Contract Ready

Disclaimer: This booklet is for general informational purposes only and does not constitute legal, financial, accounting, or business advice, and should not be relied upon as a substitute for consultation with a licensed attorney, accountant, or qualified government contracts professional regarding your specific circumstances. Federal Acquisition Regulation, Defense Federal Acquisition Regulation Supplement, Cost Accounting Standards, and Cybersecurity Maturity Model Certification provisions discussed here reflect publicly available government guidance as of September 2026; regulations, clause numbers, thresholds, dollar limits, and agency procedures are subject to change without notice. and federal acquisition is presently mid-transition on several fronts, including the Revolutionary FAR Overhaul, new certified cost or pricing data and Cost Accounting Standards thresholds, and the Cybersecurity Maturity Model Certification phase-in. Readers should verify current requirements against the clauses in their own contracts and purchase orders and current regulatory text before relying on any point here. Nothing in this booklet guarantees a contract award, a favorable audit or review outcome, or any level of compliance. Disclosure: GPS LLC is a referral partner of GovComply, which is mentioned in this booklet, and may receive compensation for referrals.

A Note on Scope

Who This Is For

This booklet is written for manufacturers in the middle of the defense supply chain. Companies with roughly $20 million to $500 million in revenue, 50 to 2,000 employees, and a compliance function of one to three people who also carry finance or quality. Many hold no direct government contract and work entirely through purchase orders from primes and Tier I suppliers.

How It Is Organized

It is organized as seven phases, in roughly the order a manufacturer should address them. Phase 1 applies to any federal buyer. Phases 2 through 7 are written for Department of Defense (DoD) work, which is the most demanding case. A supplier to civilian agencies can set aside the DoD-specific items and keep the rest.

How to Use the ADVANCED Sections

Readers with experience will find sections headed ADVANCED. Those passages go deeper into mechanics and edge cases. Newer readers can skip them on a first pass without losing the thread.

Prove It, Don't Claim It

One idea runs through every phase. Most of what follows is something a company must be able to prove, not simply claim. Registration is a form. An adequate accounting system, a sound purchasing system, a compliant cybersecurity posture, and a working quality system are conditions the government and your primes can examine after award. Finding a gap after award costs far more than closing it before.

Phase 1 — Registration and Identity

The Gate

Nothing else happens until a company exists in the federal procurement system.

SAM.gov Registration and the Unique Entity ID

Registration in the System for Award Management (SAM.gov) is the gate. A company cannot receive a federal award or payment without an active registration. Registration issues the Unique Entity ID (UEI), the 12-character identifier that replaced the Data Universal Numbering System (DUNS) number in April 2022. It is free. Paid intermediaries are unnecessary. It must be renewed every 12 months, and a lapsed registration during performance is a common, avoidable cause of interrupted payments.

CAGE Code

SAM registration also assigns a Commercial and Government Entity (CAGE) code, which identifies a specific facility. A manufacturer with several plants may need a CAGE code for each location. DoD systems reference the CAGE code throughout.

NAICS and PSC Codes

The company then selects its North American Industry Classification System (NAICS) codes, which describe what it does, and Product Service Codes (PSC), which describe what it sells. NAICS codes do more than route solicitations. Each carries a small business size standard, set by employee count or average annual receipts, and size status determines set-aside eligibility.

Representations and Certifications

Finally, SAM captures the annual Representations and Certifications. These include small business and socioeconomic status, ownership, debarment status, and the Section 889 representations under Federal Acquisition Regulation (FAR) 52.204-24 and FAR 52.204-26 regarding certain covered telecommunications and video surveillance equipment. They are made under penalty of law. Accuracy matters.

ADVANCED — SAM Timing and Prime Onboarding

SAM validation can take days to weeks the first time, particularly when entity information must be reconciled with Internal Revenue Service records. Start before pursuing a specific solicitation. For suppliers who work only through primes, SAM registration is not always required, but many primes now ask for a UEI and CAGE code during supplier onboarding, and the SAM exclusion list is what your own buyers should be checking before every defense award.

Phase 2 — Business Systems

Contract Type Draws the Line

The dividing line in Phase 2 is contract type.

A firm-fixed-price (FFP) contract places limited demands on your accounting system. The government is paying for delivery, not for your costs. Cost-reimbursement, time-and-materials (T&M), and labor-hour work are different. You are billing for costs incurred, so the government has a direct interest in how every dollar is recorded, allocated, and billed.

