How to Win Department of Defense (DoD) Contracts as a Small Business

The Department of Defense awards over $400 billion in contracts annually — more than all other federal agencies combined. Its components — Army, Navy, Air Force, Marine Corps, Space Force, DIA, NSA, DARPA, and dozens of defense agencies — represent the most diverse federal marketplace in the world.

For small businesses, DoD is simultaneously the largest opportunity and the most complex environment. DFARS requirements, security clearances, CMMC compliance, and military culture create real barriers. But DoD also has the most robust small business programs of any federal agency — and a statutory obligation to award 23% of prime contract dollars to small businesses.

This guide maps the DoD contracting landscape for small businesses and explains where and how to compete effectively.

---

DoD Contracting: The Scale and Structure

Annual Spending Breakdown (approximate)

• Army: ~$100B annually (services, systems, construction)
• Navy/Marine Corps: ~$100B annually (shipbuilding, IT, maintenance)
• Air Force/Space Force: ~$80B annually (aerospace, IT, logistics)
• Defense Logistics Agency (DLA): ~$40B annually (supplies, medical, energy)
• Other defense agencies: ~$80B (DARPA, DIA, NSA, MDA, etc.)

Contract Types

DoD uses the full range of contract types (FFP, CPFF, T&M, IDIQ) across:

• Research and Development (R&D) — DARPA, ONR, AFRL, ARL
• Systems Acquisition — major platforms, weapons systems, technology programs
• Sustainment and Maintenance — keeping existing systems operational
• Information Technology — networks, cybersecurity, software, cloud
• Professional Services — consulting, staffing, training, logistics
• Construction — base facilities, range improvements, building projects

---

DFARS: How DoD Contracting Is Different

The Defense Federal Acquisition Regulation Supplement (DFARS) is a set of additional requirements that apply on top of the base FAR for DoD contracts. Key DFARS provisions that affect small businesses:

DFARS 252.204-7012: CUI and Cybersecurity

This clause requires contractors handling Controlled Unclassified Information (CUI) to comply with NIST SP 800-171 and report cyber incidents to the DoD within 72 hours. This is the foundational cybersecurity requirement that CMMC 2.0 is built on.

If you work on DoD contracts with any sensitive technical information, this clause almost certainly applies to you.

DFARS 252.225-7001: Buy American Act

DoD has more stringent domestic content requirements than civilian agencies. The Berry Amendment (10 U.S.C. 4862) prohibits DoD from purchasing food, clothing, fabrics, and hand or measuring tools unless they are grown or manufactured in the US. Similar provisions apply to specialty metals and chemical weapons antidotes.

If you supply products to DoD, verify your supply chain compliance with Buy American and Berry Amendment requirements.

DFARS 252.204-7015: Notice of Authorized Disclosure

Contractors must have authorization from the contracting officer before disclosing DoD information to non-US persons. Relevant for IT contractors with any foreign national employees.

Security Clearances

Many DoD contracts require contractor employees to hold personnel security clearances (Confidential, Secret, or Top Secret). Clearances are granted by the government to individuals (not firms), but your company must hold a Facility Clearance (FCL) issued by the Defense Counterintelligence and Security Agency (DCSA) before any of your employees can hold a clearance.

Getting your first FCL takes 9–24 months. Do not pursue clearance-required contracts without beginning the FCL process.

---

DoD Small Business Programs

SBIR/STTR: The Innovation Entry Point

The Small Business Innovation Research (SBIR) and Small Business Technology Transfer (STTR) programs are DoD's most powerful entry point for technology-focused small businesses.

SBIR Phase I: Feasibility study, up to $150,000–$250,000, 6 months. No competitive bidding process — apply to annual or periodic solicitations.

SBIR Phase II: Full R&D, up to $750,000–$1.5M, 24 months. Based on Phase I success.

SBIR Phase III: Commercialization/production. No dollar limit. Can be awarded sole-source without competition.

Why SBIR is transformative for small tech businesses:

• No prior DoD contract required — technical merit wins
• Significant cash investment with relatively low proposal burden vs. traditional contracts
• Phase III authority allows DoD to non-competitively award production contracts to SBIR winners
• Multiple DoD components (Air Force, Army, Navy, DARPA, MDA) each run their own SBIR programs

SBIR solicitations are posted at sbir.gov and individual agency portals.

Mentor-Protégé Program (DoD-Specific)

The DoD has its own Mentor-Protégé Program (separate from the SBA's program). A DoD mentor-protégé agreement allows a large prime contractor to earn credit toward their small business subcontracting goals by formally developing a small protégé business.

