To become a government subcontractor, register your company in SAM.gov, confirm your small business status under the NAICS codes you work in, meet the cybersecurity level the work requires, and get onto a defense prime’s approved supplier list before that prime bids the program. Primes need qualified small suppliers to meet the subcontracting goals they promise the government, and they can only award work to companies that clear their pre-award checks.
For most small and mid-size aerospace and defense manufacturers, a subcontract is the first federal work they win. The prime holds the contract with the Department of War, carries the program risk, and buys machined parts, assemblies, testing, or engineering from a supplier base it has already vetted. This guide covers why primes look for small subcontractors, what to have in place before the first conversation, where primes find suppliers, what they check before award, and what changes once a subcontract is signed. For the prime-side view of the bidding process, see our Winning GovCon Contracts in 2026 series.
Why do defense primes need small subcontractors?
Large primes owe the government a small business subcontracting plan on most sizable contracts. Under FAR 19.702, any negotiated contract expected to exceed $900,000 ($2 million for construction) that has subcontracting possibilities requires the apparently successful offeror to submit an acceptable plan. A company that cannot negotiate one with the contracting officer is ineligible for award. The threshold rose from $750,000 on October 1, 2025.
The plan sets goals for the share of subcontract dollars going to small businesses and to specific categories such as women-owned, HUBZone, and service-disabled veteran-owned firms. The Small Business Act treats a prime that fails to comply in good faith with its plan as being in material breach of the contract. Primes report progress against those goals in SAM.gov, which took over subcontract reporting from the retired eSRS system in February 2026.
This gives a qualified small supplier real standing in the conversation. A machine shop that meets the prime’s quality and security requirements helps the prime meet goals it has committed to in writing, and small business liaison officers at large primes spend much of their time looking for those suppliers.
What do you need in place before you contact a prime?
Primes screen suppliers early, and most of the screening happens before anyone discusses price. Five items should be ready before your first outreach.
- gov registration. An active registration gives your company a Unique Entity ID and a CAGE code, which primes use to vet suppliers and report subcontract awards. Registration is free.
- NAICS codes and size status. List every NAICS code that describes your work and confirm your company falls under the SBA size standard for each one. Your size representation decides whether a prime can count your subcontract toward its small business goals.
- Small Business Search profile. The SBA’s Small Business Search, which the overhauled FAR now references in place of the old Dynamic Small Business Search, is where many prime buyers look for small suppliers by capability and location. Fill in your capabilities, certifications, and past performance.
- Cybersecurity status. If you will receive Federal Contract Information or Controlled Unclassified Information, you need a CMMC assessment at the level the prime flows down, with results posted in the Supplier Performance Risk System (SPRS). Level 1 is met through an annual self-assessment.
- Capability statement. A one-page document listing your processes, equipment, certifications, NAICS codes, CAGE code, and two or three examples of relevant work. Tailor it to the programs a specific prime supports.
Where do defense primes find subcontractors?
Most large defense primes run an online supplier registration portal and a small business liaison office. Registering in the portal puts your company in the prime’s supplier database, and a direct conversation with the liaison officer moves it toward a sourcing decision. Liaison officers usually know which program teams need suppliers in a given commodity area.
APEX Accelerators, funded by the Department of War’s Office of Small Business Programs, offer free counseling on registration, solicitations, and supplier outreach. Many host matchmaking events that pair small firms with prime buyers. Prime-sponsored industry days and regional defense trade shows serve the same purpose.
The SBA’s SubNet database lets large primes post subcontracting opportunities for small businesses to browse. It is worth checking, with realistic expectations. Self-service posting was unavailable for much of 2026, and current listings lean toward construction and facilities trades. For machining, electronics, composites, and engineering work, the prime’s own portal and liaison office produce more leads.
What will a prime check before awarding you a subcontract?
Before award, a prime confirms that your company meets the requirements its own contract flows down to suppliers. The table below covers the checks most aerospace and defense suppliers will see.
| Requirement | What the prime confirms | Where it comes from |
|---|---|---|
| SAM.gov registration | An active registration with a Unique Entity ID and CAGE code | Prime supplier vetting and subcontract reporting in SAM.gov |
| Exclusion status | Your company is not suspended or debarred from federal contracting | SAM.gov exclusion records |
| Size status | A small business representation under the NAICS code for the work | The prime’s small business subcontracting plan (FAR 19.702) |
| CMMC status | A current CMMC assessment at the level the prime flows down, posted in SPRS (Level 1 is a self-assessment) | DFARS 252.204-7021 |
| NIST SP 800-171 | Security controls in place on systems that handle CUI, and cyber incident reporting within 72 hours | DFARS 252.204-7012 |
| Quality system | AS9100 or ISO 9001 certification where the purchase order requires it | The prime’s supplier quality requirements |
| Accounting and timekeeping | On cost-type and T&M work, a system that segregates costs by contract and supports every billed labor hour | Contract type and the prime’s flow-down audit rights |
The cybersecurity checks have changed the most over the past year. DFARS 252.204-7021 requires a prime to flow down the correct CMMC level and to confirm, before awarding the subcontract, that the supplier has a current CMMC status for the information involved. Subcontractors also complete an annual affirmation of continuing compliance.
