A Login.gov account
SAM.gov signs you in through Login.gov. Create the account in the name of the person who will administer the registration, with multi-factor authentication set up, before you open SAM.gov.
New to Department of Defense work
This page is step 1 of five on the path from SAM.gov to CMMC.
- Step 1 — Register in SAM.gov. You are here.
- Step 2 — Read the clauses: FCI, CUI, FAR 52.204-21, DFARS 7012.
- Step 3 — Get your result on record in SPRS (a Level 1 self-assessment for FCI-only work; a NIST SP 800-171 score where CUI is involved).
- Step 4 — Meet CMMC Level 1 or Level 2.
- Step 5 — Keep it current: renewals, affirmations, day-to-day security.
SAM.gov registration
Just registered in SAM.gov, or about to? Here is how to do it, and what comes next.
SAM.gov registration is the first step into federal contracting, and it is the easy one. The step that catches first-time contractors is the cybersecurity requirement that arrives with the first contract: every federal contract that involves Federal Contract Information carries FAR 52.204-21, and defense contracts add the DFARS clauses that lead to CMMC Level 1 or Level 2. This page covers the registration itself, what to do once it goes Active, and how to get ahead of that requirement before a solicitation makes it urgent.
Before anything else
Registration is free, and you do it at sam.gov.
There is no fee to register, renew, or get a Unique Entity ID (UEI) or CAGE code. Third-party services advertise "SAM registration" for hundreds or thousands of dollars, and some of the emails and calls a new business receives after filing with its state are exactly that. The official site is sam.gov, and the official help desk is the Federal Service Desk at fsd.gov. If a site asks for payment to register you, it is not SAM.gov.
Step 1 · Prepare
Gather these before you start, and the registration goes through in one pass.
Legal business name and physical address
Exactly as they appear on your state formation documents and your IRS records. Entity validation compares the two, and a name or address that differs by a suffix, an abbreviation, or a suite number is the most common reason a registration stalls. A P.O. Box is not a physical address.
Taxpayer Identification Number
Your EIN (or SSN for a sole proprietor) and the taxpayer name the IRS has on file. SAM.gov validates the TIN with the IRS, and a mismatch holds the registration.
Banking details for payment
Routing number, account number, and account type for electronic funds transfer. This is how the government pays you, and it is required for a registration that covers contracts.
NAICS codes
The North American Industry Classification System codes that describe what you sell. You can list several; the primary one drives how you appear in searches and which small business size standard applies. Look them up at census.gov/naics.
Validation documents, in case they are asked for
If SAM.gov cannot match your business automatically, it will ask for documents that show the legal name and physical address together: articles of organization or incorporation, the IRS letter assigning your EIN, or a current state registration. A notarized letter is no longer required for most registrations.
Step 2 · Register
The registration walks through these sections in order.
- Sign in and choose "Register Entity." Select the purpose of the registration. "All Awards" covers contracts and financial assistance and is the choice for a business that wants to sell to the government. "Financial Assistance Awards Only" is for grant recipients and is a shorter registration.
- Entity validation. Enter the legal business name, physical address, and start date. SAM.gov checks them against public records and issues your Unique Entity ID. When there is no automatic match, this is the step that asks for the documents listed above, and it is where most first registrations lose time.
- