Defense procurement is how the Department of Defense buys the goods and services it needs, from fighter jets to janitorial contracts, under a body of federal rules designed to force competition, control cost, and protect the taxpayer. In fiscal year 2024, DoD obligated roughly $445 billion on contracts alone, more than every other federal agency combined.1EveryCRSReport. Defense Primer: Department of Defense Contractors That money flows to primes and to small shops several tiers deep in the supply chain, but only if you know the rulebook, pick the right lane, and stay compliant once you win.
The Rules You Are Agreeing To
Every federal purchase runs on Title 48 of the Code of Federal Regulations, which houses the Federal Acquisition Regulation. The FAR sets the baseline: how solicitations are written, how offers are evaluated, how disputes get resolved.2eCFR. Title 48 of the CFR – Federal Acquisition Regulations System DoD layers military-specific requirements on top through the Defense Federal Acquisition Regulation Supplement (DFARS), which addresses items the civilian FAR does not, including cybersecurity protocols, specialty metals sourcing, and counterfeit parts prevention.3eCFR. 48 CFR Part 201 – Federal Acquisition Regulations System
Violating either regulation carries real consequences. A contractor can lose an active contract, face suspension from new awards, or be debarred from federal work for a period that generally caps at three years but can stretch to five in drug-free workplace cases.4Acquisition.GOV. Federal Acquisition Regulation 9.406-4 – Period of Debarment
The obligation does not stop at the prime. Prime contractors must “flow down” applicable FAR and DFARS clauses into their subcontracts, in writing.5Defense Acquisition Regulations System. DFARS 252.244-7000 – Subcontracts for Commercial Products or Commercial Services The small machine shop three tiers deep still lives under federal rules on labor, cybersecurity, and financial transparency. Primes that fail to police flowdown risk having their purchasing system disapproved, which can halt new awards entirely.
Domestic Sourcing
Two overlapping laws push DoD toward American suppliers. The Buy American Act applies across federal procurement, requiring that articles, materials, and supplies be mined, produced, or manufactured in the United States, subject to exceptions. The Berry Amendment goes further for defense-specific categories: food, clothing, textiles, tents, hand and measuring tools, stainless steel flatware, dinnerware, and U.S. flags must be domestically grown or produced when purchased with DoD funds.6Office of the Law Revision Counsel. 10 USC 4862 – Requirement to Buy Certain Articles From American Sources Sourcing a covered item overseas can end the contract and open the door to fraud liability.
How DoD Actually Buys Things
DoD does not buy everything the same way. The method depends on how clearly the requirement can be defined, how much competition exists, and how urgently the item is needed. Knowing which method a solicitation uses tells you what the government cares about and how your proposal will be judged.
Sealed Bidding
Sealed bidding is the most rigid and transparent option. The government publishes detailed specifications, bidders submit locked proposals, and those proposals are opened publicly. The award goes to the lowest-priced responsible bidder whose offer meets every requirement. No negotiation. No consideration of factors beyond price and price-related criteria.7eCFR. 48 CFR Part 14 – Sealed Bidding Sealed bidding fits commodity purchases where the specs leave little room for interpretation.
Negotiated Procurement
When the government needs to weigh more than price, it issues a Request for Proposals and evaluates on a “best value” basis. Evaluators score technical approach, past performance, management capability, and cost. The less defined the requirement, the more weight technical factors carry against price.8Acquisition.GOV. FAR Part 15 – Contracting by Negotiation This is the dominant method for complex work: weapons systems, software, research programs. The government routinely pays more for a stronger solution or a better track record.
Sole Source Awards
Competition is the default, but a contracting officer can bypass it by preparing a written Justification and Approval. Federal law limits sole source awards to seven specific situations, including when only one source can supply the item, when an urgent need would cause serious harm if delayed, when industrial mobilization requires maintaining a specific supplier, or when broader competition would compromise national security.9Office of the Law Revision Counsel. 10 USC 3204 – Procedures Other Than Competitive Procedures The justification becomes part of the public record.
