SBIR-Ready Checklist for Small Businesses

Who this checklist is for

This page is written for the founder of a technical small business who has decided to pursue SBIR funding and wants a clean, ordered list of what has to happen before a proposal can go in. It is not a substitute for reading the agency solicitation. It is the precondition to reading the solicitation productively. If any item below is not complete, you will not be able to submit, regardless of how strong your technical idea is.

Phase 0 — Legal entity and banking

1. Legal entity formed. LLC or C-corporation. State of formation is usually the state you live in unless there is a specific reason to use Delaware. Keep ownership documentation clean and available.
2. EIN issued by the IRS. Free, applied for online at irs.gov. Typically takes 15 minutes. You will need this before anything else.
3. Business bank account open. The account must be in the legal entity's name and matched to the EIN. Mercury, Relay, and the traditional banks all work; be aware that some federal payment processes prefer an account at a U.S. bank with a routing number, so verify compatibility.
4. Operating agreement or bylaws in place. Even if you are a solo LLC, have a written operating agreement. It will be referenced during SBIR registration and in teaming conversations.
5. Ownership structure documented. SBIR requires more than 50% ownership and control by U.S. citizens or permanent residents. Document the ownership stack clearly and verify each owner's status.

Phase 1 — SAM.gov registration

SAM.gov is the System for Award Management. It is the master registry for every vendor doing business with the federal government. Every other portal and every other registration depends on your SAM.gov record being active.

1. Login.gov account created. SAM.gov uses Login.gov for authentication. Set up multi-factor authentication properly on day one.
2. Entity registration started on SAM.gov. The flow asks for legal name, EIN, physical address, primary NAICS, banking details, and several additional fields. Have everything ready before starting to avoid session timeouts.
3. UEI assigned. The Unique Entity ID replaces the legacy DUNS. It is assigned during SAM.gov onboarding.
4. CAGE code issued. The Commercial and Government Entity code comes through DLA after your SAM record is processed. This can take anywhere from a few days to several weeks depending on queue depth. Monitor your SAM status page daily.
5. Assertions and representations completed. Dozens of required FAR-driven reps and certs. Read each one. Do not click through.
6. SAM status Active. Not "submitted," not "processing." Active. Only at that point can the other portals find you.

Typical calendar time: 3 to 6 weeks end-to-end, driven almost entirely by CAGE queue and any IRS cross-validation delays.

Phase 2 — SBA SBIR Company Registry

The Small Business Administration maintains a central registry of firms eligible to receive SBIR awards. All participating agencies check this registry during proposal evaluation.

1. Account on sbir.gov. Free. Bound to your SAM UEI.
2. Firm profile completed. Ownership, size, NAICS alignment, a short company description, and confirmation that you meet the SBIR eligibility criteria.
3. Firm approval received. SBA reviews the submission and issues an approval status visible to agency evaluators.

Typical calendar time: 1 to 3 weeks after SAM activation.

Phase 3 — Agency-specific portals

Each SBIR agency has its own proposal submission portal. You must register with each agency whose topics you intend to pursue. The registrations themselves are free.

Department of Defense — DSIP

The Defense SBIR/STTR Innovation Portal (DSIP) covers the Army, Navy, Air Force, DARPA, Space Force, SOCOM, CDAO, and the rest of the DoD SBIR components. Register once, pursue all DoD topics.

• Account linked to SAM UEI.
• Firm profile uploaded, including a short capabilities statement.
• Points of contact designated for administrative, technical, and financial roles.
• Proposal volume templates downloaded and reviewed ahead of any open topic.

NSF — Research.gov

The National Science Foundation uses Research.gov for SBIR Project Pitches and full proposals.

• Organization registered on Research.gov.
• Authorized Organizational Representative identified.
• Principal Investigator profile created and linked to the organization.
• Project Pitch concept drafted to match one of the current NSF SBIR topic areas.

NIH — eRA Commons

The National Institutes of Health use eRA Commons for SBIR submissions through Grants.gov.

• Institutional profile created on eRA Commons.
• Signing Official and Administrative Official designated.
• PI account created and linked.
• Workflow rehearsed end-to-end on a practice submission before the real one.

Grants.gov — multi-agency

Several SBIR agencies accept submissions through Grants.gov as the front door. Even if your target is DoD or NSF, you will almost certainly use Grants.gov for at least one submission.

• Workspace account configured.
• Authorized Organization Representative role claimed.
• Adobe forms downloaded and tested in the Grants.gov PDF tooling, not in a browser.

Other agency portals (as needed)

Department of Energy, NASA, USDA, NOAA, Department of Education, and others each have their own portals or processes. Only register where you will actually submit.

Typical calendar time: 1 to 4 weeks across all portals, run in parallel.

Phase 4 — Proposal-ready assets

These are the documents and artifacts you will need to hand for any SBIR proposal. Build them once, reuse them across every submission, keep a master library.

