What the registration chain is
A contracting officer cannot award work to a company the government's records do not recognize. Before an offer can even be evaluated, five systems have to agree on the same set of facts about a firm: the state that chartered it, the IRS, SAM.gov, the Defense Logistics Agency, and the Small Business Administration. Getting those five to agree is the registration chain. It costs nothing, most of it is clerical, and it still takes new firms four to eight weeks, because the steps depend on each other in a fixed order and every step validates against the one before it.
FAR subpart 4.11 and the clause at FAR 52.204-7 make the deadline concrete. An offeror has to be registered in SAM at the time it submits an offer, and has to stay registered continuously through award. There is no waiver for "we started the paperwork." A solicitation closing next Tuesday is closed to a firm whose registration goes active next Thursday. That is the whole argument for starting the chain before a bid is in sight rather than after one appears.
The second argument for starting early: nothing here can be bought. SAM.gov registration is free. So is the Unique Entity ID, so is the CAGE code, so is the SBA profile. Third-party services will charge several hundred to a few thousand dollars to do the typing, and GSA posts warnings about them on the site itself. None of them can make the IRS match arrive faster or push an entity validation ticket up the queue.
The legal entity comes first, and the name has to match everywhere
Every later step validates against your formation documents, so the formation documents set the spelling for the rest of your federal life. Whatever the Secretary of State's record says is your legal business name, including punctuation. If the state record reads "L.L.C." with periods and your SAM entry reads "LLC" without them, that is a mismatch, and a mismatch is what turns a one-day validation into a two-week support ticket. Same for "and" versus "&", trailing commas before the entity suffix, and abbreviations of street types.
You also need a physical street address. SAM will not validate a P.O. box as the entity's physical address, and the address on file has to be the one that appears on the documents you will use to prove the entity exists. Home-based firms use the home address; that is normal and it is public.
The IRS Employer Identification Number is free and issued immediately through the online application when the responsible party has an SSN or ITIN. The catch is propagation. A brand-new EIN can take up to about two weeks before IRS records will support the automated TIN match that SAM runs, so a firm formed on Monday cannot expect an active registration by Friday no matter how clean the paperwork is. Get the EIN first and let it age while you do everything else.
Entity type matters less than founders expect. LLC, S-corp and C-corp are all eligible. What does carry rules is the SBIR and STTR programs, where 13 CFR 121.702 sets ownership and control requirements and a 500-employee ceiling including affiliates. If those programs are on your roadmap, read that section before you finalize a cap table.
The identifiers, and who issues each
Five numbers do most of the work. They are issued by different offices, on different clocks, with different renewal rules, and confusing them is the most common source of wasted phone calls.
| Identifier | Issued by | Typical time | Renewal |
|---|---|---|---|
| EIN / TIN | IRS, online application | Same day; up to 2 weeks to propagate | Permanent |
| UEI (12 characters) | SAM.gov entity validation | 1 to 3 business days if the record matches | Permanent, tied to the entity |
| CAGE code (5 characters) | DLA CAGE Branch, via SAM | A few days to 2 weeks after submission | 5-year term, renewed through SAM |
| MPIN | You set it inside SAM | Immediate | Yours to maintain |
| SBC Control ID | SBA Company Registry at SBIR.gov | Same day | Kept current per agency rules |
Getting the UEI
The Unique Entity ID replaced the DUNS number for federal awards on April 4, 2022. It is a 12-character alphanumeric string, it is issued by SAM.gov directly, and no commercial data provider is involved anymore. You cannot pick it and you cannot transfer it between entities.
Two things gate it. First, a Login.gov account with identity verification, which means a government ID and either a phone verification or a mailed code. Do this before you sit down to register, because a failed identity proofing at 11 p.m. on a deadline is a bad way to learn the process. Second, entity validation: SAM compares your legal business name and physical address against public and commercial records. Clean matches clear in about a business day.
