What a systems integrator needs from you

Onboarding is a different test than selection

The capability conversation ends the moment someone in the integrator's supply chain organization sends the first email. That email carries a portal invitation, a master agreement, a flow-down exhibit, an insurance requirement sheet, and a request for reps and certs, and it wants all of it inside a week. Specialists read this as bureaucracy. It is not. Selection was a judgment about your skill. Onboarding is a test of whether you can be absorbed into a delivery machine that is already running, without slowing it down.

The distinction matters because different people make the two decisions. The person who picked you was a solution architect, a capture lead, or a delivery director with a hole in a plan. The people who onboard you are contracts, supply chain, security, IT, and accounts payable, and none of them evaluated your technical work. To them you are a new node to be wired into a running system without breaking it. Every request they make is an interface specification. Answer them that way and the process takes three weeks. Argue as you would about architecture and it takes three months.

The integrator has also told a customer the work starts on a date. If your onboarding slips that date, the delivery director who fought to add you now owns a problem. That memory outlasts your first year of contribution.

The paper stack, and what each layer actually binds

Most specialists picture the relationship as one document. It is five or six, they arrive out of order, and they bind different things. Confusing them is the most common cause of a firm working for weeks against a signature that authorizes no payment.

Document	When it lands	What it binds	What to read first
Proprietary information agreement	Before any technical discussion	What you may repeat, to whom, for how long	Term, residuals clause, whether it is mutual
Teaming agreement	Before the bid, if there was one	Exclusivity for the pursuit, proposal support, intended scope	Expiry, and whether it obligates anyone to sign a subcontract
Master subcontract agreement	At or just after selection	The relationship: flow-downs, IP, payment, audit, termination	The flow-down exhibit and the intellectual property article
Statement of work exhibit	With or shortly after the master	What "done" means, deliverables, the acceptance path	Acceptance criteria and any data deliverable list
Work authorization or task order	Before anyone may charge	Funded ceiling, period of performance, charge code	The ceiling, and who notifies whom as it is approached
Purchase order in the supplier portal	Often last, sometimes after work starts	The number your invoice must quote to be payable	Whether value and dates match the work authorization

The master agreement deserves real time, because it is written once and governs every future order. Its flow-down exhibit is frequently a list of clause numbers with no text. Ask for the text. "52.203-13" means one thing on a $200,000 order and something heavier on a program that runs six years.

The work authorization is the one specialists skip and should not. A master agreement can be fully executed while no money is authorized, and an engineer who starts on a verbal "we're good, get going" is working at risk. Ask for the charge code in writing before the first hour is booked. No competent program manager is offended by that.

Flow-downs are mandatory, but the set is not automatic

A prime is required to push certain government clauses into its subcontracts. It is also under commercial pressure to push down everything, because the cheapest way to manage risk is to hand it to the next tier. Both are true at once. Know which clauses are genuinely required, so you can spend negotiating capital on the ones that are not.

FAR 52.244-6, which governs subcontracts for commercial products and commercial services, carries a defined list. In its October 2025 form it requires flow-down of, among others, 52.203-13 Contractor Code of Business Ethics and Conduct, 52.203-19 on internal confidentiality agreements, 52.204-21 Basic Safeguarding of Covered Contractor Information Systems, 52.204-25 on covered telecommunications equipment, 52.204-30 Federal Acquisition Supply Chain Security Act Orders, 52.219-8 Utilization of Small Business Concerns, 52.232-40 on accelerated payments to small business subcontractors, and a long run of labor clauses at 52.222-21 through 52.222-62.

Several carry real work rather than a signature. FAR 52.204-21 sets fifteen basic safeguarding requirements and flows down wherever federal contract information will reside in or transit your system, excepting commercially available off-the-shelf items. FAR 52.204-25 implements both halves of Section 889, naming Huawei, ZTE, Hytera, Hikvision, and Dahua with their subsidiaries and affiliates, and the second half asks whether you use such equipment anywhere in your business, not only on this contract. FAR 52.203-13 requires a written code of business ethics within thirty days of award and, above the threshold at FAR 3.1004(a), an internal control system and an ethics awareness program within ninety days.