DoD mentor-protégé agreements can support technology transfer, cost-sharing on facilities or equipment, and subcontract awards — potentially worth millions in non-competitive business development.

DoD APEX Accelerators (Formerly PTAC)

In 2023, the DoD rebranded its Procurement Technical Assistance Centers to APEX Accelerators. These centers provide free technical assistance to businesses pursuing DoD contracts — including cybersecurity compliance support, CMMC readiness assessments, and proposal development coaching.

---

Targeting the Right DoD Buyer

DoD is not a single buyer — it is dozens of acquisition commands, each with their own mission, budget cycle, and small business priorities.

Army Acquisition Commands

• Army Contracting Command (ACC) — manages most Army service contracts
• Army Corps of Engineers (USACE) — construction and civil works; massive small business programs
• Army Research Laboratory (ARL) — R&D contracting
• PEO Soldiers, PEO Enterprise Information Systems — program executive offices manage system acquisitions

Navy Acquisition

• Naval Facilities Engineering Systems Command (NAVFAC) — construction
• Naval Information Warfare Systems Command (NAVWAR) — IT and cybersecurity
• Naval Sea Systems Command (NAVSEA) — ships and marine systems
• Naval Air Systems Command (NAVAIR) — aircraft and aviation systems
• Office of Naval Research (ONR) — R&D

Air Force/Space Force

• Air Force Life Cycle Management Center (AFLCMC) — aircraft and weapons systems
• Air Force Research Laboratory (AFRL) — R&D
• Space Systems Command (SSC) — satellite and space systems
• Air Force SBIR program — one of the most active SBIR programs

Defense Agencies

• Defense Logistics Agency (DLA) — $40B in supplies, medical, energy. The most commodity-focused DoD buyer.
• Defense Information Systems Agency (DISA) — IT and communications
• Defense Advanced Research Projects Agency (DARPA) — breakthrough technology R&D
• Missile Defense Agency (MDA) — sensors, interceptors, systems

---

Your DoD Market Entry Strategy

Route 1: SBIR/STTR (Technology Companies)

If you offer innovative technology, SBIR is your best entry point. The proposal burden is lower than traditional RFPs, the awards are larger per dollar of proposal investment, and Phase III sole-source authority means a successful SBIR can become multi-million dollar production contracts without competition.

Timeline: 6–18 months from application to Phase I award.

Route 2: Small Business Set-Asides (Services/IT)

DoD components have aggressive small business goals. Target Army USACE or DLA for construction and commodity contracts; NAVWAR or AFLCMC for IT; Army ACC for professional services.

Timeline: 12–24 months from first contact to first award.

Route 3: Subcontracting to a DoD Prime (Any Domain)

Every large DoD prime contractor (Lockheed Martin, Boeing, Raytheon, General Dynamics, Booz Allen Hamilton, SAIC) has a small business subcontracting plan and is actively seeking qualified small business subcontractors. Register on their supplier portals and make contact with their supplier diversity offices.

Timeline: 3–9 months to first subcontract.

Route 4: GSA Schedule Orders (IT and Services)

DoD uses GSA Schedule contracts heavily for IT products and professional services. A GSA Schedule contract combined with relevant cybersecurity certifications (CMMC Level 1 or 2) positions you to receive DoD orders through eBuy and direct agency contacts.

Timeline: 4–9 months for Schedule award; then ongoing order development.

---

CMMC: The DoD Cybersecurity Requirement

If you pursue any DoD contract involving CUI (and most substantive service contracts do), you need a CMMC compliance path. See our complete CMMC 2.0 guide for the full picture.

For small businesses just entering DoD contracting:

• Start with a self-assessment against NIST 800-171 (use the free DoD 800-171 assessment tool)
• Submit your SPRS score in SPRS.mil
• Identify gaps and create a Plan of Action and Milestones (POAM)
• Begin gap remediation before pursuing CUI-involving contracts

---

Key Takeaways

• DoD awards $400B+ annually — the largest federal buyer by far, with opportunities across all domains.
• DFARS adds requirements on top of FAR — cybersecurity (DFARS 252.204-7012), Buy American, clearance requirements.
• SBIR/STTR is the best entry point for tech companies — lower barriers, larger initial awards, and sole-source Phase III authority.
• Security clearances and FCLs take 9–24 months — begin the process before you need it for a specific contract.
• Target specific acquisition commands (USACE, NAVWAR, AFLCMC, DLA) based on your capabilities — "DoD" is not a single buyer.
• CMMC compliance is required for CUI-involving DoD contracts — start the assessment and remediation process now.

Find and track DoD small business opportunities with RFxNerd →