When the match fails, you open an entity validation ticket with the Federal Service Desk and attach documentation. The usual set is a state formation document showing the exact legal name, an IRS EIN assignment letter (the CP 575, or a 147C if the original is lost), and a document tying the entity to the address, such as a bank statement or a utility bill in the entity's name. Ticket turnaround is measured in business days and can stretch past two weeks in busy periods. This single queue is the largest source of variance in the whole timeline.
SAM offers a "get a UEI only" path that stops short of full registration. That is enough to be a subrecipient on some federal financial assistance under 2 CFR part 25, and it is not enough to receive a prime award or a purchase order. If your goal is contracts, go all the way through.
Finishing the SAM registration
Full registration is four blocks of data. Core Data covers entity type, addresses, fiscal year end, electronic funds transfer information (routing number, account number, an ACH point of contact), the MPIN you choose, and ownership disclosure for any immediate and highest-level owner. Assertions covers your NAICS codes, product and service codes, size metrics such as annual receipts and employee counts, and whether you want to appear in the disaster response registry. Representations and Certifications is the FAR and DFARS block. Points of Contact names the electronic business POC, the government business POC, and the past performance POC.
The electronic business POC is the one people underestimate. That person controls your roles in downstream systems, including the Procurement Integrated Enterprise Environment, which is where DoD invoicing through Wide Area Workflow and Supplier Performance Risk System reporting live. Naming a person who has left the company is a self-inflicted outage.
Once submitted, the registration moves through IRS TIN validation, then CAGE assignment or validation, then goes Active. Budget for the possibility that you will be asked for something twice.
The CAGE code
A CAGE code is a five-character identifier assigned by the Defense Logistics Agency's CAGE Branch. For domestic entities it is assigned automatically as part of SAM registration, so there is no separate application. Firms with a foreign physical address take a different route and obtain an NCAGE from the NATO Support and Procurement Agency before registering.
Two properties surprise people. It is a location code, so a firm performing at multiple sites can hold multiple CAGE codes, and FAR 52.204-16 and 52.204-18 require reporting and maintaining the codes for each place of performance. And it carries a five-year term of its own, kept alive by keeping the SAM registration current rather than by a separate renewal.
In practice the CAGE is the key DoD systems index on. Proposal portals, contract writing systems, invoicing and cybersecurity score reporting all reference it. Civilian agencies lean more on the UEI. Carry both on your capability statement.
NAICS codes and size standards
NAICS selection confuses new registrants because the code that matters is not the one they pick. A contracting officer assigns a single NAICS code to each solicitation, and that assignment determines the size standard you are measured against for that procurement. The "primary NAICS" you set in SAM is descriptive. It shapes how buyers find you in market research; it does not decide whether you are small on a given bid.
The size standards live at 13 CFR 121.201. For the codes most software and data firms operate under, 541511 Custom Computer Programming Services and 541512 Computer Systems Design Services both carry a receipts-based standard of $34.0 million in average annual receipts. Research and development work under 541715 is employee-based instead, at 1,000 employees, with higher thresholds carved out for certain aircraft and missile subcategories. SBA adjusts the dollar standards for inflation on a multi-year cycle, so read the current table rather than a figure from a conference slide.
How the averages are computed also matters. Receipts are averaged over the firm's five most recent completed fiscal years under 13 CFR 121.104, following the Small Business Runway Extension Act. Employee counts are averaged over the preceding 24 months under 13 CFR 121.106. And under the affiliation rules at 13 CFR 121.103, you count the receipts and employees of affiliates, which is where investor-backed firms discover they are not small.
If a solicitation carries a NAICS code you believe is wrong for the work, the assignment is appealable to SBA's Office of Hearings and Appeals under 13 CFR 121.1103, and the window is short. Read it as a real remedy with a real clock, not a theoretical one. On the selection side, list the codes you can actually perform. A padded list puts your name in front of buyers for work you will have to decline, which is a worse outcome than not appearing at all.
