We have been writing and securing software in San Antonio since 2010. Most of that work has been commercial and regulated: clinical systems handling patient data, applications that answer to auditors, security work for organizations that would rather I not name them. This year I started the paperwork to sell to the federal government, which means I have spent an unreasonable number of evenings reading source documents instead of the blogs written by companies that sell registration services.
What follows is the arithmetic as I currently understand it. I am new to this market. Where I am guessing, I say so.
The registration itself is free. SAM.gov costs nothing. Anyone quoting you a fee is charging for the labor of filling out forms, which is a legitimate service to sell but a strange thing to buy if you have ever configured a firewall. The part people underestimate is entity validation, where SAM confirms your legal business name and physical address against third party records. If your Secretary of State filing, your bank, and your utility bill disagree about whether you are “Robles Industries LLC” or “Robles Industries, L.L.C.” you will spend weeks resolving that. Plan on four to six weeks start to finish and treat anything faster as luck.
Registration renews annually. A lapse makes you ineligible for award, and it also drops you out of the searches that contracting officers run. This is the failure mode I actually worry about for a firm our size. Registration is not difficult. It is boring, annual, and owned by nobody in particular, and boring annual tasks owned by nobody are exactly the tasks small firms drop. I put it on the calendar with a ninety day warning and a named owner, which is me.
One artifact of how slowly this material updates: the Unique Entity ID replaced the DUNS number in SAM on 4 April 2022. That was four years ago. If you land on a consultant’s site that still tells you to obtain a DUNS number, close the tab, because nothing else on that page has been checked either. I will note without much satisfaction that a government capability statement training PDF I pulled from an Air Force contracting squadron still lists DUNS in its company data block. The advice in that document is good. It has also not been touched in about a decade, and that tells you something useful about the pace of this market.
Size is judged against the solicitation, not against you
Small business status is measured against a particular NAICS code, and the code that matters is the one the contracting officer put on the solicitation rather than the primary code on your SAM profile. You can be small for one requirement and large for the next one, and firms have lost awards on protest for assuming otherwise.
For the work we do, the relevant codes are 541511 (custom computer programming), 541512 (computer systems design), and 541519 (other computer related services). All three currently carry a $34.0 million receipts-based size standard. We are not remotely close to that ceiling, which is supposed to be the point. A firm of our size competing against firms up to $34 million is already competing against companies with dedicated capture teams, proposal writers, and people whose entire job is knowing which contracting officer takes meetings. It is not a level playing field, but it is a bounded one.
The proposed rule I have opinions about
On 20 August 2026 SBA published a proposed rule that would consolidate roughly 995 separate size standards into 338, mostly by collapsing individual six-digit NAICS codes into their four- and five-digit industry groups. The methodology changes too, from a seven-factor analysis to a three-factor one built around average market size, with the existing caps removed and new floors set at 500 employees or $30.6 million.
For our industry group, NAICS 5415, the proposed standard is $531 million. Today it is $34 million.
That is roughly a fifteenfold increase, and I do not think the people writing the rule are acting in bad faith. SBA declined to lower any standard, even in the industries where its own analysis suggested a decrease, and there is a real argument that the old six-digit standards were arbitrary and that firms were being pushed off the small business cliff before they could survive open competition. I have read the reasoning. It is coherent.
I still think the effect on firms like mine is bad, and I will say why plainly. A set-aside is a mechanism for limiting the competitive field. When the field runs from a two-person shop to a company with half a billion dollars in annual receipts, the word “small” has stopped doing any work. A $500 million firm bidding a $300,000 task order is not constrained by the same overhead math I am. It can price to win, absorb the loss, and treat the award as a foothold. My firm cannot. The practitioners writing about this rule are already predicting margin compression, falling win rates for incumbent small businesses, and a spike in size protests as firms challenge newly eligible competitors. That last one is its own tax, paid by whoever files.
The comment period closes 21 September 2026. As I write this, it is still open, and the rule is not final. I have not filed my comment yet. I intend to before the deadline, and I would encourage anyone running a genuinely small technology firm to do the same, because the firms that will benefit most from this change already employ people whose job is filing comments.
The band where we can actually compete
Thresholds moved on 1 October 2025. The micro-purchase threshold went from $10,000 to $15,000. The simplified acquisition threshold went from $250,000 to $350,000. Under FAR 19.502-2, acquisitions above the micro-purchase threshold and at or below the simplified acquisition threshold are automatically reserved for small business, which puts the band at $15,001 to $350,000.
For a firm our size, that band is the whole opportunity, at least at first. Above the simplified acquisition threshold you are in rule of two territory with full proposal requirements, past performance references we do not yet have, and evaluation criteria written by people who have bought this kind of work many times before. Below $15,000 you are looking at purchase card buys that are usually already routed to a vendor someone knows.
Here is the honest math on a hypothetical $200,000 task order in that band. Call it forty to sixty unbilled hours to respond properly, assuming the requirement is close to work we already do and I am not writing a technical volume from scratch. At our internal cost that is real money, and it is money spent before any evidence that we can win. I do not know our win rate. I have zero data points. Anyone quoting you an industry average win rate for a first-time bidder is telling you about their sample, not yours.
So the rule I set for myself is a budget rather than a forecast: a fixed number of hours per month on federal business development, no more, until we have enough attempts to estimate a rate. If after a year the hit rate is bad, that is useful information, and the hours go back into commercial work where I already know what a dollar of effort returns.
What I am actually doing
The SAM registration is in progress. Our profile in SBA’s Small Business Search, which replaced the Dynamic Small Business Search and now lives at search.certifications.sba.gov, is being written with the keywords a contracting officer would plausibly type, not the ones I would use to describe myself at a conference. Those are different vocabularies and I had to be told that.
Beyond that: responding to sources sought notices even when we would not bid the eventual solicitation, because those responses are how a requirement gets scoped and how a set-aside decision gets made. Talking to primes about subcontracting, which is the least glamorous entry path and probably the correct one for a firm with no federal past performance. And reading the actual regulations rather than summaries of them, which has already saved me from two expensive misunderstandings.
I will report back when I have numbers instead of assumptions.