration. Multiple Award Schedule To get on a Schedule you submit an offer to GSA identifying the Special Item Numbers matching your products or services, along with pricing documentation and evidence of past commercial sales. Once awarded, your offerings are listed on GSA Advantage, and agencies can send Requests for Quotes directly to Schedule holders through the eBuy system.10GSA eBuy. eBuy
Small Business Certifications That Change Who Can Compete
The government sets annual goals for how much contracting goes to small businesses, and certain contracts are set aside entirely for certified firms. Large companies cannot compete for those at all.
8(a) Business Development Program
The 8(a) program is for small firms owned by socially and economically disadvantaged individuals. The business must be at least 51 percent owned and controlled by U.S. citizens who meet the SBA’s disadvantage criteria. The owner’s personal net worth must be under $850,000, and their adjusted gross income averaged over three years cannot exceed $400,000.11eCFR. Eligibility Requirements for Participation in the 8(a) Business Development Program The owner has to run daily operations and make long-term decisions. Firms admitted to the nine-year program can receive sole-source contracts and compete in 8(a) set-asides.
Service-Disabled Veteran-Owned Small Business
SDVOSB certification requires at least 51 percent ownership by one or more service-disabled veterans, registration in SAM.gov, and compliance with SBA size standards.12U.S. Small Business Administration. Veteran Small Business Certification Certified firms can compete for SDVOSB set-asides across all federal agencies.
HUBZone Program
The Historically Underutilized Business Zone program targets firms in economically distressed areas. Your principal office must sit inside a designated HUBZone, and at least 35 percent of your employees must live in one.13U.S. Small Business Administration. HUBZone Program The SBA publishes a map tool for checking whether a location and workforce qualify. That map is scheduled for updates throughout 2026 as designations expire and new ones are added.
Contract Types and Who Carries the Risk
Which contract type an agency uses depends on how well it can define the work in advance. The type determines who eats a cost overrun and how you get paid.
Fixed-Price Contracts
Under a firm-fixed-price contract, the government pays a set amount regardless of what the work actually costs.14Acquisition.GOV. FAR Subpart 16.2 – Fixed-Price Contracts You absorb any cost overruns and keep any savings. If you bid too low, you lose money. Agencies like these because they get cost certainty with minimal administrative overhead.
Cost-Reimbursement Contracts
Cost-reimbursement contracts flip the risk to the government, which pays all allowable costs plus a fee that functions as profit.15Acquisition.GOV. FAR Subpart 16.3 – Cost-Reimbursement Contracts These are used for research, development, and other work whose scope cannot be pinned down up front. Because the government is on the hook for costs, your accounting system has to withstand federal audit. Every cost-reimbursement contract also carries a cost ceiling you cannot exceed without the contracting officer’s approval.
Time-and-Materials Contracts
Time-and-materials contracts split the difference. The government pays fixed hourly labor rates that include wages, overhead, and profit, plus reimbursement for the actual cost of materials.16Acquisition.GOV. FAR 16.601 Time-and-Materials Contracts Each T&M contract includes a ceiling price the contractor exceeds at its own risk. Before raising the ceiling, the contracting officer has to analyze pricing and document why the increase serves the government’s interest. These are common for emergency repairs, IT support, and work whose duration or materials cannot be forecast.
Agencies can layer incentive provisions onto any of these types, rewarding contractors for beating cost targets, delivering early, or exceeding performance standards, or reducing fees when targets are missed. A cost-plus-incentive-fee contract, for example, sets a target cost and shares savings between the government and contractor at an agreed ratio.
How the Award Decision Gets Made
The path from solicitation to award depends on the complexity of what the agency is buying.
Sealed Bidding
For straightforward purchases, agencies use sealed bidding. The agency publishes an Invitation for Bids with rigid specifications, bidders submit sealed price proposals, and bids are opened publicly at a set time.17Acquisition.GOV. FAR Part 14 – Sealed Bidding The contract goes to the lowest-priced responsive, responsible bidder. No negotiations. No revisions. The evaluation is mathematical.
Negotiated Procurements
For complex work, agencies issue a Request for Proposals and evaluate on both technical merit and price. You submit separate technical and cost proposals, and the agency can hold discussions and request revised offers before deciding.18Acquisition.GOV. 48 CFR 15.101 – Best Value Continuum When technical risk is high, technical evaluation carries more weight than price. When the requirement is clear-cut, price dominates.
Some solicitations use a Lowest Price Technically Acceptable approach, awarding to the cheapest bidder who clears a minimum technical bar. Under LPTA, proposals are checked for acceptability but not ranked on technical quality, and no tradeoffs between price and technical merit are allowed.19Acquisition.GOV. 15.101-2 Lowest Price Technically Acceptable Source Selection Process For non-defense agencies, using LPTA requires the contracting officer to document why it fits, including a finding that the agency would gain little or no additional value from proposals exceeding the minimum requirements.
Evaluation and Debriefings
An evaluation board of technical experts and contracting officials scores each submission solely against the criteria in the solicitation. After the contracting officer makes the award, all offerors are notified. If you did not win, request a post-award debriefing in writing within three days of that notification; the agency should hold the debriefing within five days of the request.20Acquisition.GOV. 15.506 Postaward Debriefing of Offerors Request one every time. Debriefings show how evaluators saw your strengths and weaknesses, and that information is what makes the next proposal better.
