IT government contracting is one of the most accessible corners of the public market for a small tech firm, because nearly every agency at every level buys the same things: websites, networks, cybersecurity, hardware, cloud, and software support. The firms that win follow a predictable path. They register under the right NAICS codes, sell into state and local government while they build federal past performance, subcontract to larger primes, and get their cybersecurity house in order before chasing defense work. A GSA schedule helps, but it is a later step, not the first one. This guide walks each part.
Which NAICS codes do IT companies use?
Your NAICS codes decide which solicitations you see and which set-asides you qualify for, so pick them deliberately. The common IT codes:
| NAICS | Title | Typical work |
|---|---|---|
| 541511 | Custom Computer Programming Services | Custom software, app development |
| 541512 | Computer Systems Design Services | Systems integration, network design, IT consulting |
| 541513 | Computer Facilities Management Services | Managed IT, data center operations |
| 541519 | Other Computer Related Services | Recovery, installation, other IT support |
| 518210 | Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services | Hosting, cloud infrastructure |
Size standards are set per code. For 541512, a firm is small if its average annual receipts are $34 million or less. Check the SBA size standards table for each code you list, and see our NAICS guide for how to choose a primary code.
How do federal agencies buy IT?
Three ways, and a small firm usually meets them in this order:
- Small, open-market buys. Purchases under the $15,000 micro-purchase threshold, and simplified acquisitions up to $350,000, move fast and are often set aside for small businesses.
- Subcontracts. Large IT primes hold big contracts and need small partners for set-aside goals, specialized skills, and local presence. Teaming and subcontracting is how many IT firms earn their first federal past performance.
- Contract vehicles. Agencies place much of their IT spending through pre-competed vehicles. The best known is GSA’s Multiple Award Schedule IT category, which replaced the old GSA Schedule 70 and covers hardware, software, cloud, and services, including cybersecurity and SaaS. Our GSA schedule vs open market guide covers when getting on a schedule is worth the effort.
The honest order matters. A schedule contract without past performance or relationships rarely produces orders by itself. Build those first through the first two routes.
What does CMMC mean for IT firms?
If you want Department of Defense work, cybersecurity certification is now part of the bid. The Cybersecurity Maturity Model Certification (CMMC) rule took effect on November 10, 2025. In Phase 1, applicable DoD solicitations require a Level 1 or Level 2 self-assessment, reported in the Supplier Performance Risk System (SPRS) before award. Level 1 covers the 15 basic safeguarding requirements in FAR 52.204-21. The rollout runs in four phases through November 10, 2028, per this summary from Dorsey.
Two practical points for small IT firms:
- CMMC is a DoD requirement. Civilian federal agencies and state and local governments do not require it, which is one more reason to start there.
- Your own compliance is a selling point. An IT firm that already meets Level 1 or Level 2 is an easier subcontractor for a defense prime to bring on.
Cloud products sold to federal agencies raise a separate question, FedRAMP authorization, which is worth researching before you pitch a SaaS product to a federal buyer.
Why state and local IT is the better starting point
State agencies, counties, cities, and school districts buy IT constantly, and their bids are smaller, closer to home, and far less crowded than national federal solicitations. Two real examples open in our feed this week: the Vermont Department of Taxes is seeking a searchable database of people, businesses, and assets, and the Jefferson County Clerk in Kentucky has a Microsoft cloud modernization proposal out. Neither shows up on SAM.gov.
States also buy IT through cooperative contracts. Under NASPO ValuePoint, one lead state runs a competitive solicitation and other states sign on to use the resulting contracts, which also opens them to cities, counties, and schools in participating states. Winning a cooperative contract is a bigger lift, but it is worth knowing why some state IT buying never appears as an open bid: it runs through contracts that already exist.
Across all categories, 3,307 new government opportunities posted to our feed today, and 16,847 of the opportunities we track come from state and local sources. The practical move is to register on your state’s procurement portal and watch it alongside SAM.gov.
How do small IT firms win their first contract?
- Register in SAM.gov under your primary IT NAICS code and the secondary codes you can actually deliver.
- Write a capability statement that leads with commercial past performance. Agencies accept relevant private-sector work, so make it specific: systems, users, outcomes.
- Answer sources-sought notices in your specialty. They cost little to write and can shape set-aside decisions before the RFP drops.
- Pursue certifications you qualify for. 8(a), HUBZone, WOSB, and SDVOSB set-asides are common in IT. See our certifications guide.
- Bid small and local first. Micro-purchases, simplified acquisitions, and state and local IT bids build the past performance that bigger federal work demands.
What this guide doesn’t cover
- Specific contract vehicles and on-ramps. Governmentwide IT vehicles open and close on their own schedules. Check the agency running each one before planning around it.
- CMMC details for your contract. The required level depends on the information a contract handles. Read the solicitation and consult a qualified advisor.
- Every IT listing. RFPHawk pulls SAM.gov, Grants.gov, and state portals into one feed you can filter by industry, state, and keyword. Our IT category is assigned automatically from listing text, so it occasionally includes items that are not IT, and we do not cover most county and city portals. Always read the full solicitation at its source.
Key takeaways
- Use the right IT NAICS codes. For 541512, the small business size standard is $34 million.
- GSA’s MAS IT category replaced Schedule 70. It helps once you have past performance.
- CMMC applies to applicable DoD contracts since November 10, 2025. Civilian, state, and local work does not require it.
- State and local IT is the most accessible starting point, and much of it never touches SAM.gov.
Frequently asked questions
What NAICS code do IT companies use for government contracts?
Most IT service firms use 541512 (Computer Systems Design Services), 541511 (Custom Computer Programming), 541513 (Computer Facilities Management), or 541519 (Other Computer Related Services). Hosting and cloud infrastructure firms often add 518210. The small business size standard for 541512 is $34 million in average annual receipts.
Does GSA Schedule 70 still exist?
Not under that name. GSA consolidated its schedules into the Multiple Award Schedule, and IT is now one of its 12 categories. The IT category covers what Schedule 70 did: hardware, software, cloud, and IT services, including cybersecurity and SaaS.
Do I need CMMC to win government IT contracts?
Only for applicable Department of Defense work. The CMMC rule took effect November 10, 2025, and Phase 1 requires Level 1 or Level 2 self-assessments reported in SPRS for covered DoD solicitations. Civilian federal, state, and local contracts do not require CMMC.
How do small IT companies get government contracts?
Register in SAM.gov under the right NAICS codes, build a capability statement with commercial past performance, answer sources-sought notices, and start with small buys, subcontracts to larger primes, and state and local IT bids. A GSA schedule helps later but is not required to start.
Where do state and local governments post IT bids?
On their own procurement portals: state purchasing sites, county and city bid boards, and school district websites. States also buy IT through cooperative contracts such as NASPO ValuePoint, where one lead state runs the competition and other states join the resulting contracts.
Recommended
- Browse open IT opportunities: live federal and state IT bids
- GSA Schedule vs Open Market: when a schedule is worth it
- Teaming and Subcontracting for Small Businesses: the fastest route to past performance
Put RFPHawk to work on your pipeline.
Federal SAM.gov plus a growing list of state portals, refreshed daily and scored against your profile so you see the bids worth pursuing first.
Start free — no credit card