Federal agencies, states, cities, counties and school districts can be large, reliable customers for a startup, but every one of them buys under its own rules. For federal work, register in SAM.gov, confirm you really qualify as a small business once your investors are counted, decide whether to sell directly or through a prime contractor, and read the IP and cybersecurity clauses closely. State and local work runs on each jurisdiction’s own procurement code, often through cooperative contracts, with standard terms you can’t negotiate away and public records laws that can expose your proposal. Classified work adds a facility security clearance, which turns on who owns and controls your company.
Key takeaways
- Register in SAM.gov before you bid on federal work, and on the supplier portal of each state or locality you’re targeting. SAM.gov registration is free, gives you a Unique Entity ID and must be renewed every year.
- Federal small business status is a self-certification. Count your affiliates, including investors with veto rights over ordinary business decisions, before you claim it.
- Cooperative contracts let one government buy from a contract another government already competed. Winning one, or selling through a reseller that holds one, can save you from bidding city by city.
- State and local contracts come on the government’s paper. Expect no indemnity from the government, its own governing law, termination if funding isn’t appropriated, and no room for your click-through terms.
- Proposals and contracts are generally public records. Mark trade secrets exactly the way the solicitation asks.
- Sell your product as a commercial item whenever you can, and mark every federal deliverable with the required legends. Report federally funded inventions on time, or you can lose IP rights.
- Security and accessibility requirements now show up in government deals at every level. Build for them early.
- Classified work needs a facility clearance, and foreign investors can slow or block it. Think about this before you take foreign money.
- Careless statements to the federal government can create False Claims Act liability of up to three times the government’s damages, plus penalties. Many states have their own false claims acts.
How does the federal government buy?
Federal agencies buy under the Federal Acquisition Regulation (FAR) and agency supplements such as the Defense Federal Acquisition Regulation Supplement (DFARS). The FAR is in the middle of a rewrite, the “Revolutionary FAR Overhaul,” which agencies have been applying through class deviations since mid-2025 while formal rulemaking continues. Read the clauses in the actual solicitation rather than assuming the old text applies.
Since October 1, 2025, agencies can buy up to $15,000 on a government purchase card (the micro-purchase threshold) and use simplified procedures up to $350,000 (the simplified acquisition threshold). Purchases between those two numbers are generally reserved for small businesses when at least two are expected to compete. Larger buys go through formal competitions or existing contract vehicles such as GSA schedules.
Startups usually get in through doors built for new technology: pilots, challenge-based buys, Commercial Solutions Openings, Other Transaction agreements for prototypes (which sit outside the FAR and can lead to follow-on production without a new competition), and SBIR and STTR research awards. The SBIR and STTR programs lapsed on October 1, 2025 and were reauthorized through September 30, 2031 by a law signed April 13, 2026. The new law adds foreign-risk screening of applicants and, starting in fiscal year 2027, limits on how many proposals one company can submit.
How do state and local governments buy?
Each state has its own procurement code, usually run by a central purchasing office for state agencies, and cities, counties, school districts, transit authorities and public universities often buy under rules of their own. Most follow the same pattern: small purchases with few formalities, informal quotes for mid-sized buys, and a formal request for proposals (RFP) or invitation to bid above a dollar threshold that each jurisdiction sets for itself. Register on the supplier portals of the states and localities you’re targeting, since that’s where solicitations are posted and how buyers find you.
Cooperative contracts are the shortcut many software startups use. A state, or a purchasing cooperative such as NASPO ValuePoint or Sourcewell, runs one competitive procurement, and other governments can buy from the resulting contract without running their own. This is often called piggybacking. Whether a particular agency can use a particular cooperative contract depends on its own state and local law, so ask the buyer before you count on it. If you don’t hold a cooperative contract yourself, a reseller that does can carry your product.
Budgets drive timing. Forty-six states start their fiscal year on July 1, and local governments and school districts set their own calendars, so a deal that misses the budget cycle can slip a year. Larger contracts may need approval at a public meeting, which adds weeks. Most states have prompt payment laws, but expect purchase orders, invoicing portals and several sign-offs before you’re paid.
Many states and cities run their own small business, minority-owned, women-owned and disadvantaged business certifications, and some contracts give a preference or set participation goals for certified firms. These programs are separate from federal SBA size status, and each has its own application.