IDIQ Contracts
Indefinite-delivery, indefinite-quantity contracts are the workhorse of modern defense procurement. Instead of a single fixed-scope award, the government awards one or more IDIQ contracts that set a ceiling value and a guaranteed minimum, then issues task orders as needs arise. The solicitation must specify both a minimum quantity, which must be more than nominal, and a reasonable maximum.10Acquisition.GOV. Indefinite-Quantity Contracts
When multiple companies hold the same IDIQ, the contracting officer must give each awardee a fair opportunity to compete for every task order above the micro-purchase threshold, with exceptions for urgent needs, highly specialized requirements, and logical follow-ons.11Acquisition.GOV. FAR 16.505 – Ordering IDIQs dominate IT services, professional support, and logistics because the government can scale work without rebidding the whole requirement.
Other Transaction Authority
For prototyping and cutting-edge technology, DoD can step outside the FAR entirely using Other Transaction Authority. OTs are not traditional contracts, grants, or cooperative agreements. They let the government use commercial business practices, waive cost accounting system requirements, and negotiate flexible intellectual property terms to attract firms that would otherwise refuse to work under the standard regulatory burden.12Office of the Law Revision Counsel. 10 USC 4022 – Authority to Carry Out Prototype Projects OTs have grown fast because they move quickly and reach nontraditional defense firms that the FAR system struggles to bring in.
How You Get Paid
The payment structure decides who carries the financial risk. The government matches the structure to how much uncertainty is baked into the work.
Fixed-Price Contracts
Under a fixed-price contract, the government pays a set amount regardless of what the work actually costs. Come in under budget, keep the difference. Overrun, absorb the loss. The FAR pushes agencies toward fixed-price whenever the scope is well-defined and cost risk is low, because the incentive to control cost is built into the structure and government oversight can be lighter.
Cost-Reimbursement Contracts
When the scope or costs cannot be pinned down, the government uses cost-reimbursement contracts. The contractor bills allowable, allocable, and reasonable costs as work progresses and earns a fee on top. Federal law caps that fee. On research and development work under a cost-plus-fixed-fee arrangement, the fee cannot exceed 15 percent of estimated costs; on other cost-plus-fixed-fee contracts, it cannot exceed 10 percent.13Acquisition.GOV. Federal Acquisition Regulation 15.404-4 – Profit
Risk shifts to the government, and oversight follows. The Defense Contract Audit Agency examines contractor accounting systems, cost estimating systems, and material management practices to confirm billed costs are legitimate.14Defense Contract Audit Agency. DCAA Contract Audit Manual Chapter 4 – General Audit Requirements Contractors pursuing cost-reimbursement work need an approved accounting system that can segregate costs by contract, track labor hours, and produce documentation for incurred cost audits. A disapproved accounting system is a dealbreaker.
Registering to Compete
Before you bid on anything, you have to be visible in the government’s vendor systems. Miss a step and you cannot receive awards or, in some cases, payments.
System for Award Management
SAM registration is mandatory. You provide your legal business name, physical address, taxpayer identification number, banking information for electronic funds transfers, and the North American Industry Classification System codes describing your services. SAM issues you a Unique Entity ID, which becomes your primary identifier across federal contracting.15SAM.gov. Entity Registration You also receive a Commercial and Government Entity (CAGE) code, a five-character alphanumeric identifier used for facility recognition and payment processing.16Defense Logistics Agency. CAGE Code (Commercial and Government Entity Code) Renew annually. A lapsed registration blocks new awards.
Cybersecurity Maturity Model Certification
Many defense contracts now require a specific level of cybersecurity certification under the CMMC program. Contractors and subcontractors handling Controlled Unclassified Information must demonstrate compliance with the 110 security requirements in NIST SP 800-171 Revision 2 to achieve CMMC Level 2.17Department of Defense Chief Information Officer. About CMMC Depending on the solicitation, Level 2 compliance may be verified by self-assessment or by an authorized third-party assessment organization, with reassessment every three years and annual affirmation.
Plans of action and milestones are permitted on a limited basis at Level 2, but any open items must be closed within 180 days of conditional status. Firms new to defense work routinely underestimate the effort. Getting technical controls in place, documenting policies, and scheduling a third-party assessment can take six months to a year.
