How Manufacturers Prepare to Bid on Government Contracts

A manufacturer is ready to bid on federal work when five things are in place: an active registration in the System for Award Management (SAM.gov), the correct industry codes and small business size status, a current cybersecurity self-assessment score for defense work, a documented quality system, and accounting and timekeeping practices that can hold up to a government review. Most of this work can start before a target solicitation exists. The accounting and timekeeping pieces take the longest to change, so they are worth starting early.

Federal buyers purchase machined parts, assemblies, fasteners, and finished equipment every day, and a large share of those purchases is set aside for small businesses. This guide covers the order of work for small and mid-size manufacturers whose first customer is likely to be the Department of War or one of its prime contractors. Civilian agencies such as the General Services Administration and the Department of Veterans Affairs use the same SAM.gov registration, industry codes, and size rules. The cybersecurity clauses described below are specific to defense contracts.

Where do first government contracts usually come from?

Most manufacturers win their first federal work through one of three routes. The first two are direct awards from an agency, and the third is a subcontract under a larger prime contractor.

1. Small direct purchases. Since October 1, 2025, the micro-purchase threshold has been $15,000 and the simplified acquisition threshold has been $350,000, after an inflation adjustment by the FAR Council (Pillsbury). Purchases under $15,000 can be made with a government purchase card without competitive quotes. Purchases up to $350,000 use simplified procedures, which usually means shorter solicitations and faster awards.
2. Small business set-asides. When a contracting officer expects fair-priced offers from two or more small businesses, the purchase is set aside for small business. This is called the Rule of Two. Purchases between the two thresholds are set aside whenever the Rule of Two is met (SmallGovCon), and the rewritten FAR Part 19 keeps the rule in place for larger purchases as well (Schwabe).
3. Subcontracts to prime contractors. Large primes buy components from smaller suppliers and report against small business subcontracting goals. A subcontract does not remove the federal requirements. Primes flow the same defense clauses down to their suppliers, including the cybersecurity requirements covered later in this guide.

Each route depends on the same preparation, so the steps below apply whichever route a manufacturer pursues first.

How do you register to do business with the government?

Every federal prime contractor needs an active entity registration in SAM.gov, the government’s free registration system. Registration produces two identifiers. The Unique Entity ID (UEI) is a 12-character identifier that SAM.gov issues when registration begins. The Commercial and Government Entity (CAGE) code is assigned by the Defense Logistics Agency while the registration is processed.

The registration follows six steps.

1. Create a Login.gov account for the person who will manage the registration.
2. Gather the legal business name, physical address, Employer Identification Number, and banking details for electronic payment. The name and address must match IRS records exactly.
3. Complete entity validation in SAM.gov to receive the UEI.
4. Complete the registration sections, including NAICS codes, size information, and the representations and certifications.
5. Submit the notarized letter that appoints the Entity Administrator, which most new registrations require.
6. Track the status until the registration is active, then add the renewal date to the company calendar.

SAM.gov advises that activation can take up to 10 business days, and validation problems extend that. A mismatch between the business name in SAM.gov and IRS records is the most common cause of delay. Registration must be renewed at least once every 12 months, and a lapsed registration makes a company ineligible for new awards.

Registration and renewal are free. Companies that email offers to complete SAM.gov registration for a fee are third-party services. Free help is available from the Federal Service Desk.

Which NAICS codes and size standard apply to your company?

North American Industry Classification System (NAICS) codes describe what a company makes, and every solicitation is assigned one NAICS code. That code sets the size standard used to decide whether a company counts as small for that purchase. Manufacturing size standards are based on the average number of employees and currently range from 500 to 1,500 employees, depending on the industry. 

Most manufacturers list one primary NAICS code and several secondary codes in SAM.gov. The codes should cover products the company can deliver today. A company can be small under one NAICS code and not small under another, so the size check is done code by code for each opportunity.

Companies that qualify can also pursue socioeconomic certifications, which open additional set-aside programs. These include the 8(a) Business Development program, HUBZone, Women-Owned Small Business, and Service-Disabled Veteran-Owned Small Business. Each program has its own eligibility rules, and a local APEX Accelerator counselor can help a company check which ones apply.

What cybersecurity is required before you can win defense work?

Defense contracts carry cybersecurity requirements that depend on the type of information a supplier receives. Federal Contract Information (FCI) is information provided by or generated for the government under a contract that is not intended for public release. Controlled Unclassified Information (CUI) is a more sensitive category that includes many of the technical drawings and specifications used in defense manufacturing.

Contracts that involve only FCI require basic safeguarding under FAR clause 52.204-21, which corresponds to the 15 requirements of CMMC Level 1. Contracts that involve CUI include DFARS clause 252.204-7012, which requires the contractor to implement the 110 security requirements in NIST SP 800-171 and to report cyber incidents to the Department within 72 hours.