The Accounting System

Before awarding cost-type work, the government may conduct a pre-award survey using Standard Form (SF) 1408. The survey looks for separation of direct and indirect costs, a logical indirect cost structure, job cost accumulation by contract, and exclusion of unallowable costs under FAR Part 31. DoD contracts may include Defense Federal Acquisition Regulation Supplement (DFARS) 252.242-7006, which sets the criteria an acceptable accounting system must meet. In practice, that usually means a government contract accounting system rather than an off-the-shelf general ledger.

Timekeeping

Labor is the most scrutinized cost element in most audits. Expect daily time entry by every employee, allocation of all hours to cost objectives, supervisor approval, total-time accounting, and an audit trail for every correction. The system should be in place before the first cost-type invoice.

Incurred Cost Submissions

Under FAR 52.216-7, contractors on flexibly priced work generally submit a final indirect cost rate proposal within six months after the end of each fiscal year. The Defense Contract Audit Agency (DCAA) audits those submissions, along with proposals and business systems.

The Purchasing System

A manufacturer that buys materials and subcontracts work for government contracts needs a documented purchasing system. That covers competition, price and cost analysis, file documentation, exclusion checks, and correct flowdown of clauses to suppliers. Under DFARS 244.302, the administrative contracting officer determines whether a Contractor Purchasing System Review (CPSR) is needed when a contractor's sales to the government are expected to exceed $50 million over the next twelve months, with certain competitively awarded fixed-price and commercial sales excluded. The Defense Contract Management Agency (DCMA) conducts the review against the 24 criteria in DFARS 252.244-7001, and the need for a review is reassessed at least every three years.

Why Approval Matters

An approved purchasing system matters because the alternative is slow. Without one, more subcontracts require the contracting officer's advance consent under FAR Subpart 44.2.

Government Property

If the contract provides government-furnished property, or the company acquires property the government will own, a property management system meeting FAR 52.245-1 is required. This is often overlooked until the first shipment arrives on the dock.

Earned Value

An Earned Value Management System (EVMS) is required only on large cost or incentive contracts that meet the thresholds in DFARS Subpart 234.2. Most mid-market manufacturers will not trigger it. Treat it as a contract-driven requirement rather than a baseline.

ADVANCED — Business Systems and Payment Withholds

DFARS 252.242-7005 ties the six contractor business systems (accounting, estimating, purchasing, property, earned value, and material management and accounting) to payment. On covered contracts, significant deficiencies can lead to withholding of up to 5 percent of payments in total until the contractor corrects them. Because "covered contract" is linked to Cost Accounting Standards coverage, the 2026 threshold changes in Phase 5 will narrow how many new awards carry the clause. Existing contracts keep the terms they were written with.

Phase 3 — Cybersecurity and Information Safeguarding

Two Regimes, Firm Dates

For DoD work, this has become the most time-consuming readiness item, and it now has firm dates. Two regimes are involved, and keeping them separate matters.

The Baseline

DFARS 252.204-7012 requires any contractor that handles covered defense information to provide adequate security by implementing the 110 requirements of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, and to report cyber incidents to DoD within 72 hours. The clause flows to subcontractors whose work involves that information. DoD has held the requirement to Revision 2 through a class deviation, even though NIST published Revision 3 in 2024. For civilian and lower-sensitivity work, FAR 52.204-21 sets 15 basic safeguarding requirements for federal contract information.

Assessment and Scoring

DFARS 252.204-7019 and 252.204-7020 require a NIST SP 800-171 self-assessment using the DoD Assessment Methodology, with the score posted to the Supplier Performance Risk System (SPRS). In practice, a current SPRS score is a precondition for work involving Controlled Unclassified Information (CUI).

Certification

The Cybersecurity Maturity Model Certification (CMMC) program adds verification. The acquisition rule took effect November 10, 2025, beginning a phased rollout.

• Phase 1 (November 10, 2025) — Level 1 and Level 2 self-assessments as a condition of award.
• Phase 2 (November 10, 2026) — Level 2 certification by a CMMC Third-Party Assessment Organization (C3PAO) becomes the expected requirement for most contracts involving CUI.
• Later phases — Level 3 requirements and full implementation follow in 2027 and 2028.

The Three Levels

Level 1 covers the 15 basic safeguarding requirements for federal contract information. Level 2 aligns with the 110 NIST SP 800-171 requirements. Level 3 applies to a small set of the most sensitive programs.

ADVANCED — C3PAO Capacity and Assessment Scope

C3PAO capacity is finite, and the Phase 2 date creates a scheduling bottleneck. A company that handles CUI and has not engaged an assessor is already late relative to the market. Conditional certification is available when a company meets a minimum threshold of the Level 2 requirements, with the remainder closed under a plan of action within a limited window, but certain requirements cannot be deferred. Scope carefully: the fewer systems and people that touch CUI, the smaller and less expensive the assessment. CMMC is a specialty discipline. Most compliance platforms built for acquisition clauses, including GovComply, do not cover it.

