The SBA has proposed the biggest rewrite of small business size standards in decades — and if it goes through as written, an estimated 114,541 additional firms would qualify as “small,” including 37,002 companies that already hold federal contracts. If you’ve built your business around a specific NAICS code and a specific receipts threshold, this…
Every small defense contractor eventually gets told they need a system security plan. Almost nobody gets told where that requirement actually comes from, what has to be in it, or why the document they downloaded from a template site will fail an assessment. This is the practical version, written for a shop with five people…
Your SPRS score is a number you calculate yourself, post yourself, and are held to by the government. Nobody checks your arithmetic before it goes in. That combination is why so many small defense contractors have a score in SPRS that does not survive contact with a government assessor. This walks through the actual scoring…
On July 13, 2026, the Department of War suspended the transition to Phase 2 of the Cybersecurity Maturity Model Certification program. Within a week, a lot of small defense contractors heard a much simpler version of that sentence: CMMC is dead. It is not. And acting as though it is will cost you contracts, and…
Configure QuickBooks for DCAA compliance: chart of accounts, timekeeping, indirect rates, unallowables. SF 1408 preparation for small contractors.
What DCAA Does and Why It Matters The Defense Contract Audit Agency — DCAA — is DoD’s contract-audit organization. DCAA audits cost-reimbursement, time-and-materials, and other flexible-price contracts to determine whether the government paid what it should have. For small contractors accustomed to firm-fixed-price commercial work, DCAA compliance is a new discipline: the government wants to…
DFARS 101 for Small Contractors Defense Federal Acquisition Regulation Supplement — DFARS — is the DoD’s overlay on top of the general Federal Acquisition Regulation (FAR). For any small business selling to the Department of Defense, DFARS clauses matter as much as FAR clauses. The most-discussed DFARS provisions today are the cybersecurity clauses that require…
What NIST 800-171 Actually Is NIST Special Publication 800-171 is the U.S. government’s control catalog for how contractors must protect Controlled Unclassified Information (CUI). CUI is the sensitive-but-unclassified data the federal government shares with vendors — technical drawings, contract-performance data, personally identifiable information, and program-specific material that isn’t secret but isn’t public. If your contract…
Why the Contract Type Matters More Than the Dollar Value Small government contractors regularly celebrate a $500,000 contract award without asking a simple question: what type of contract is it? A $500K firm-fixed-price contract with a scope you understand is a business you can plan around. A $500K time-and-materials contract with a poorly-defined statement of…
Getting Paid Is the Second-Hardest Part of Government Contracting Winning the contract is hard. Getting paid on it is a close second. The federal government does not send you an invoice or ask you to send it a bill — you have to submit invoices through a specific electronic system, in a specific format, tied…