Filing a Bid Protest
If you believe an agency made a procurement error, you can file a bid protest with the Government Accountability Office. Timing is strict. Protests must be filed within 10 calendar days after you knew or should have known the basis for the challenge.21eCFR. 4 CFR 21.2 – Time for Filing If you requested a debriefing, the 10-day clock starts on the date the debriefing is held rather than the date you learned the award result. Miss the deadline and the GAO dismisses the protest as untimely regardless of its merits.
A protest filed with the GAO triggers an automatic stay of contract performance in many cases, giving the agency time to reconsider. Agencies often take voluntary corrective action once they review the challenge rather than defending it through the full process.22U.S. GAO. Bid Protests – Key Features and Trends
Performing the Contract and Getting Paid
Winning is the start, not the finish. Performance, invoicing, and evaluation all follow their own procedures.
Who Has Authority
Two government officials oversee every contract. The Contracting Officer is the only person with legal authority to modify contract terms, authorize additional spending, or formally accept work. The Contracting Officer’s Representative monitors day-to-day progress and confirms that technical standards are being met. If anyone else in the program office tells you to change scope, that instruction means nothing unless the Contracting Officer confirms it in writing. Acting on unauthorized direction is your risk to eat.
Invoicing and Payment Timing
For Defense Department contracts, invoicing runs through Wide Area Workflow, an electronic system where contractors upload invoices for routing and approval.23Acquisition.GOV. DFARS 252.232-7006 – Wide Area WorkFlow Payment Instructions Each invoice must include the contract number, a description of the work performed, and the specific dates of performance. Any discrepancy against the contract terms triggers a rejection, and pushing a corrected invoice back through the system adds weeks to your payment.
The Prompt Payment Act requires the government to pay a proper invoice within 30 days of receipt or 30 days after acceptance of the work, whichever is later.24Acquisition.GOV. 48 CFR 52.232-25 – Prompt Payment Miss that window and the agency owes interest calculated under Office of Management and Budget regulations.25Acquisition.GOV. FAR Subpart 32.9 – Prompt Payment Federal policy also encourages accelerated payment to small business contractors, which can shorten the timeline. Perishable goods like meat, fish, and dairy have a shorter window still, at seven to ten days.
Past Performance Evaluations
After final payment, the government completes a performance evaluation in the Contractor Performance Assessment Reporting System. These evaluations cover technical quality, cost control, schedule adherence, management responsiveness, and small business subcontracting compliance.26Acquisition.GOV. 42.1503 Procedures You get to review the government’s ratings and submit comments concurring or disputing.27CPARS. CPARs The record follows you. Future evaluation boards use these ratings to gauge reliability, and a bad mark on one contract can weigh on proposals for years.
Compliance Obligations That Come With the Territory
Federal contractors carry regulatory obligations that reach well beyond the deliverable itself. Several of them catch experienced companies off guard.
Prevailing Wages
Federal construction contracts exceeding $2,000 trigger the Davis-Bacon Act, which requires paying workers at least the prevailing wage for their trade and location.28Office of the Law Revision Counsel. 40 USC Subtitle II, Part A, Chapter 31, Subchapter IV The Department of Labor publishes wage determinations by geographic area and construction type. Workers must be paid weekly, and every worker must be classified according to the actual work performed rather than whichever title is easiest for payroll.29SAM.gov. Wage Determinations
Service contracts carry a parallel obligation under the Service Contract Act. The Department of Labor issues wage determinations setting minimum hourly rates and fringe benefits for specific labor categories in each locality. If a labor category is not listed, the contractor submits a conformance request to establish an appropriate rate.
Miller Act Bonds
Federal construction contracts exceeding $100,000 require both a performance bond and a payment bond under the Miller Act.30Office of the Law Revision Counsel. 40 USC 3131 – Bonds of Contractors of Public Buildings or Works The performance bond protects the government if you fail to complete the work; the payment bond protects subcontractors and material suppliers by guaranteeing they get paid. Premiums typically run between one and three percent of contract value, and getting bonded means proving financial stability to a surety company. New contractors often find bonding capacity to be their biggest early barrier to larger construction projects.
Subcontracting Plans
Large businesses awarded contracts expected to exceed $900,000, or $2 million for construction, must submit a small business subcontracting plan showing how they will provide opportunities to small, disadvantaged, veteran-owned, and HUBZone businesses.31Acquisition.GOV. 19.702 Statutory Requirements Failure to make good-faith efforts toward those goals can affect your past performance rating and future competitiveness.
Cybersecurity for Defense Contractors
Defense contractors face rising cybersecurity certification requirements under the Cybersecurity Maturity Model Certification program, which began Phase 1 implementation in late 2025 and runs through November 2026.32Department of Defense CIO. About CMMC The program has three levels. Level 1 covers basic safeguarding with 15 security requirements and an annual self-assessment. Level 2 applies to contractors handling controlled unclassified information and requires meeting 110 requirements aligned with NIST SP 800-171, with either a self-assessment or a third-party assessment every three years. Level 3 adds 24 additional requirements and requires assessment by the Defense Contract Management Agency. Contractors at Level 2 who receive a Plan of Action and Milestones must close all identified gaps within 180 days. If your company touches defense-related information, knowing which CMMC level applies to your contracts is now part of doing the business.