Phase 4 — Quality Management

The Prime Enforces It

Manufacturing contracts almost always impose a quality standard, and primes enforce it through their own supplier requirements.

The Standard

Much of the aerospace and defense supply chain requires AS9100D, published through the International Aerospace Quality Group (IAQG), which builds on ISO 9001 with aviation, space, and defense requirements. Some lower-tier work requires ISO 9001 alone. Certain North Atlantic Treaty Organization (NATO) and DoD contracts invoke Allied Quality Assurance Publication (AQAP) 2110. Special processes such as heat treating, welding, nondestructive testing, chemical processing, and coatings commonly require Nadcap accreditation.

Supplier Quality Assurance Requirements (SQAR)

Each prime publishes its own. They set inspection, documentation, retention, change notification, and flowdown expectations, and they are revised periodically. A new SQAR revision is a contract change in everything but name.

First Article Inspection (FAI)

New or changed parts frequently require a full verification of the first production article, documented on AS9102 forms. A defensible package depends on metrology, configuration control, and records that tie every characteristic to its requirement.

Nonconformance and Corrective Action

Expect a working process for nonconformance reports (NCR) and corrective action requests (CAR), with root cause analysis that holds up over time. Primes track response time and recurrence.

Your Suppliers

The prime holds you responsible for everything you ship, including what you bought. Flow the applicable quality requirements to your own suppliers, verify their certifications stay current, and keep the evidence.

ADVANCED — The Move to IA9100

The IAQG is expected to publish the next revision of AS9100, renamed IA9100, in late 2026, following the ISO 9001 revision. Industry sources expect a transition window of about three years. Early reporting points to heavier emphasis on supplier management, counterfeit prevention, product safety, human factors, and information security. Begin a gap assessment against the draft themes now rather than waiting for the published text.

Phase 5 — Clauses, Cost, and Pricing

Read Before You Sign

Every federal contract incorporates FAR clauses, and defense contracts add DFARS clauses. Before award, the task is to read the specific clauses in the solicitation, identify which impose ongoing obligations, confirm the company can meet them, and determine which must flow to suppliers.

Flowdown

For commercial subcontracts, FAR 52.244-6 and DFARS 252.244-7000 limit the clauses that must flow. The list is shorter than the prime contract, but it is not empty, and primes routinely add their own terms. Build one controlled clause library, assign an owner, and retire every uncontrolled template.

Certified Cost or Pricing Data

On negotiated awards without adequate price competition, contractors above a threshold must submit and certify cost or pricing data under the rules commonly called the Truthful Cost or Pricing Data Act (TINA). The threshold rose to $2.5 million on October 1, 2025. The Fiscal Year (FY) 2026 National Defense Authorization Act (NDAA) raised it to $10 million for DoD prime contracts and subcontracts entered into after June 30, 2026.

Cost Accounting Standards (CAS)

The CAS Board published a final rule on September 1, 2026, effective October 1, 2026. The basic applicability threshold rises from $2.5 million to $35 million. The threshold for full coverage and a formal Disclosure Statement rises from $50 million to $100 million. Many mid-market manufacturers on fixed-price work were already exempt, but exemption should be confirmed contract by contract.

Acquisition Thresholds

Since October 1, 2025, the simplified acquisition threshold has been $350,000 and the micro-purchase threshold $15,000. Those figures determine where simplified procedures and a number of clause obligations begin.

ADVANCED — Threshold Relief Is Not Risk Relief

Higher thresholds reduce formal triggers. They do not reduce risk. Contracts awarded under the old thresholds keep the clauses they were written with unless modified. FAR Part 31 cost principles still govern any cost you bill. A prime that needs your cost data to support its own proposal will still ask for it. And contracts written with static threshold language may not adjust automatically; ask your contracting officer or prime whether a modification is appropriate.

Phase 6 — Export Control and Supply Chain Integrity

Export Control

Items and technical data on the United States Munitions List fall under the International Traffic in Arms Regulations (ITAR), which require registration with the State Department's Directorate of Defense Trade Controls (DDTC). Dual-use items fall under the Export Administration Regulations (EAR). Registration, a technology control plan, and controls on releasing technical data to foreign persons, including employees working in the United States, should be in place before controlled data arrives.

Domestic Sourcing and Prohibited Sources

Depending on the item, a manufacturer may need to satisfy the Buy American statute, the Berry Amendment for food, clothing, and textiles, the specialty metals restrictions in DFARS 252.225-7009, and the Trade Agreements Act where it applies. Section 889 prohibitions on certain telecommunications equipment apply broadly.