Should we sell directly, as a subcontractor or through a contract vehicle?
| Route | How it works | Best for | Watch out for |
| Prime contractor | You contract directly with the agency | Control of scope, price and the customer relationship | The full compliance load: contract clauses, invoicing systems, audits |
| Subcontractor | You sell to a contractor already on the contract | Faster first revenue using the prime’s contract and back office | Flow-down clauses and less direct contact with the end user |
| Reseller | A government reseller lists your product on its contract vehicles | Off-the-shelf software and hardware | Reseller margin and the reseller’s flow-down terms |
| Cooperative contract | You win a contract that a state or purchasing cooperative opens to other governments | Selling the same product to many states, cities and school districts | A long first competition, and pricing and terms that apply to every buyer |
| R&D or prototype award (SBIR, STTR, Other Transaction) | A federal agency funds you to develop or prove out technology | Deep tech and dual-use companies | Data rights, invention reporting and eligibility rules |
Many startups begin as a subcontractor or through a reseller and bid directly once demand grows. Either way, read the flow-downs: a prime or reseller passes you the cybersecurity, data rights and labor clauses from its own contract.
Do we qualify as a small business?
For federal contracts, small business status opens set-aside contracts and makes you attractive to large primes with small business subcontracting goals. The Small Business Administration (SBA) sets a size standard for each industry (NAICS) code, measured by average annual receipts or by number of employees. Receipts are averaged over your last five completed fiscal years, or annualized over the time you’ve been in business if that’s shorter. Employees are averaged over the pay periods in the last 24 months. Today the standard for software publishers is $47 million in receipts and for custom computer programming $34 million. In August 2026 the SBA proposed an overhaul that would consolidate the standards, raise many of them and switch many industries, including software publishers, to employee-based standards; the current standards apply until a final rule takes effect.
The contracting officer assigns a NAICS code to each solicitation, and you must be small under that code, not just under your primary one.
The trap is affiliation. The SBA adds in the receipts or employees of every affiliate, and it treats anyone who owns 50% or more of your voting stock, or who has “negative control,” as controlling you. Negative control means the power to block ordinary actions. A minority investor whose vetoes cover only extraordinary matters, such as issuing new equity, a sale, a merger, dissolution or bankruptcy, generally isn’t an affiliate. A veto over the annual budget, hiring officers or signing contracts can make that investor, and companies it controls, your affiliates. Review your charter and investor agreements before you certify. See Protective Provisions.
Example. A software company has three completed fiscal years, with receipts of $3 million, $9 million and $24 million. Its annualized average is $12 million, well under the $47 million standard for software publishers. Now suppose a corporate investor with $500 million in annual revenue owns 35% of the company and holds a veto over its annual budget. The SBA may treat the investor as an affiliate, add its receipts, and the company is no longer small.
Nobody checks your size in advance. You certify it yourself, which is why a wrong certification is dangerous: it can support False Claims Act claims, suspension or debarment. Document how you reached your answer, update your SAM representations at least once a year, and recheck after any financing that changes ownership or investor rights. Set-asides for women-owned, service-disabled veteran-owned, HUBZone and 8(a) companies have their own eligibility rules on top of size. Under a 2025 executive order, many federal contracts now require contractors to certify that they don’t run DEI programs that violate federal anti-discrimination law. The requirement is being challenged in court, so check the clauses in your contract and have your employment policies reviewed before you sign.
What terms should we expect in a state or local contract?
Governments contract on their own paper, and many terms a commercial customer would negotiate are fixed by statute or policy.
Indemnity and liability. Many states and localities can’t indemnify a vendor, because an indemnity would commit money the legislature or council hasn’t appropriated. They will usually ask you to indemnify them and to carry specified insurance, and many resist caps on your liability, especially for data breaches and intellectual property claims.
Governing law and disputes. Expect the government’s own law, its own courts and limits on arbitration. Sovereign immunity can restrict how and where you can bring a claim, and some disputes must go through an administrative process first.
Funding and termination. Contracts usually include a non-appropriation clause, which ends the contract if funding isn’t approved for the next fiscal year, and a right to terminate for convenience. Price multi-year deals with that in mind.
Your standard terms. Agencies often can’t accept click-through terms, automatic renewals or open-ended price increases, and the government’s terms usually override anything in your order form or online terms. Read the order of precedence clause. Federal contracts work the same way: commercial license terms that conflict with federal law, such as indemnities and automatic renewals, don’t bind the government.
Public records. Proposals, contracts, pricing and correspondence are generally public records once the award is made, and sometimes sooner. Most solicitations explain how to mark trade secrets and confidential information and ask for a redacted copy. Follow those instructions exactly and assume anything unmarked can be released. A nondisclosure agreement doesn’t override a public records law.
Ethics and contact rules. During an open solicitation, many governments bar vendors from discussing it with anyone other than the named procurement officer. Gift limits, lobbying registration and, in some places, limits on political contributions by contractors also apply. Learn the rules before your sales team reaches out.
What IP rights does the government get?
For federal contracts, it depends on whether you’re delivering a commercial product or developing something new with government money.
Commercial products and software. When you sell a commercial item, the government generally takes the rights in your standard commercial license, except for terms that conflict with federal law, such as open-ended indemnities or a state governing-law clause. When the facts support it, positioning your product as commercial is usually your most important IP decision.