On defense work the DFARS layer sits on top. DFARS 252.204-7012 flows down without alteration except to identify the parties, into any subcontract for operationally critical support or involving covered defense information, and it carries seventy-two-hour incident reporting to dibnet.dod.mil. If cloud services are involved, DFARS 252.239-7010 flows down to every subcontract that touches them, requires the safeguards in the DoD Cloud Computing Security Requirements Guide in effect when the solicitation issued, keeps government data inside the United States or its outlying areas absent contracting officer approval, and requires images and monitoring data preserved at least ninety days after an incident. If government property will be in your hands, FAR 52.245-1 flows down and obliges the prime to review your property management system, so someone will ask to see it.

What is usually negotiable is the commercial layer the integrator adds on its own account: unlimited liability, broad indemnities, audit rights with no notice period, non-solicitation terms that reach your whole staff, and intellectual property assignment that sweeps in background technology you brought with you. Those are business terms, not regulatory obligations, and treating them as flow-downs is how firms sign away what nobody required them to give.

The cyber gate has a calendar, and it is not yours

On defense work this is now the most common reason a start date slips, because the requirement is checkable and the integrator can see your answer before you send it.

DFARS 252.204-7019 defines a current assessment as one not more than three years old unless the solicitation says otherwise, and requires the summary level score to be posted in the Supplier Performance Risk System. DFARS 252.204-7020 then binds the prime directly: it may not award a subcontract subject to NIST SP 800-171 implementation unless the subcontractor completed at least a Basic assessment within the last three years. That is a prohibition on the integrator, not a preference. An analyst who queries SPRS and finds nothing has no discretion to proceed.

The Cybersecurity Maturity Model Certification requirement arrived as DFARS 252.204-7021, carrying a November 2025 clause date, with the companion solicitation provision at 252.204-7025. The contracting officer inserts the required level, and the four statuses are Level 1 (Self), Level 2 (Self), Level 2 (C3PAO), and Level 3 (DIBCAC). The clause requires the prime to flow down the correct level and to confirm the subcontractor holds a current certificate or status appropriate to the information flowed down. DFARS subpart 204.75 draws a line at the end of the decade: until November 9, 2028 the clause applies when the program office or requiring activity determines a specific level is required, and on or after November 10, 2028 whenever contractor information systems will process, store, or transmit federal contract information or controlled unclassified information. Until then it is a program-office decision, so ask which level applies to this effort rather than assuming.

One honest caveat. The clause names NIST SP 800-171 as the control set without pinning a revision on the face of the requirement, and which revision governs has been a moving question. Ask which revision the flow-down specifies before you compute a score, because the answer changes the arithmetic.

Identity, badging, and the access path

An engineer who cannot log in is not billable. Access is the longest lead item in the sequence and the one specialists start last.

Three paths run in parallel and none substitutes for another. The first is the integrator's own identity system. Large aerospace and defense primes commonly use a shared supplier identity layer rather than issuing accounts directly; Exostar's Managed Access Gateway is the widest example, with Boeing, Lockheed Martin, RTX, BAE Systems, Honeywell, Huntington Ingalls Industries, and Rolls-Royce among the named users of its supplier network. Registration there is organizational, so whoever holds your administrator account becomes a dependency for every future hire.

The second is government-controlled access. FAR 52.204-9 implements HSPD-12, OMB M-05-24, and FIPS 201, and it flows down whenever subcontractor employees need routine physical access to a federally controlled facility or routine access to a federally controlled information system. It also obliges you to account for every piece of government-issued identification and return it when an employee leaves or the work ends. Sponsorship comes from the prime, which puts the prime's security office on your critical path in week one, not week five.

