New to Government Contracting? 90-Day Compliance Checklist for IT Companies (2026)

SAM.gov registration is mandatory for any entity receiving federal contracts or grants. Start early because entity validation by the IRS and CAGE code assignment can take 2-3 weeks. You cannot bid on or receive a federal contract without an active SAM.gov registration.

The UEI replaced the DUNS number in April 2022. It is issued automatically during SAM.gov registration. You will need this identifier on every proposal, contract, and invoice.

The Commercial and Government Entity (CAGE) code is a five-character identifier assigned by DLA. If you plan to do any DoD work, a CAGE code is required. It is assigned automatically during SAM.gov registration for domestic entities.

For IT services, your primary code is likely 541512 (Computer Systems Design Services, $34M small business size standard). Also consider 541511 (Custom Computer Programming, $34M), 541513 (Computer Facilities Management, $34M), and 541519 (Other Computer Related Services, $34M). Your NAICS selection affects your small business size standard and set-aside eligibility.

SBA size standards for IT NAICS codes are based on average annual receipts over the prior 5 years. For 541512, the threshold is $34M. Self-certify in SAM.gov. Misrepresentation of size status is a federal offense under the Small Business Act.

Set-aside certifications dramatically increase your win rate. 8(a) requires social and economic disadvantage plus a 9-year program commitment. HUBZone requires principal office and 35% of employees in a qualified zone. SDVOSB requires 51% ownership by a service-disabled veteran. WOSB requires 51% ownership by one or more women.

Government accounting requirements demand clear separation between personal and business finances. A dedicated account simplifies audits, supports your indirect rate structure, and is a practical prerequisite for EFT payment registration on SAM.gov.

All federal payments are made via EFT. Enter your banking details during SAM.gov registration. This is mandatory before you can receive any contract payments.

Review your business structure (LLC, S-Corp, C-Corp) with counsel familiar with government contracting. Key considerations: organizational conflicts of interest, affiliates that affect size, and ownership structure. A contracting officer must determine you are "responsible" (financially and operationally capable) before awarding a contract.

Your accounting system must segregate direct from indirect costs, accumulate costs by contract, and comply with FAR Part 31 cost principles. For cost-reimbursement contracts, the system must meet DCAA adequacy standards (SF 1408). QuickBooks or Unanet with proper chart of accounts is common for small contractors. You do not need DCAA approval to bid on firm-fixed-price contracts, but you do need the structure.

At minimum, establish fringe, overhead, and G&A pools. A typical IT services structure: Fringe (25-40% of direct labor), Overhead (40-80% of direct labor), and G&A (10-25% of total cost input). These rates affect your pricing on every proposal. Provisional rates should be established and adjusted annually based on actuals.

Daily timekeeping is the single most audited area in government contracting. Requirements: employees must record time daily, corrections must show audit trail, time must be allocated to specific contracts or indirect pools, and supervisors must approve timesheets. DCAA expects total time accounting (all hours, not just billable). Tools like Unanet, Deltek Costpoint, or even properly configured Harvest can work.

Cost Accounting Standards (CAS) apply based on contract value. Below $7.5M in CAS-covered contracts: exempt. $7.5M-$50M: modified CAS coverage (CAS 401 and 402 only). Above $50M: full CAS coverage (all 19 standards). Most new small contractors are exempt, but you should understand the thresholds because they affect how you structure your cost accounting from day one.

This clause applies to virtually all federal contracts involving contractor information systems. The 15 controls cover: (i) limit access to authorized users, (ii) limit information system access to transaction types authorized, (iii) verify and control connections to external systems, (iv) control information posted on public systems, (v) identify information system users, (vi) authenticate users before access, (vii) sanitize or destroy media with FCI, (viii) limit physical access, (ix) escort visitors, (x) maintain audit logs, (xi) limit physical access to equipment, (xii) monitor and control communications at boundaries, (xiii) implement subnetworks for publicly accessible systems, (xiv) identify and report flaws timely, (xv) update malicious code protection.

Write down your security policies even if you only need the 15 basic controls. A documented security posture is expected in proposals and can be required during contract performance. If you plan to pursue DoD work later, having documented policies now makes the NIST 800-171 transition significantly easier.

Establish a filing system for contract documents, modifications, correspondence, invoices, deliverables, and performance records. FAR 4.803 lists what the government must keep; use it as a guide for your own records. You will need these files for audits, past performance references, and any disputes.

Most agencies require invoicing through the Invoice Processing Platform (IPP) or Wide Area Workflow (WAWF) for DoD. Learn the Prompt Payment Act rules: agencies must pay within 30 days of a proper invoice or the later of goods/services acceptance. Interest accrues on late payments. Improper invoices are a common cause of payment delays for new contractors.

A GSA Multiple Award Schedule contract gives agencies a streamlined way to buy from you. For IT services, apply under SIN 54151S. Requirements: 2 years in business, 3 past performance references (government or commercial), audited or reviewed financials, and competitive pricing. The application is extensive but the payoff is significant. Start the process now; expect 3-6 months to award.

A capability statement is the one-page "resume" for your company. Include: core competencies (2-3 specific services), differentiators, NAICS codes, contract vehicles, certifications (small business status, clearances), past performance summary, and contact information. This is what you hand to contracting officers and primes at industry days and networking events.

Past performance is typically the second most important evaluation factor after technical approach. If you have no government past performance, document relevant commercial work with similar scope, complexity, and dollar value. Register completed contracts in CPARS/PPIRS. Consider subcontracting to a prime on a small task to build an initial past performance record.

CMMC Level 1 (self-assessment, 15 controls from FAR 52.204-21) is required for all DoD contracts with FCI. CMMC Level 2 (110 NIST 800-171 controls, third-party assessment) is required for contracts involving CUI. The phased rollout began in 2025. Conduct a gap assessment now so you know the cost and timeline to achieve certification before bidding on DoD work.

If you are a large business (or small business bidding on a contract above $750K with subcontracting), you may need a subcontracting plan with goals for small, SDB, WOSB, HUBZone, SDVOSB, and VOSB subcontractors. For now, understand the requirement. As a small business, you are more likely to be named as a subcontractor in someone else's plan, which is a business development opportunity.

Many agencies maintain their own vendor portals beyond SAM.gov. Key ones for IT contractors: NASA SEWP (for IT products/services), CIO-SP3/CIO-SP4 (NIH/NITAAC for IT services), GSA eBuy (if you hold a GSA Schedule), and agency-specific small business offices. Register where your target agencies buy.

All federal opportunities above the micro-purchase threshold ($10K) are posted on SAM.gov (contract opportunities, formerly FBO). Set up saved searches for your NAICS codes and keywords. Consider paid tools like GovWin, Bloomberg Government, or Deltek for pipeline intelligence and early identification of opportunities before they hit SAM.gov.

PTACs provide free one-on-one counseling for new government contractors. They can review your SAM.gov registration, capability statement, and first proposal. Every state has at least one PTAC. This is the single highest-value free resource for new contractors.

Agencies hold pre-solicitation industry days, small business outreach events, and matchmaking sessions. These are your chance to meet contracting officers and program managers before opportunities are posted. Check agency OSDBU (Office of Small and Disadvantaged Business Utilization) websites for event calendars.

Create reusable boilerplate sections: company overview, management approach, quality control plan, relevant experience, key personnel resumes, and past performance narratives. Having templates ready means you can respond to opportunities within the typically tight proposal deadlines (often 14-30 days).