What you are actually signing in the reps and certs
The representations and certifications block is the part of registration with legal weight, and it is the part most often clicked through. FAR 52.204-8 collects the annual representations; FAR 52.212-3 governs commercial products and services. You are certifying facts about your firm under penalty, and False Claims Act exposure attaches to false certifications.
Three areas deserve real attention before you answer. Section 889 of the FY2019 NDAA, implemented at FAR 52.204-24, 52.204-25 and 52.204-26, has you represent that you do not use covered telecommunications or video surveillance equipment as a substantial or essential component of any system. Answering that honestly means a reasonable inquiry into your own network hardware, your conference room cameras, and your cloud and connectivity vendors. FAR 52.209-5 asks about criminal convictions, civil judgments and delinquent federal tax liability for the firm and its principals. DFARS adds its own layer for defense work, including 252.204-7016 through 252.204-7018 on covered defense telecommunications services and 252.204-7019 and 252.204-7020, which require a current NIST SP 800-171 self-assessment score posted in SPRS before a covered contract can be awarded. If your roadmap includes controlled unclassified information, our note on CMMC for small AI offerors covers what that assessment involves.
While you are in a checking mood, search the SAM exclusions list for your firm, your principals and anyone you plan to name as key personnel. Exclusions are the government-wide debarment record under FAR subpart 9.4, they are public, and finding a name-match problem before a contracting officer does is worth the ten minutes.
The SBA profile and socioeconomic certifications
Small business status itself is self-certified in SAM against the size standard for the applicable NAICS code. Nobody issues you a "small business certificate," and any vendor selling one is selling nothing.
What you should complete is the SBA supplemental data, which populates your profile in SBA's Dynamic Small Business Search. That profile is a search tool used by prime contractors' small business liaison officers and by agency small business specialists doing market research. It has fields for a capabilities narrative, keywords, quality assurance standards and references. A registration that is technically active with an empty profile is invisible to exactly the people you want finding you.
The socioeconomic programs are different animals: 8(a) Business Development, HUBZone, WOSB and EDWOSB, and service-disabled veteran-owned status through SBA's VetCert, which took over from the VA's program on January 1, 2023. These require formal application and review, self-certification for WOSB ended on October 15, 2020, and SDVOSB self-certification was phased out during the SBA transition. Reviews run in months. Start them once SAM is active, and read how set-asides actually work before deciding which are worth the effort.
SBIR, STTR and grant applicants need a second registry
SAM is necessary and not sufficient for the research programs. SBIR and STTR applicants also register in the SBA Company Registry at SBIR.gov, which issues an SBC Control ID that agencies require on the proposal itself. It takes minutes and it is a hard stop at submission time if you skip it.
Each funding agency then runs its own portal with its own accounts and its own identity checks: the Defense SBIR/STTR Innovation Portal for DoD, eRA Commons for NIH, Research.gov for NSF, and Grants.gov for most civilian assistance. Federal financial assistance also brings in 2 CFR part 25, which requires the UEI for recipients and for subrecipients. Every one of these accounts can be created while your SAM registration is still pending, which is the single best use of the waiting period.
Where first-time registrations stall
Editorial weighting of failure modes drawn from public GSA and Federal Service Desk guidance. Illustrative ranking, not a measured statistic.
The rejections that cost weeks
The legal business name did not match
Copy the name character for character from the state formation record, including punctuation, spacing and the entity suffix. Trade names go in the doing-business-as field, never in the legal name field. If the state record itself contains a typo, fix it with the state first. SAM will not accept a name that its validation sources cannot corroborate.
TIN validation failed
The IRS match compares the EIN and the legal name exactly as the IRS holds them, which is what appears on the CP 575 assignment letter. Two causes dominate: the name in SAM differs from the IRS record, or the EIN is too new to have propagated. If the letter is lost, call the IRS Business and Specialty Tax line and request a 147C.
The physical address was rejected
P.O. boxes and virtual mailbox addresses are not acceptable as the entity's physical address. The address also has to appear on the documentation you submit for validation. A registered-agent address that you do not occupy will create problems at validation and again later, when a contracting officer looks at place of performance.