The third is the program's own environment: repositories, build systems, ticketing, and whatever enclave the data lives in. Ask early whether your engineers work on integrator-furnished laptops or on your own devices under a management profile, because that decides whether your development environment survives contact with the program. Ask whether accounts are issued on the integrator's tenant, since a second email address changes your records retention and puts your correspondence inside their discovery obligations.

Your rates have to survive someone else's rate structure

This is the step specialists underestimate most. A large integrator prices work against a labor category structure it negotiated with the government years ago. Each category has a title, a minimum education requirement, a minimum years-of-experience requirement, and a ceiling rate. Your "senior machine learning engineer at $215 an hour" is not something the pricing system can accept. It has to become a specific category on their schedule, and your engineer has to meet that category's stated minimums or the file needs a documented substitution rationale, typically trading additional years of experience for a missing degree where the contract permits it.

Map your people to that structure before anyone asks. Send a table with your title, their category, the person's degree and year, their years in the discipline, and your rate against their ceiling. An analyst who receives that can price the work in an afternoon. One who receives a free-text rate sheet builds the table themselves, after everything else on their desk.

Two things move the number besides the ceiling. If the subcontract is cost-reimbursement, the integrator will ask whether your accounting system has been determined adequate for such awards and will want your provisional indirect rates, because your numbers land inside their cost volume and have to be defensible there. And if the prime award is a small business set-aside, the limitations on subcontracting apply: FAR 52.219-14 holds the prime to paying no more than fifty percent of the amount paid by the government to firms that are not similarly situated entities, where a similarly situated entity is a first-tier subcontractor with the same small business program status that also qualifies as small under the NAICS code assigned to that subcontract. That one definition decides whether your share is a rounding error or the center of the bid.

What the engineering organization needs, as distinct from contracts

Once the paperwork clears, a second onboarding starts, run by people who never saw any of it. It is shorter, and it decides whether you are asked back.

An interface, not a team. The integrator owns the system. Your piece has inputs, outputs, and a contract in the software sense: schemas, error behavior, latency expectations, a versioning story. Write it down in week one and send it to their architect. It converts you from a staffing line into a component with an owner.

Their definition of done, not yours. Large programs have a configuration management process, a code review gate, a security scanning threshold, and an artifact repository, and those gates apply to your commits on day one. Ask what the merge criteria are, what scanner runs, and what score blocks a build. A specialist whose first pull request fails four gates nobody mentioned looks slow when the real problem was an unasked question.

Deliverables that match the data item list. If the prime contract carries data deliverables, your statement of work exhibit likely inherits some, each with a format, a submission path, and a review period. Learn which of your outputs is a contract deliverable and which is working material; the two carry different consequences for being late.

Secure development evidence. Federal buyers increasingly ask software producers to describe their practices against NIST SP 800-218, the Secure Software Development Framework, at version 1.1 from February 2022 with a companion publication at SP 800-218A. If the integrator has made attestations about the software it delivers, your practices have to be consistent with them. Keep a written description of your build pipeline, dependency management, and vulnerability handling ready.

Status in their format, on their cadence. Program offices run a rhythm: weekly status against a work breakdown structure, a risk register with owners and dates, a monthly financial roll-up. Adopt it, so your inputs go into a customer deck without anyone rewriting them.

Durations vary by integrator and by whether a government approval sits in the path. The ordering stays fixed, and the two longest steps are the ones you can start earliest: the cyber pack and the access request.

The invoice has to clear a machine, not a person

Getting paid is a technical problem with a known solution, and firms lose their first ninety days to it. An invoice at a large integrator is matched automatically against a purchase order number, a line item, a charge code, and a period. If any of the four is wrong or missing, it is rejected without a human reading it, and the rejection notice frequently goes to the address that registered the portal account rather than to whoever sent the invoice. Confirm all four in writing before the first submission, and confirm who receives rejections.

