How small businesses break into Department of Defense contracting — where DoD buys, how to find and win opportunities, and the DFARS, CMMC, and security rules that come with the work.
Last reviewed on September 28, 2026 by the Government.biz editorial team against the DFARS, the CMMC program status as of September 2026, and the April 2026 SBIR/STTR reauthorization.
The Department of Defense — which has also used the secondary name "Department of War" since a September 2025 executive order — accounts for more than half of all federal contract spending in most years. It buys almost everything: weapons systems and spare parts, but also IT, construction, facilities maintenance, food, fuel, medical supplies, training, engineering, and professional services. That breadth is why DoD is often the most realistic first federal customer for a small business, even one that has never thought of itself as a "defense company."
DoD also carries the heaviest compliance load of any federal buyer. On top of the FAR, every DoD contract includes clauses from the Defense Federal Acquisition Regulation Supplement (DFARS), and many include cybersecurity, country-of-origin, and security requirements that civilian agencies do not impose. Knowing which apply to your work — before you bid — is most of the battle. For an overview across agencies, see FAR and DFARS compliance.
"DoD" is not one buyer. Contracts are awarded by hundreds of contracting offices across the military departments and defense agencies, each with its own mission, habits, and small business staff.
| Component | Examples of buying organizations | What they commonly buy |
|---|---|---|
| Army | Army Contracting Command, U.S. Army Corps of Engineers, Mission and Installation Contracting Command | Base operations, construction and engineering, vehicles, training, IT |
| Navy & Marine Corps | NAVSEA, NAVAIR, NAVSUP, NAVFAC, Marine Corps Systems Command | Ship and aircraft systems and repair, facilities, logistics, engineering services |
| Air Force & Space Force | Air Force Life Cycle Management Center, Space Systems Command, installation contracting squadrons | Aircraft sustainment, space systems, base services, R&D |
| Defense Logistics Agency (DLA) | DLA Troop Support, DLA Land and Maritime, DLA Aviation, DLA Energy | Spare parts, food, clothing, medical supplies, construction equipment, fuel |
| Other defense agencies | DISA, Defense Health Agency, Missile Defense Agency, DIU | IT and telecommunications, health care, advanced technology, commercial prototypes |
Every major buying command has an Office of Small Business Programs whose job includes helping small firms understand upcoming requirements. Start there once you know which commands buy what you sell. Geography matters too: many installation-level contracts (grounds, custodial, repairs, minor construction) are won by firms near the base, and large clusters of defense work sit in Northern Virginia, the Maryland suburbs of D.C., Hampton Roads, San Diego, Huntsville, and around major depots and bases.
High-volume, mostly small-dollar quotes for parts and supplies. Good for manufacturers and distributors who can meet exact part-number and packaging requirements.
Services, construction, and supplies competed among small businesses or socioeconomic categories such as 8(a), HUBZone, SDVOSB, and WOSB/EDWOSB.
R&D funding for technology companies; DoD is the largest SBIR/STTR agency, and Phase III awards can follow without a new competition.
Large primes with subcontracting plans have small business goals. Subcontracts build DoD past performance quickly.
Other transaction agreements (10 U.S.C. 4022) and commercial solutions openings run by organizations such as DIU and service innovation hubs buy commercial technology fast, outside most FAR procedures.
GSA Schedules and IDIQs such as SEWP or OASIS+ are widely used by DoD customers for task orders — see GSA Schedule.
The DLA Internet Bid Board System (DIBBS) is where the Defense Logistics Agency posts most of its requests for quotations and where vendors search, view, and submit quotes. Much of it is spare parts and consumables identified by NSN, so the work rewards precision and speed more than proposal writing.
Start with a narrow set of Federal Supply Classes where you have a genuine cost or sourcing advantage, set up saved searches, and track win rates by NSN.
The Small Business Innovation Research (SBIR) and Small Business Technology Transfer (STTR) programs are non-dilutive R&D funding for small technology companies, and DoD runs the largest share of them. Both programs lapsed on September 30, 2025 and were reauthorized when the President signed the Small Business Innovation and Economic Security Act on April 13, 2026, extending them through September 30, 2031. The reauthorization added foreign-risk screening, a new larger "strategic breakthrough" Phase II vehicle, and agency-set caps on the number of proposals a company may submit starting in fiscal year 2027.
