The thing that makes this deal different
In a commercial acquisition, the customer contracts come along. Assignment clauses get reviewed, a few consents get chased, and the revenue arrives on the other side of the close. Federal revenue does not work that way. A government contract cannot be handed to a third party at all without the government's agreement, and the government's agreement is discretionary, unscheduled, and granted by a person whose incentives have nothing to do with your closing date. Everything else in this article follows from that one fact.
The failure mode is specific and repeatable. A buyer runs a competent commercial diligence process on a target with forty percent federal revenue, prices the whole book at a software multiple, closes, and then discovers that eleven contracts need novation, one of them is a set-aside the combined company cannot hold, two are running on a facility clearance that does not survive the ownership change, and the technology the thesis was built on carries a standing government license nobody read. None of that is exotic. All of it is in the file, if the file exists.
So the useful framing for a data room in this situation is not completeness. It is answerability. Can a buyer, with the documents in the room and no further conversations, determine which contracts survive, on what timeline, under what conditions, and what the combined entity is still eligible to win. A room that cannot answer that is a room that pushes those questions past the close, where they become integration surprises with dollar amounts attached.
Where a Government-Adjacent Deal Actually Loses Value
Editorial weighting from practitioner reading of how far each finding travels toward the price. Illustrative, not a measured statistic.
Novation is a document, not a formality
Start with the structure question, because it decides how much of the rest matters. Under FAR 42.1204, a novation agreement is required when a contractor transfers all its assets, or the entire portion of the assets involved in performing the contracts, and asks the government to recognize a successor in interest. The statute behind it, 41 U.S.C. 6305, prohibits transfer of a government contract to a third party outright. The government may recognize the successor when it decides that doing so is in the government's interest. It is not obliged to.
A stock purchase that leaves the contracting party legally intact avoids the novation entirely. FAR 42.1204(b) is explicit: where the ownership changes through a stock purchase, no legal change in the contracting party occurs, and the party retains control of the assets and continues performance, a novation is not required. That is why so many government-adjacent deals get structured as stock purchases even when the buyer would have preferred assets for tax reasons. The tax benefit is real and the novation risk is also real, and they are traded against each other in the first week or they are traded against each other in a panic in month six.
If the deal is an asset deal, the room needs the raw material for the novation package before signing, not after. FAR 42.1204(e) and (f) list what the responsible contracting officer requires: the proposed novation agreement, the purchase or transfer instrument, evidence of the transferor's and transferee's corporate authority, an opinion of counsel that the transfer was properly effected, balance sheets of both parties as of the transfer date, and the consent of sureties on every contract carrying a bond. Assembling that is weeks of work. Assembling it while a contracting officer waits is how a deal ends up with contracts in limbo and an original contractor still legally on the hook, which is exactly what FAR 42.1204(c) says happens when the government does not concur.
The contract file, contract by contract
The single most useful artifact in a government-adjacent data room is a contract register with one row per active award and a real set of columns. Not a revenue summary. A register the buyer can join to everything else.
Each row carries the award number, the agency and the specific contracting office, the contract type, period of performance with option years and their exercise dates, the ceiling and the funded value separately, whether it is a prime or a subcontract and under whose prime, whether it was competed or set aside and under which program, the clause list, and the current contracting officer and contracting officer's representative by name. The ceiling and funded distinction is the one most often collapsed in a summary deck, and it matters, because ceiling is capacity and funded is money that exists.
Then the register gets joined to the government's own record. Awards are visible on USAspending and in the Federal Procurement Data System, and the entity's registration status, exclusions and representations are visible in SAM.gov. When the target's internal numbers and the public record disagree, that disagreement is a finding, and it usually means either the subcontract portion of the book is larger than presented or the target is counting task orders against ceiling rather than funding.