Know the payment chain. The integrator pays you, the government pays the integrator, and the second event usually precedes the first. FAR 52.232-40 requires a contractor that receives accelerated payments from the government to make accelerated payments to its small business subcontractors within fifteen days of receipt, and to include that clause in subcontracts with small business concerns. It is a real obligation, not a guarantee of a date, so plan cash assuming the first cycle is the slowest.

Expect reporting requests that are not about you. Under FAR 52.204-10 the prime reports first-tier subcontract awards in the FFATA subaward reporting system by the end of the month following the month of award, which is why you are asked for your unique entity identifier, your parent company's identifier, your place of performance down to the congressional district, and a NAICS code. If the prime carries a subcontracting plan under FAR 52.219-9, it reports through the electronic subcontracting reporting system on a fixed calendar: the Individual Subcontract Report semiannually for the periods ending March 31 and September 30, due thirty days after each close, and the Summary Subcontract Report annually by October 30. That calendar is why a request for your socioeconomic data arrives in April and October and needs an answer that week.

What to have ready before the first email arrives

Assemble this once and keep it current. One folder is the difference between a three-week onboarding and a three-month one.

• Entity identity block: unique entity identifier, CAGE code, legal name and address exactly as registered, parent identifier if any, and current SAM registration status.
• Size and socioeconomic representation under the NAICS code the subcontract will carry, not the code you prefer, plus which certifications are certified and which are self-certified.
• Cyber pack: current SPRS summary level score with its assessment date, a system security plan, a plan of action and milestones, and your CMMC status if the work touches defense information.
• Labor category map: your titles, your rates, and the education and experience each named person holds, ready to align to the integrator's category structure.
• Accounting posture: your accounting system's status for cost-reimbursement work, timekeeping practice, and provisional indirect rates.
• Insurance certificates: general liability, professional liability, cyber, workers compensation, plus the ability to add the integrator as an additional insured and raise limits quickly.
• Section 889 and supply chain answers, plus a written description of your build pipeline and vulnerability handling.
• Named availability: who works on this, at what percentage, starting when, and what happens if the start date moves a quarter.
• One point of contact with authority to sign, answer, and escalate.

The mistakes that make an integrator regret the pick

Redlining the flow-down exhibit. The clauses the government requires cannot be traded away by the prime. Marking them up signals that you do not know which layer you are reading, and it costs a week while someone explains it. Redline the commercial terms instead.

Treating the start date as the integrator's problem. If your access request has not moved in two weeks, escalate it yourself. The delivery director assumes silence means progress.

Letting an engineer start on a verbal go-ahead. Without a work authorization and a charge code, those hours may be unrecoverable, and the argument about them poisons a relationship that had not started yet.

Substituting the named engineer. Your named people are usually why you were selected, and a substitution in the first months reads as a bait and switch even when it is not. If availability is uncertain, say so before signing and propose the substitution path in writing.

Answering slowly. A large integrator onboards many suppliers at once. The one who returns a complete pack in two days moves to the front of a queue otherwise ordered by whoever replied last.

The regulation is moving underneath all of this

Two things are in flux, and saying so is more useful than writing as if they were settled. The federal acquisition regulation is being rewritten under the overhaul effort, which began with agency class deviations and moved to formal publication of regulatory changes announced by the Office of Management and Budget in June 2026, with the stated aim of returning the FAR to its statutory roots and removing most non-statutory rules. Clause numbering and text are shifting, so verify what your integrator's contracting activity operates under rather than trusting a year-old checklist. Separately, CMMC is phasing in against the November 2028 boundary above. Neither changes what an integrator needs. They change which document you read when you check.

Bottom line

An integrator that selected you has already decided you can do the work. What it needs next is proof that adding you does not add risk: a paper stack read at the right layer, flow-downs accepted without argument and commercial terms negotiated with confidence, a cyber posture posted rather than promised, people who map cleanly to a category structure someone else built, and an invoice that clears the first time. All of it is checkable. Firms that treat onboarding as a delivery task rather than an administrative annoyance start billing weeks earlier, and they are the ones called for the next program without competing for it.

Frequently asked questions