Small Business Preferences
The federal government targets awarding at least 23 percent of prime contract dollars to small businesses.18U.S. Small Business Administration. Record-Breaking $183B Federal Contracts to Small Businesses Contracting officers must set aside acquisitions for small businesses whenever they reasonably expect at least two capable small firms will submit competitive offers at fair market prices.19Acquisition.GOV. Subpart 19.5 – Small Business Total Set-Asides, Partial Set-Asides, and Reserves For acquisitions above the micro-purchase threshold and at or below the simplified acquisition threshold of $350,000, set-aside is the default unless the contracting officer determines two qualified small firms are unlikely to bid.20Acquisition.GOV. Threshold Changes – October 1st, 2025
Whether you qualify as “small” depends on your industry. SBA publishes size standards for each NAICS code, expressed as a maximum number of employees or maximum average annual receipts over the most recent five completed fiscal years. Part-time and temporary employees count the same as full-time, and SBA aggregates the receipts and employees of affiliated companies.21eCFR. Small Business Size Regulations A company that looks small on its own may exceed the threshold once affiliates are counted.
The 8(a) Program and Related Preferences
The 8(a) Business Development Program is the most prominent socioeconomic preference. To qualify, a business must be at least 51 percent owned and controlled by U.S. citizens who are socially and economically disadvantaged, with individual owners meeting personal net worth, income, and asset limits. Certification lasts nine years (a four-year developmental stage followed by a five-year transitional stage), and an individual can only participate once.22U.S. Small Business Administration. 8(a) Business Development Program
The advantage is significant. The government can award sole-source contracts to 8(a) participants up to $7 million for manufacturing work and $4.5 million for all other acquisitions with no competition at all. For DoD sole-source 8(a) awards exceeding $100 million, a formal justification is required; other agencies hit that trigger at $25 million.22U.S. Small Business Administration. 8(a) Business Development Program HUBZone firms located in historically underutilized areas and service-disabled veteran-owned small businesses have their own certification requirements and sole-source thresholds.
The Bidding and Selection Process
With registration done, work is pursued through a structured sequence. Solicitations post on SAM.gov (formerly FedBizOpps), and proposals go in through secure portals like the Procurement Integrated Enterprise Environment.23Procurement Integrated Enterprise Environment. PIEE Frequently Asked Questions Some agencies use GSA eBuy for schedule purchases. What follows the submission depends on whether the procurement uses sealed bidding or negotiated procedures.
Evaluation and Competitive Range
In negotiated procurements, the government runs parallel technical and price evaluations. Technical evaluators score proposals against the criteria published in the solicitation, looking at approach, staffing plan, relevant experience, and past performance. Price evaluators assess whether proposed costs are realistic and consistent with the technical approach. Evaluators cannot apply undisclosed criteria, and they must treat all offerors consistently. Crediting one firm with a strength for a feature while ignoring the same feature in a competitor’s proposal is one of the most common grounds for a successful protest.24U.S. Government Accountability Office (GAO). Bid Protests: A Guide for Interested Parties
If the agency holds discussions rather than awarding on initial proposals, it establishes a competitive range of the most highly rated offerors. Those in the range receive feedback on weaknesses and deficiencies and can submit revised proposals. Discussions must be meaningful; agencies cannot mislead an offeror about a weakness or hide a deficiency the offeror could correct. After final revisions, the source selection authority makes the award decision and issues a formal notice. Unsuccessful firms can request a debriefing.
What It Costs to Compete
Pursuing defense contracts is not free, and new entrants routinely underestimate the investment. Proposal preparation for a complex solicitation can consume weeks of staff time, and many firms hire consultants or capture managers. DCAA-compliant accounting services, needed for cost-reimbursement work, run in the range of a few thousand dollars per month. Add CMMC and the barrier to entry is real before you submit your first proposal. Budget for these expenses as a cost of doing business.
Who Owns What You Build
Technical data and software rights are among the most consequential and misunderstood parts of defense procurement. The answer depends on how the work was funded, and getting it wrong can cost a company its competitive edge or cost the government billions in lock-in.