DFARS 252.204-7019 adds a condition of award. An offeror required to implement NIST SP 800-171 must have a current assessment, no more than three years old, posted in the Supplier Performance Risk System (SPRS) (48 CFR 252.204-7019). For most small suppliers this is a Basic Assessment, which is a self-assessment scored under the DoD Assessment Methodology. Each requirement is worth 1, 3, or 5 points, and scores range from -203 to 110. A score below 110 can be posted along with a target date for completing the remaining requirements. The score needs to reflect the company’s actual controls, because an inflated self-assessment can lead to False Claims Act liability.

The Cybersecurity Maturity Model Certification (CMMC) program adds verification on top of these clauses. On July 13, 2026, the Department of War suspended CMMC Phase 2, which would have required third-party Level 2 certification for many contracts starting November 10, 2026 (Department of War). A September 3 class deviation made the suspension binding on contracting officers. Phase 1 remains in effect, so Level 1 and Level 2 self-assessments, annual affirmations, SPRS scores, DFARS 252.204-7012, and NIST SP 800-171 all still apply (implementing memo). As of early October 2026, no new start date for Phase 2 has been announced. Prime contractors can also set their own requirements for suppliers, and some continue to ask subcontractors to prepare for Level 2.

What quality and export controls do defense buyers expect?

Solicitations for manufactured items often name a quality standard. ISO 9001 is common for general supplies, and aerospace buyers frequently require AS9100. Buyers also expect lot traceability, certificates of conformance with shipments, and first article inspection when the contract calls for it. Companies that make items on the U.S. Munitions List must register with the State Department’s Directorate of Defense Trade Controls under the International Traffic in Arms Regulations (ITAR), even if they never export (Williams Mullen). Domestic sourcing rules, including the Buy American statute and the DFARS specialty metals clause, can also govern the materials a shop buys. 

Does your accounting system need to change?

The contract type determines how closely the government reviews a company’s accounting. Since July 15, 2026, fixed-price contracts have been the default and preferred contract type under the revised FAR Part 16, which implements Executive Order 14402 (FAR Council guidance). Agencies now need an approved justification before using most other contract types above set dollar thresholds. Many first awards to manufacturers will be firm-fixed-price product purchases, where the company is paid the agreed price on delivery.

Cost-reimbursable and time-and-materials contracts work differently. The government pays based on the costs and hours the contractor records, so the accounting system must be determined adequate before award. For a first cost-type award, this usually happens through a pre-award survey by the Defense Contract Audit Agency (DCAA), documented on Standard Form 1408 (SF 1408). DCAA reviews the design of the system and reports its findings to the contracting officer, who makes the award decision. DCAA publishes a pre-award accounting system checklist that follows the SF 1408 criteria.

The SF 1408 review looks at whether the accounting system can do five things.

1. Separate direct costs from indirect costs.
2. Identify unallowable costs, such as entertainment, and keep them out of amounts billed to the government.
3. Accumulate costs by contract and by job.
4. Record labor hours by contract through a timekeeping system with controls.
5. Post costs to the general ledger at least monthly and produce reliable financial reports.

Timekeeping is where commercial manufacturers usually need the most change. Many shops track hours by work order for costing purposes. A government review expects each employee to record their own time daily, to the correct contract or charge code, with supervisor approval and with any correction showing who made it and why. DCAA can also perform floor checks, where an auditor visits the shop, asks employees what they are working on, and compares the answer to that day’s time record.

Accurate labor records also help on fixed-price work. They support pricing for future bids and change orders, and they shorten the path to cost-type work when it comes.

How do you find opportunities and get help?

Federal opportunities above the micro-purchase threshold are posted on SAM.gov under Contract Opportunities. Sources sought notices and requests for information appear before a solicitation and show which agencies are planning purchases in a company’s NAICS codes. Responding to them introduces the company to the contracting office early. Each military service and defense agency also has an Office of Small Business Programs that can explain what it buys and how.

For direct help, APEX Accelerators provide free counseling on registration, certifications, bid preparation, and cybersecurity requirements. The program is funded through Department of War cooperative agreements (Office of Small Business Programs), and manufacturers can find their local office through the APEX Accelerator directory. Large primes also run supplier portals where small manufacturers can register their capabilities.

Preparing before the first bid

The readiness steps follow a set order: register in SAM.gov, confirm NAICS codes and size, complete the cybersecurity self-assessment, document the quality system, and set up accounting and timekeeping for the contract types the company expects to pursue. The checklist above summarizes each step.

AutoTime Solutions provides DCAA-compliant timekeeping for government contractors in aerospace and defense. Manufacturers preparing for a first cost-type bid can use the free three-minute DCAA Timekeeping Compliance Assessment to see where their current labor tracking process stands across six areas. The assessment rates each area as strong, moderate, or at risk, which gives finance and operations teams a starting list of changes to make before the first government review.