1. Founder biography. One-page technical bio. Education, federal experience, prior delivery, public work. Written in the third person.
2. Capabilities statement. One to two pages describing the firm's technical capabilities, past performance, differentiators, and federal registrations. This is the reference document for every teaming call and many proposal attachments.
3. Past performance narratives. Three to five detailed descriptions of prior technical work, including customer, scope, outcome, and a reference. These must be real and verifiable.
4. Commercialization plan template. SBIR Phase II and Phase III require a plan for how the technology will reach market. Draft a reusable base version now; customize per topic.
5. Key personnel resumes. For every technical contributor named in a proposal, a current resume formatted to the agency's requested structure.
6. Indirect rate strategy. Even for Phase I, you need a position on how you account for overhead and fringe. DCAA-compliant methods only.
7. Cost volume framework. A working spreadsheet that ingests labor categories, hours, fringe, overhead, and fee and produces a total that matches agency format.
8. SF-424, SF-424A, and related federal forms. Pre-filled templates where allowed.
9. Data Rights position. Pre-decided policy on Government Purpose Rights, Limited Rights, and SBIR Data Rights assertions. Get this wrong and you lose valuable commercial leverage.

Phase 5 — Partnering readiness

SBIR proposals often benefit from subcontractors, consultants, or prime partners. Prepare the teaming infrastructure before you need it.

1. Mutual NDA template. Clean, reciprocal, reviewable by any sophisticated counterparty in under an hour.
2. Teaming agreement template. Standard provisions covering scope, fee, termination, ownership of pre-existing IP, and post-award conduct.
3. Subcontractor intake pack. The documents you will need from a sub (W-9, insurance certificates, capabilities statement, SAM status) collected once per sub and kept on file.
4. Prime partner list. Cleared primes in your capability area whose facility clearances, contract vehicles, and small-business subcontracting plans make them plausible partners.

Phase 6 — Technical readiness

Agencies want to see evidence that the proposing firm can actually build. Have technical artifacts ready to attach or demonstrate.

1. Prototype or proof-of-concept code. A working system that demonstrates a relevant technical capability. Hosted publicly where possible; screenshots and architecture diagrams where not.
2. Public technical signal. Kaggle profile, GitHub repositories, published notebooks, or a technical blog. Reviewers often search for the founder's name; give them something to find.
3. Reference architecture diagrams. One-page architecture diagrams for the kinds of systems you propose to build. Keep them generic enough to repurpose across topics.
4. Security posture documentation. Even for Phase I, a one-page statement of how the firm handles source code, secrets, and data.

Typical cold-start timeline

Common blockers

• Bank account not matching EIN. SAM.gov banking validation fails. Fix by opening a proper business account in the legal entity's name.
• CAGE code stuck in queue. There is no expediting. Register early. Do not tie a proposal deadline to a CAGE assignment you do not yet have.
• Ownership structure unclear. If a passive investor's status is ambiguous, SBIR eligibility is ambiguous. Document everything.
• Missing Authorized Organizational Representative. NSF and NIH both require this role. Designate it and test login before a deadline.
• First-time Grants.gov submission during a deadline week. The portal has quirks. Rehearse a submission with a practice package weeks before the real one.
• Proposal attachments in the wrong PDF format. Agencies specify version, embedded fonts, page limits, margin sizes. Read the solicitation precisely.

Sample checklist block

After the checklist: submitting

Being SBIR-ready is not the same as winning SBIR. Once the infrastructure is in place, the real work begins: matching your technical strength to the right agency topics, writing a proposal that addresses the evaluation criteria precisely, and — critically — aligning with a federal customer who wants the outcome and can sponsor a Phase III. Winners are almost always firms that did customer discovery before the proposal, not after the award.

FAQ

Who is eligible for SBIR?

A for-profit U.S. small business with fewer than 500 employees, more than 50% owned and controlled by U.S. citizens or permanent resident aliens (for most agencies; NIH permits certain foreign ownership structures under specific rules), where the principal investigator is primarily employed by the small business during the award period. STTR has slightly different requirements and allows more research-institution partnership.

Do I need a UEI and a CAGE?

Yes. The UEI is assigned during SAM.gov registration and replaces the legacy DUNS. The CAGE code is assigned by DLA and is required for all federal contract and grant awards. Both come through the SAM.gov process but on different timelines.

How long does SBIR readiness take from a cold start?

Six to twelve weeks is the typical range. SAM.gov registration drives the critical path because CAGE assignment is queue-dependent. Starting with a long runway before the solicitation you want to target is always better than trying to compress the timeline.

Can I pursue SBIR if I still have a W-2 job?

Technically, at the moment of Phase I award you must primarily be employed by the small business. Many founders transition full-time at the point of Phase I execution. Some agencies permit limited dual employment during Phase I pre-award stages; read the solicitation carefully.

Which agencies are easiest to win?

There is no easy agency. Win rates hover around 10 to 15 percent across programs, with some variation by topic. The better question is which agency's topics align with your specific technical strength and whether you already have a relationship with a likely end customer.