Counterfeit Parts

For electronics, DFARS 252.246-7007 and DFARS 252.246-7008 require a detection and avoidance system and purchases from trusted sources, and they reach deep into the supply chain.

Phase 7 — Post-Award Administration

The Machinery Must Already Exist

Readiness does not end at award. Several obligations begin the day performance starts, and the government expects the machinery to exist already.

• Invoicing — DoD payment runs through Wide Area Workflow (WAWF) in the Procurement Integrated Enterprise Environment (PIEE). Set it up before the first delivery.
• Deliverables — Track contract data requirements lists (CDRL), reports, and deadlines against the schedule.
• Audits and surveillance — On flexibly priced work, expect DCAA engagement on costs and DCMA engagement on quality, purchasing, and property.
• Records retention — Under FAR Subpart 4.7, many records must generally be kept for three years after final payment, and some longer. Auditors reach back.
• Regulatory currency — Clauses and thresholds change. A process to monitor changes and update your clause library, templates, and supplier flowdowns is itself part of readiness.

Making It Continuous

The Common Failure Mode

Every phase above shares a failure mode. Compliance evidence gets reconstructed from scratch each time someone asks: before an audit, during a prime's supplier review, when a key employee leaves.

Compliance as a Standing Operation

The fix is to treat compliance as a standing operation. Obligations tracked per contract. Evidence captured when the work happens. One owner for the clause library. Gaps found by your team before an auditor or prime finds them.

Choosing the Right Tool

For a small portfolio, disciplined spreadsheets and a clear owner may be enough. As programs multiply, many manufacturers move to purpose-built tools. GovComply, a veteran-owned platform built for mid-market defense manufacturers, is one example. It sits above the Enterprise Resource Planning (ERP) system rather than replacing it, tracks FAR and DFARS clause obligations by contract, manages supplier flowdown and supplier quality records, and assembles audit evidence packages. It does not make compliance determinations, handle cost accounting, or cover CMMC. (Disclosure: GPS is a GovComply referral partner.)

The Principle

Whatever the tool, the principle holds. The system should carry the knowledge, not one person.

Readiness Checklist

• SAM.gov and UEI — Active registration, renewed every 12 months. Owner: Contracts.
• CAGE code — Assigned through SAM, one per facility where needed. Owner: Contracts.
• NAICS, PSC, and size status — Codes selected, size confirmed for each code. Owner: Contracts or Business Development.
• Representations and Certifications — Complete and current, including Section 889. Owner: Contracts or Legal.
• Accounting system — Adequate for any cost-type work, unallowables segregated. Owner: Finance.
• Timekeeping — Daily entry, total-time accounting, audit trail. Owner: Finance and Human Resources.
• Purchasing system — Documented, controlled clause library, exclusion checks. Owner: Supply Chain.
• Cyber baseline — NIST SP 800-171 Revision 2, 72-hour incident reporting. Owner: Information Technology.
• SPRS score — Current self-assessment posted. Owner: Information Technology.
• CMMC — Level 2 C3PAO path in place before November 10, 2026 if handling CUI. Owner: Information Technology.
• Quality system — AS9100D, ISO 9001, or AQAP 2110 as required, Nadcap for special processes. Owner: Quality.
• First Article Inspection — Metrology and records for AS9102 packages. Owner: Quality.
• Cost or pricing data — Ability to certify above the applicable threshold. Owner: Finance.
• Export control — ITAR or EAR registration, technology control plan. Owner: Legal or Security.
• Sourcing compliance — Buy American, Berry, specialty metals, Section 889 as applicable. Owner: Supply Chain.
• WAWF — Set up for electronic invoicing before first delivery. Owner: Finance.

Reference Figures

What Is In Flux

• The FAR rewrite — The Revolutionary FAR Overhaul is rewriting the FAR in plain language and removing many non-statutory requirements. Agencies have been operating under class deviations while formal rulemaking proceeds. The proposed rule covering Parts 8, 12, 13, 15, 38, 44, and 51 was published September 18, 2026, with comments due October 19, 2026. Clause numbers and text may change. Expect conforming DFARS changes to follow.
• CAS implementation — The new CAS thresholds take effect October 1, 2026. Watch for how contracting officers apply them to modifications, options, and indefinite delivery contracts.
• TINA implementation — The $10 million DoD threshold applies by statute to contracts entered into after June 30, 2026. Confirm the implementing regulatory language and the clause in your specific award.
• CMMC Phase 2 — Assessor capacity, conditional certifications, and how contracting officers write the requirement into solicitations will all be tested after November 10, 2026.
• NIST SP 800-171 Revision 3 — Published by NIST but not yet required by DoD. A future transition is likely. Build to Revision 2 today and track the change.
• IA9100 and ISO 9001 — Both quality standards are being revised, with publication expected in 2026 and multi-year transitions to follow.