| Clause | What it requires | Learn more |
|---|---|---|
| 252.204-7012 | Safeguard covered defense information using NIST SP 800-171; report cyber incidents to DoD within 72 hours | CUI handling |
| 252.204-7019 / -7020 | Have a current NIST SP 800-171 assessment score posted in SPRS; allow DoD assessments | CMMC |
| 252.204-7021 | CMMC level required by the contract (see status below) | CMMC in 2026 |
| 252.225-7001 / -7009 / -7012 | Buy American, specialty metals restrictions, and Berry Amendment domestic-source requirements for items such as textiles, clothing, and food | Buy American, TAA & Berry |
| 252.232-7006 | Submit payment requests electronically through Wide Area Workflow (PIEE) | — |
| 252.246-7007 / -7008 | Detect and avoid counterfeit electronic parts; source from trusted suppliers | — |
| FAR 52.204-25 (applies DoD-wide) | Prohibition on covered Chinese telecommunications equipment | Section 889 |
Negotiated and cost-type DoD contracts also bring accounting and business-system expectations: an adequate accounting system for cost-reimbursement work, DCAA audits, and — for larger contractors — the DFARS business systems rules. See DCAA compliance and DFARS business systems. Export-controlled technical data brings ITAR or EAR obligations, which are separate from the DFARS.
The Cybersecurity Maturity Model Certification program verifies that contractors protect federal contract information (FCI) and controlled unclassified information (CUI). The contract rule took effect on November 10, 2025, starting Phase 1, under which applicable solicitations can require CMMC Level 1 or Level 2 self-assessments.
On July 13, 2026, DoD suspended the Phase 2 requirements — third-party (C3PAO) Level 2 certification, originally set to begin November 10, 2026 — along with other pending CMMC milestones, and stood up a reform task force for a 60-day review. A September 3, 2026 class deviation then directed contracting officers not to include third-party assessment requirements in contracts. As of this review, no replacement schedule had been published.
See our CMMC certification guide and CMMC 2026 status update for levels, costs, and preparation steps, and check the DoD CIO CMMC page for the latest direction.
Most DoD contracts are unclassified, so you do not need a clearance to start. When a contract requires access to classified information, the company needs a facility clearance (FCL) and individual employees need personnel clearances. You cannot apply for an FCL on your own: a government customer or a cleared prime contractor must sponsor you to the Defense Counterintelligence and Security Agency (DCSA), typically because you are being considered for a classified contract or subcontract. Cleared contractors must then follow the National Industrial Security Program Operating Manual (32 CFR Part 117), including an insider threat program. A common route for small firms is to start as a subcontractor on a cleared prime's contract, which provides the sponsorship.
Register in SAM.gov to get a UEI and CAGE code, identify the NAICS codes and product service codes you sell under, and find the DoD buying offices that purchase them. Then watch SAM.gov and DIBBS for solicitations, respond to sources sought notices, meet each command's Office of Small Business Programs, and consider SBIR/STTR topics or subcontracting to primes to build DoD past performance. Free help is available from DoD-funded APEX Accelerators.
DIBBS is the Defense Logistics Agency Internet Bid Board System, the web portal where DLA posts most of its requests for quotations and where vendors search, view, and submit quotes, largely for spare parts and supplies identified by National Stock Number. You need an active SAM.gov registration with a CAGE code before you can register in DIBBS.
It depends on the solicitation. Since November 10, 2025, applicable DoD solicitations can require a CMMC Level 1 or Level 2 self-assessment. In July 2026 DoD suspended the Phase 2 third-party (C3PAO) certification requirements pending a reform review, and a September 2026 class deviation directs contracting officers not to include third-party assessment requirements. Self-assessment and the NIST SP 800-171 obligations under DFARS 252.204-7012 still apply when you handle controlled unclassified information.
No. Most DoD contracts are unclassified. A facility clearance is needed only when a contract requires access to classified information, and a company cannot apply on its own; a government agency or cleared prime contractor must sponsor it through the Defense Counterintelligence and Security Agency.
Yes. SBIR and STTR authority lapsed on September 30, 2025, but Congress reauthorized both programs and the President signed the law on April 13, 2026, extending them through September 30, 2031. DoD posts its SBIR and STTR topics on the Defense SBIR/STTR Innovation Portal.
The Defense Federal Acquisition Regulation Supplement (DFARS) is DoD's supplement to the FAR. The FAR applies to all executive agencies; DFARS adds DoD-specific policies and clauses, such as cybersecurity safeguarding (252.204-7012), specialty metals and Berry Amendment restrictions, and electronic invoicing through PIEE. A DoD contract will include both FAR and DFARS clauses.
Look up large primes' small business liaison officers, register in their supplier portals, search SBA's SubNet for subcontracting notices, attend industry days, and ask an APEX Accelerator for introductions. Large primes with subcontracting plans have small business goals, so a clear capability statement aimed at a specific program helps.
Authoritative sources: DFARS and DFARS Part 252 clauses on Acquisition.gov, the DoD CIO CMMC program, SBIR.gov, and the Defense Logistics Agency. CMMC policy was changing rapidly in 2026 — confirm current requirements in each solicitation. This page is general information, not legal advice.