Noncommercial data and software. For development work, DoD clauses sort rights into categories: unlimited rights, government purpose rights, and limited or restricted rights for items developed entirely at private expense. You keep the narrower categories only if you assert them in your proposal and mark every deliverable with the exact legend the clause requires. Unmarked deliverables can be treated as delivered with unlimited rights. Negotiate what you must deliver (object code rather than source, interface documents rather than full design files), and keep records showing which work you paid for yourself.
SBIR data. Under current DoD rules, data generated under an SBIR or STTR award is protected for 20 years from the award, after which the government generally receives government purpose rights.
Inventions. Under the Bayh-Dole framework, a small business can keep title to inventions made with federal funding, but the government gets a nonexclusive, paid-up, worldwide license, and you must meet three deadlines: disclose the invention to the agency within two months after the inventor discloses it to you in writing, elect title within two years of that disclosure, and file a patent application within one year after electing title. Miss them and the government can take title. Your CIIAAs should require prompt written disclosure of inventions. See Who Owns Startup IP?.
State and local contracts. Most state and local buyers license software the way any customer does, but custom development contracts often say the government owns the deliverables. Carve out your pre-existing platform, tools and general improvements, and license rather than assign anything you plan to reuse.
What cybersecurity and accessibility rules apply?
Any federal contract involving federal contract information carries basic safeguarding requirements. DoD contracts involving controlled unclassified information (CUI) require the NIST SP 800-171 controls. DoD’s CMMC program began appearing in contracts on November 10, 2025 and is phasing in. Through November 9, 2026, solicitations may require a Level 1 or Level 2 self-assessment. From November 10, 2026, many will require a Level 2 certification from an accredited third-party assessor. Cloud services that handle federal data usually need FedRAMP authorization. A senior official affirms compliance, and a false affirmation is another source of False Claims Act risk. If DoD is your target, build your systems for CUI from the start. Retrofitting costs more. See Data Breach Response for Startups.
State and local buyers set their own security requirements. Many accept or require GovRAMP (formerly StateRAMP) verification for cloud products, Texas state agencies require TX-RAMP certification, systems that handle criminal justice data must meet the FBI’s CJIS Security Policy, and school districts commonly require a student data privacy agreement under state student privacy laws. Expect a security questionnaire either way.
Accessibility now matters in every government deal. Federal agencies buy under Section 508, which requires accessible technology, and usually ask for an accessibility conformance report. A 2024 Justice Department rule requires state and local governments’ websites, apps and online content, including content provided through vendors, to meet WCAG 2.1 Level AA. After an April 2026 extension, the deadline is April 26, 2027 for governments serving 50,000 or more people and April 26, 2028 for smaller governments and special districts. Governments are writing the standard into their contracts, so build it into your product now.
What does a security clearance involve?
Classified work requires a facility security clearance (FCL) from the Defense Counterintelligence and Security Agency (DCSA). You can’t apply on your own. An agency or a cleared prime must sponsor you for a specific contract that requires access to classified information, shown by a DD Form 254. You’ll need a facility security officer, key management personnel (including your senior officer) cleared at the facility’s level, organized corporate records, a full ownership chart and a completed Certificate Pertaining to Foreign Interests (SF 328). Processing typically takes months.
Foreign ownership, control or influence (FOCI) is the biggest variable. A foreign investor with a board seat or a large stake, or significant foreign debt, can require a mitigation agreement that adds months and governance limits. Foreign investment in companies working with critical technologies can also require a CFIUS filing. If classified work is in your plan, think about FOCI before every round: who holds board seats, what information rights foreign investors get, and whether government work belongs in a separate subsidiary. See 6 Types of Investors in Startups.
What should we do first?
- Pick your first market: one federal agency, one state, or a group of cities or school districts. Each has its own buying process.
- Register in SAM.gov for federal work, get your Unique Entity ID and CAGE code, and calendar the annual renewal. Register on the supplier portals of the states and localities you’re targeting.
- For federal work, choose your NAICS codes and run a size and affiliation check against your cap table and investor agreements.
- Decide whether your first deal will be direct, as a subcontractor, through a reseller or through a cooperative contract.
- Decide what you’re selling as commercial and what you’ll develop, and document which IP you funded privately.
- Set up an invention disclosure process tied to federal award numbers.
- Map your security program to the standard your buyers use (NIST SP 800-171 for DoD, GovRAMP or a state program for states), and have an accessibility conformance report ready.
- Prepare a redacted copy of every proposal that protects your trade secrets.
- Have counsel review the contract, the clause list and any flow-downs before you sign.
Investors will ask what rights the government holds in your technology during due diligence, and your IP strategy has to account for deliverables and inventions. For the commercial terms, see How Do I Negotiate Customer Contracts as a Startup?.
If you’re weighing your first government contract, contact us. We’ll review the deal and bring in government contracts counsel when the work calls for it.