Documentation was submitted in the wrong form
Validation tickets get closed for legible-but-unofficial documents: an unsigned draft operating agreement, a screenshot of a state web page instead of the filed certificate, a bank statement with the address redacted. Send the filed, dated, official version, unredacted except for account numbers, and in one of the accepted file formats.
A realistic timeline, and what runs in parallel
Clean cases finish in about two weeks. Cases with a validation ticket run four to eight. The sequence below assumes a domestic firm registering for the first time with no prior federal identifiers.
First-time registration sequence
Steps 1 through 5 are serial because each validates the previous one. Everything else can run alongside them. While validation is pending, set up the agency portals, register in the SBA Company Registry, write the capability statement, choose and document your NAICS codes, get the accounting practices in shape (our note on accounting readiness covers what a government audit expects to find), and read the reps and certs in advance so that the day you answer them you are confirming decisions rather than making them.
Have these on the desk before you open SAM.gov
- The filed state formation document, showing the exact legal name
- The IRS EIN assignment letter (CP 575) or a 147C replacement
- A physical street address that matches both documents, no P.O. box
- Bank routing and account numbers, plus an ACH point of contact
- Fiscal year end date, and receipts and employee figures by year
- The NAICS codes you can actually perform, with the size standard for each
- Names and emails for the electronic business, government business and past performance contacts
Renewal, and the failure mode nobody plans for
SAM registration expires every 365 days. An expired registration means you are ineligible for award, and it can hold up payment on work already delivered. The renewal is not a single click, because it re-signs the full representations and certifications package under FAR 52.204-8, which means someone has to read the Section 889 and responsibility questions again and confirm the answers are still true.
SAM sends reminder email, and the reminders go to the addresses on file. Firms that lose a registration usually lost it because the notification went to a former employee's mailbox. Put a calendar reminder 60 days out, owned by a person and not a shared inbox, and confirm the POC email addresses at every renewal.
Changes during the year also matter. A new legal name, a move, a change of bank, a change of ownership: each requires a SAM update, and an update can re-trigger validation. Do not discover that on the week a proposal is due.
Bottom line
The registration chain is not hard work, and it is unforgiving about sequence and spelling. Form the entity, get the EIN and let it age, identity-proof at Login.gov, request the UEI, complete all four blocks of SAM with the reps and certs actually read, let the CAGE assignment land, then fill in the SBA profile and the agency portals. Firms that treat it as a two-hour errand the week a solicitation drops end up watching that solicitation close. Firms that treat it as a four-to-eight week prerequisite start bidding on their own schedule, which is the only schedule worth having.
Frequently asked questions
Two weeks is a good case and four to eight weeks is common. The variable steps are entity validation, which is fast when your legal name and address match public records and slow when a support ticket is needed, and the IRS TIN match, which can fail for up to about two weeks on a brand-new EIN.
No. Registration, the UEI and the CAGE code are all free, and support is available at no cost through the Federal Service Desk. Paid services can do the data entry, and they have no ability to speed up IRS validation or the entity validation queue.
The UEI is a 12-character identifier issued by SAM.gov that replaced the DUNS number in April 2022 and identifies the entity across all federal awards. The CAGE code is a five-character code assigned by the Defense Logistics Agency that identifies a specific location, is used heavily by DoD systems, and is issued automatically during SAM registration for domestic firms.
List the codes describing work you can actually perform. Your primary NAICS in SAM affects how buyers find you in market research. Size status on a specific procurement is determined by the single NAICS code the contracting officer assigns to that solicitation, measured against the standard in 13 CFR 121.201.
Generally no. FAR 52.204-7 requires an offeror to be registered in SAM at the time of offer submission and to remain registered through award. Grant and assistance programs have their own rules under 2 CFR part 25, and they also require the UEI. Treat registration as a prerequisite to bidding, not a parallel task.