When the government pays for development, it receives unlimited rights: use, modify, reproduce, and disclose the data for any purpose, including sharing it with other contractors. When a contractor funds development entirely with its own money, the government receives only limited rights, meaning it can use the data internally but cannot release it outside the government or authorize another company to manufacture from it without written permission.25eCFR. 48 CFR 252.227-7013 – Rights in Technical Data Other Than Commercial Products and Commercial Services Mixed funding produces government purpose rights, which permit government use and disclosure for government purposes but restrict commercial release for a set period.
Contractors must assert their rights on time during the proposal process. Failing to identify limited rights data before award often forfeits the protection entirely. On the other side, the government benefits from negotiating data rights early, because limited rights data in critical systems can create sole-source dependency that drives up sustainment costs for decades.
If You Lose: Bid Protests
Losing an award is not necessarily the end. Federal law provides protest mechanisms, and agencies overturn or correct awards more often than most people expect.
GAO Protests
The Government Accountability Office is the most commonly used venue. A protest must generally be filed within 10 days after the protester knew or should have known the basis for the challenge. Once GAO receives a timely protest, the Competition in Contracting Act triggers an automatic stay: the agency cannot award (or must suspend performance if already awarded) while the protest is pending.26Acquisition.GOV. FAR 33.104 – Protests to GAO That stay is the reason most firms start at GAO.
GAO must issue a decision within 100 days, or 65 days under the express option. Common grounds for sustaining a protest include unreasonable technical evaluations, evaluation criteria not disclosed in the solicitation, unequal treatment of offerors, failure to conduct meaningful discussions, and inadequately documented source selection decisions.24U.S. Government Accountability Office (GAO). Bid Protests: A Guide for Interested Parties GAO decisions are technically recommendations, not binding orders, but agencies almost always comply. A prevailing protester can recover proposal preparation costs and attorney fees.
Court of Federal Claims Protests
The U.S. Court of Federal Claims is the judicial alternative. There is no automatic stay; the protester must seek a preliminary injunction by meeting the traditional four-part test of likelihood of success, irreparable harm, balance of hardships, and public interest. Proceedings follow rules modeled on the Federal Rules of Civil Procedure, and corporations must be represented by admitted counsel. The standard of review asks whether the agency’s decision was arbitrary, capricious, or not in accordance with law. Unlike GAO recommendations, Court of Federal Claims decisions are binding and enforceable. Recovery of attorney fees is limited to parties qualifying under the Equal Access to Justice Act, which restricts eligibility based on company size and net worth.
The Enforcement Risk That Dwarfs the Rest
The biggest legal risk in defense contracting is not losing a protest or having a contract terminated. It is the False Claims Act. The statute imposes liability on anyone who knowingly submits a false claim for payment, makes a false record supporting a claim, or conceals an obligation to return money to the government.27Office of the Law Revision Counsel. 31 USC 3729 – False Claims Penalties are designed to be devastating: treble damages (three times the government’s actual loss) plus a civil penalty for each false claim. As of 2025, that per-claim penalty ranges from $14,308 to $28,618.28Federal Register. Civil Monetary Penalty Inflation Adjustment
A contractor who overbills on 500 invoices does not face one penalty. It faces 500, each carrying that per-claim amount, on top of triple the overcharged amount. Damages can be reduced from treble to double if the contractor self-reports within 30 days, cooperates fully, and reports before any government investigation has begun.27Office of the Law Revision Counsel. 31 USC 3729 – False Claims
The False Claims Act also lets private citizens sue on the government’s behalf through qui tam actions. A whistleblower who brings a successful case can receive between 15 and 30 percent of the total recovery, which gives employees, subcontractors, and former partners a direct financial reason to report suspected fraud. Federal contractors are separately required to disclose credible evidence of fraud, bribery, gratuity violations, or False Claims Act violations to the agency’s Office of Inspector General.29Acquisition.GOV. FAR 52.203-13 – Contractor Code of Business Ethics and Conduct Failing to disclose can itself become grounds for suspension or debarment, even if the underlying violation turns out to be minor.
A serious internal compliance program is the cheapest insurance available against the most expensive enforcement tool the government has.