Two more items belong with the register and are usually absent. Every subcontract under a federal prime, with its flow-down clauses, because a target that is mostly a subcontractor has revenue that depends on relationships with primes rather than on contracts with the government, and those relationships are terminable in ways the register will not show. And every teaming agreement and mentor-protégé arrangement, since those carry eligibility consequences that outlive the deal.
Set-aside status is the asset that most often evaporates
If any part of the revenue depends on small business status, service-disabled veteran-owned status, 8(a), HUBZone, or a women-owned set-aside, the acquisition can extinguish it, and the room needs to say so plainly rather than leave a buyer to discover it.
The mechanism is size and affiliation. SBA's rules at 13 CFR 121.103 treat concerns as affiliated when one controls or has the power to control the other, and the combined receipts or employee counts are then measured against the size standard for the relevant NAICS code. A profitable small business acquired by a large acquirer is no longer small. The existing awards are not automatically pulled, but recertification obligations attach, options may not be exercisable as set-aside work, and the pipeline the seller showed the buyer is largely built on competitions the combined entity cannot enter.
Ownership-based programs are harder still. 8(a) participation and service-disabled veteran-owned status turn on who owns and controls the company, and a change of ownership either requires SBA's prior approval or terminates the status. The room should hold the current certifications, the SAM.gov representations and certifications in full, the NAICS codes each award was competed under with its size standard, and a plain statement of what the seller believes happens to each program on a change of control. That statement will be checked, and the version where the seller has already done the analysis reads very differently from the version where the buyer's counsel discovers it.
The honest accounting is to segment the revenue into three buckets before anyone builds a model. Full-and-open work that survives intact. Set-aside work with a defined runway, priced only through the current period of performance. And pipeline built on eligibility the combined entity will not have, which is worth zero and should be labeled zero rather than discounted.
Facility clearances and foreign ownership
A facility clearance is granted to a legal entity under the National Industrial Security Program and it does not travel with a transaction. Under the NISPOM, codified at 32 CFR Part 117, a change of ownership is a reportable event, and the Defense Counterintelligence and Security Agency reviews whether the cleared entity still qualifies. Depending on structure, that can mean the clearance continues, or it lapses and the successor entity must be sponsored and processed again.
Foreign ownership, control or influence is the sharper issue, and it does not require a foreign buyer to appear. Foreign limited partners in a fund, foreign debt with governance rights, a foreign parent several layers up: each can trigger FOCI review, and the remedies range from a board resolution to a security control agreement to a proxy agreement, which is a genuine constraint on how a buyer runs the company. The room should hold the current FCL status, any existing FOCI mitigation instrument, and the full ownership chain up to ultimate beneficial owners.
Separately, and often confused with FOCI, is CFIUS. A transaction involving a foreign person and a U.S. business with access to critical technology or sensitive personal data may be subject to mandatory filing, and the timelines are measured in months. Both reviews get faster when the ownership documentation is complete and slower when it is assembled reactively. That is the whole of the practical advice here: the review is not avoidable, so the only variable a seller controls is how long it takes.
Security compliance evidence, checked rather than accepted
Where a target handles Controlled Unclassified Information, DFARS 252.204-7012 requires implementation of NIST SP 800-171, and DFARS 252.204-7019 and 252.204-7020 require a current self-assessment score posted in the Supplier Performance Risk System. The score is a number the target produced about itself. Treat it accordingly.
Four documents make it checkable. The system security plan, which should name the actual systems and their boundary rather than describe a generic architecture. The plan of action and milestones, with dates, because a POA&M whose milestones all passed a year ago is a statement about how the company treats commitments. The assessment methodology showing how the score was calculated against the 110 controls. And the date the score was posted, since a score from 2022 describes a system that no longer exists.
The most productive check costs an afternoon. Take three controls that the SSP claims are implemented, pick ones that leave evidence, and ask to see the evidence. Multifactor authentication on privileged accounts: show the identity provider policy. Audit logging retained for the required period: show the retention configuration and one query against last quarter. FIPS-validated encryption for CUI at rest: show the module and its certificate number. A target with real implementation produces all three in under an hour. A target with a document produces a document.