The Department of War suspended CMMC Phase 2 on July 13, 2026, and a September 3 class deviation directed contracting officers to remove third-party assessment requirements from solicitations and contracts. As of October 2026, contracts can require CMMC Level 1 or Level 2 self-assessments, and the NIST SP 800-171 requirements under DFARS 252.204-7012 are unchanged. A supplier with no SPRS entry is still screened out.Â
Clause numbers have also shifted. Under a February 1, 2026 class deviation, DFARS 252.204-7019 was deleted and 252.204-7020 was renumbered 252.240-7997. FAR 52.204-21, the basic safeguarding clause, is now 52.240-93. Older contracts and many prime flow-down templates still show the legacy numbers, so expect to see both.
Should you join a mentor-protégé program?
A mentor-protégé agreement pairs a small business with an experienced contractor that provides structured help, such as building a quality system, improving manufacturing processes, or explaining federal contract regulations. Two programs matter most for defense suppliers.
The DoD Mentor-Protégé Program, made permanent by the FY2023 NDAA, connects small businesses with established defense contractors. Mentors receive either cost reimbursement or credit toward their small business subcontracting goals for the assistance they provide. To qualify as a protégé, a company must be small under the size standard for its primary NAICS code and fall into at least one category listed in DFARS Appendix I. Those categories include women-owned, HUBZone, and service-disabled veteran-owned firms, along with nontraditional defense contractors and companies that supply goods or services critical to the defense supplier base. The last two cover many small aerospace and defense manufacturers that have never held a prime contract. A company can participate for up to five years from its first agreement.
The SBA Mentor-Protégé Program is open to small businesses in any industry and lets a protégé form a joint venture with its mentor to compete for set-aside contracts. It suits companies that plan to bid as a prime later.
Under the DoD program, a mentor cannot require a protégé agreement as a condition of awarding a subcontract. A supplier can win work from a prime without joining either program.
What changes once you sign?
A signed subcontract brings the prime’s obligations down to your company. Flow-down clauses cover cybersecurity, export controls, quality requirements, and, on many programs, the government’s audit and records rights. The prime answers to the government for its suppliers’ performance, so expect quality audits, first-article inspections, and regular requests for documentation.
Contract type shapes what the prime needs from you. On a firm-fixed-price purchase order for parts, the prime cares about delivery, quality, and price. On a cost-reimbursable or time-and-materials subcontract, every labor hour you bill becomes part of the cost the prime passes to the government. Those hours need to be recorded daily against the correct contract and task, approved by a supervisor, and supported by records that hold up if the prime or government auditors review them. Suppliers taking on their first cost-type work should review their timekeeping and accounting practices before the first invoice goes out.
Frequently asked questions
Do I need to be a small business to be a government subcontractor?
No. Companies of any size can hold subcontracts. Small business status matters because primes on contracts above $900,000 set goals for the share of subcontract dollars going to small businesses, and only a small supplier’s awards count toward those goals.
Do subcontractors need to register in SAM.gov?
Most defense primes ask for it. An active SAM.gov registration gives your company a Unique Entity ID and a CAGE code, which primes use to vet suppliers and report subcontract awards. Registration is free.
Does CMMC apply to subcontractors?
Yes. DFARS 252.204-7021 requires primes to flow down the CMMC level that fits the information a subcontractor will handle and to confirm the subcontractor’s assessment status in SPRS before award. Level 1 is met through an annual self-assessment.
Can a subcontractor also bid as a prime contractor?
Yes. Many companies hold prime contracts and subcontracts at the same time. Subcontract work also builds the past performance that agencies review when they evaluate prime proposals.
Does a subcontractor need a DCAA-compliant accounting system?
It depends on the contract type. Firm-fixed-price purchase orders rarely call for one. Cost-reimbursable and time-and-materials subcontracts call for an accounting system that segregates costs by contract and supports every billed labor hour with timekeeping records, and a prime can ask for evidence of that system before award.
Getting ready for the first subcontract
A prime awards subcontracts to suppliers who already look like low-risk partners. For cost-type and T&M work, that includes labor records showing who worked on which contract, for how many hours, and who approved them. AutoTime Solutions provides DCAA-compliant timekeeping and labor tracking for aerospace and defense contractors. To see where your current timekeeping stands, take the 3-minute DCAA Timekeeping Compliance Assessment.
Cole Delaney
Director of Product & Partnerships