Sources

Regulations and Rulemaking

1. Acquisition.gov, Federal Acquisition Regulation — acquisition.gov
2. Acquisition.gov, Defense Federal Acquisition Regulation Supplement — acquisition.gov
3. Defense Federal Acquisition Regulation Supplement 244.302, Requirements (Contractor Purchasing System Reviews) — acquisition.gov
4. Defense Federal Acquisition Regulation Supplement 252.244-7001, Contractor Purchasing System Administration — acquisition.gov
5. Defense Federal Acquisition Regulation Supplement 252.244-7000, Subcontracts for Commercial Products or Commercial Services — acquisition.gov
6. Defense Federal Acquisition Regulation Supplement 252.242-7005, Contractor Business Systems — acquisition.gov
7. Defense Federal Acquisition Regulation Supplement 252.242-7006, Accounting System Administration — ecfr.gov
8. Defense Federal Acquisition Regulation Supplement 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting — ecfr.gov
9. Defense Federal Acquisition Regulation Supplement 252.225-7009, Restriction on Acquisition of Certain Articles Containing Specialty Metals — ecfr.gov
10. Defense Federal Acquisition Regulation Supplement 252.246-7007, Contractor Counterfeit Electronic Part Detection and Avoidance System — ecfr.gov
11. Federal Acquisition Regulation Part 31, Contract Cost Principles and Procedures — acquisition.gov
12. Federal Acquisition Regulation 52.216-7, Allowable Cost and Payment — acquisition.gov
13. Federal Acquisition Regulation 52.244-6, Subcontracts for Commercial Products and Commercial Services — acquisition.gov
14. Federal Acquisition Regulation 52.245-1, Government Property — acquisition.gov
15. Federal Acquisition Regulation Subpart 4.7, Contractor Records Retention — acquisition.gov
16. Federal Acquisition Regulation Subpart 44.3, Contractors' Purchasing Systems Reviews — acquisition.gov
17. Code of Federal Regulations, Title 48, Section 53.301-1408, Standard Form 1408, Preaward Survey of Prospective Contractor Accounting System — ecfr.gov
18. Federal Register, Federal Acquisition Regulation: Inflation Adjustment of Acquisition-Related Thresholds (August 27, 2025) — federalregister.gov
19. Federal Register, Revolutionary FAR Overhaul Parts 8, 12, 13, 15, 38, 44, and 51 (Proposed Rule, September 18, 2026) — federalregister.gov
20. Acquisition.gov, Revolutionary FAR Overhaul — acquisition.gov

Agencies and Systems

1. System for Award Management, Entity Registration — sam.gov
2. Defense Contract Audit Agency — dcaa.mil
3. Defense Contract Management Agency — dcma.mil
4. Supplier Performance Risk System — sprs.csd.disa.mil
5. Procurement Integrated Enterprise Environment — piee.eb.mil
6. Department of Defense Chief Information Officer, Cybersecurity Maturity Model Certification — dodcio.defense.gov
7. U.S. Department of State, Directorate of Defense Trade Controls — pmddtc.state.gov

Standards Bodies

1. National Institute of Standards and Technology, Special Publication 800-171 Revision 2 — csrc.nist.gov
2. International Aerospace Quality Group, 9100 Series Standards — iaqg.org

Industry Analysis

1. Redstone Government Consulting, 2026 NDAA Increases the Truthful Cost or Pricing Data Act (TINA) Threshold to $10 Million — info.redstonegci.com
2. Hunton Andrews Kurth, CAS Board Finalizes Sweeping Deregulation: Higher Thresholds, Streamlined CAS 407, and New Rules for Indefinite Delivery Contracts (September 2026) — hunton.com
3. Secureframe, CMMC Phase 2: What to Expect and How to Prepare — secureframe.com
4. APEX Quality Assurance, IA9100 in June 2026: What Aerospace Organizations Should Know Right Now — apexqualityassurance.com
5. FedBiz Access, FAR Part 44 Overhaul: What Government Contractors Need to Know — fedbizaccess.com
6. GovComply — govcomply.ai

© 2026 GPS LLC. All rights reserved.

This copyright covers the original writing, analysis, and structure of this booklet. The underlying facts, figures, and government publications cited and linked throughout are public record and not owned by GPS LLC or anyone else.

© 2026 GPS LLC. All rights reserved.