CMMC adds a scheduled dimension. The program's phased rollout under 32 CFR Part 170 and the acquisition rule at 48 CFR mean assessment requirements are appearing in solicitations on a defined schedule through the rest of the decade. The diligence question is not whether the target is certified today. It is which of its contracts will carry a CMMC requirement at their next option or recompete, at what level, and whether the assessment path is funded. A Level 2 certification assessment through a third party is a real project, commonly in the low six figures once the remediation before it is counted, and it takes months rather than weeks.
How Long the Government Side Takes, After Signing
Planning ranges, not commitments. Every one of them depends on a queue the buyer does not control, which is the reason to start the paperwork before signing rather than after.
Federally funded technology carries rights that survive the sale
If any part of the product was built under a federal funding agreement, the buyer is not acquiring clean title in the way the term sheet assumes. Under the standard patent rights clause at 37 CFR 401.14, a contractor may elect to retain title to a subject invention, and the government retains a nonexclusive, nontransferable, irrevocable, paid-up license to practice or have practiced the invention for or on behalf of the United States. That license does not terminate because the company changed hands. The same clause carries march-in rights.
Then there is 35 U.S.C. 204, the preference for United States industry, which reaches assignees directly. Neither the contractor nor an assignee may grant an exclusive right to use or sell a subject invention in the United States unless the licensee agrees that products will be manufactured substantially in the United States. Agencies can waive it on a showing, but the waiver is a case-by-case decision. A thesis that depends on exclusive offshore manufacturing needs that waiver treated as a condition precedent.
Where the funding came through SBIR or STTR, data rights are more specific and more valuable. DFARS 252.227-7018 defines a protection period for SBIR/STTR data that begins at award and runs 20 years, unless the agency and contractor negotiate otherwise after award. When the period expires, the government holds government purpose rights in that data, permanently. So the room needs a component-level trace: which parts of the codebase and which technical data were developed under which award, on what date, and how much of the protection clock remains. A target that can produce that trace has a materially more valuable asset than one that cannot, because the one that cannot has to be priced as though the rights are unknown.
Past performance does not automatically follow the assets
Past performance is a scored evaluation factor in most federal competitions, and a great deal of a government-adjacent target's forward value sits in its CPARS record. That record attaches to the entity that performed, identified by its Unique Entity ID and CAGE code. In a stock purchase where the entity survives, the record survives with it. In an asset purchase, the buyer's ability to use that record in future proposals depends on whether the assets and the people who did the work came along, and on how each evaluation board reads it.
The room should hold the CPARS evaluations themselves, the past performance narratives the target has been using in proposals, the contract deliverables and acceptance records behind them, and a list of the individuals named as key personnel on each award. Key personnel matter twice: once because their departure is a performance risk on active contracts, and again because their résumés are load-bearing on the proposals that generate future revenue.
The recompete schedule is the other half. For every award, the room should show when it ends, whether the follow-on is planned, whether the target is the incumbent, and what the incumbency is actually worth. Incumbency helps, and it is not a guarantee. A forecast that models incumbent recompetes at ninety percent capture without evidence from the target's own history is a forecast built on optimism, and the target's own history is in the room: how many recompetes has it faced, and how many did it win.
What the room should hold, and what each gap costs
| Artifact | What it answers | What its absence costs |
|---|---|---|
| Contract register with clause lists, funded vs. ceiling, named CO/COR | Which revenue transfers, on what path, and who signs | The whole book gets priced at one multiple, and the transfer risk is discovered after close |
| Set-aside status, NAICS codes, size standards, current SAM representations | What the combined entity can still win | Pipeline carried at full value that the buyer is not eligible to compete for |
| Ownership chain to ultimate beneficial owners, FCL status, any FOCI instrument | Whether the clearance survives and what review is triggered | A months-long review starting the week after close, on classified work that stops in the meantime |
| SSP, POA&M with dates, SPRS score methodology, three controls with evidence | Whether the security posture is real or documentary | Remediation before the next option exercise, unbudgeted, on a deadline set by a contract clause |
| Component-level map of SBIR/STTR and other federally funded IP | What rights the government already holds in the asset | An exclusivity assumption in the thesis that the funding agreement never permitted |
| CPARS evaluations, key personnel by award, recompete calendar | Whether the forward revenue is defensible | A pipeline model with no basis, and key-person departures that surface at the first recompete |
| Every subcontract under a prime, with flow-downs and prime relationships | How much of the revenue depends on someone else's contract | Revenue treated as contracted when it is a relationship, terminable on terms nobody read |
The pattern across every row is the same. The artifact is cheap to produce before a process starts and expensive to produce inside one, and its absence does not read as neutral to a competent buyer. It reads as a company that has not been asked these questions, which raises the question of what else has not been asked.
Sequencing, for a seller preparing the room
The work splits cleanly into what a company can do on its own schedule and what depends on the government. Do the first category early, because the second cannot be compressed.
Start with the contract register, since everything else joins to it, and reconcile it against the public record before a buyer does. Then the set-aside analysis, which is a written statement of what happens to each program on a change of control, prepared with counsel. Then the security package: the SSP against the real boundary, a POA&M with dates the company will actually meet, and the evidence file for the controls that will get sampled. Then the IP trace, which is usually the longest single item, because it requires reading award clause lists against a component inventory that may not exist yet.
What depends on the government gets started as early as the deal permits. Novation packages are assembled from documents that mostly exist before signing. Clearance and foreign ownership questions get raised with the cognizant security agency once the transaction is far enough along to discuss. None of that moves faster because the deal is urgent, and the queue is the same length whether or not the room was ready.
One caution about scope. This is diligence preparation, not a compliance program. A seller who tries to fix every finding before opening the room will not open the room. The goal is a complete and honest picture with the remediation priced, because a buyer will accept a known cost with a plan far more readily than an unknown with a reassurance.
Bottom line
A government-adjacent data room is judged on whether it lets a buyer answer four questions without a meeting: which contracts transfer and by what mechanism, what the combined entity remains eligible to win, what rights the government already holds in the technology, and whether the security posture is a system or a document. Every one of those has a documentary answer that exists somewhere in the company today. The deals that go badly are not the ones where the answers were bad. They are the ones where nobody assembled the answers, so the price was set on a commercial read and the federal reality arrived afterward, priced at whatever it happened to cost.
Frequently asked questions
Generally yes. FAR 42.1204(b) says a novation is unnecessary where ownership changes through a stock purchase, no legal change in the contracting party occurs, and that party retains control of the assets and continues performance. Change-of-ownership reporting obligations still apply, and clearance and foreign ownership reviews are separate from the novation question.
Assembling the package under FAR 42.1204(e) and (f) is typically four to eight weeks of work, and contracting officer review commonly runs three to nine months after that, varying by agency and by how many contracts are involved. It is not a step that compresses under deal pressure, which is the argument for preparing the package before signing.
Existing awards are usually not terminated, but recertification obligations attach under SBA's rules, options may not be exercisable as set-aside work, and the combined entity is measured for affiliation under 13 CFR 121.103 going forward. The practical effect is on the pipeline rather than on the current backlog, and the pipeline is often where the value was placed.
The score is self-reported. Check the date it was posted, read the system security plan for the actual boundary it covers, read the POA&M for milestones with dates that have passed, and sample three implemented controls for evidence from the systems themselves rather than from the document.
The protection attaches to the data and its award, not to the owner, so it continues. What matters in diligence is the trace: which components came from which award, on what date, and how much of the DFARS 252.227-7018 protection period remains before government purpose rights attach permanently.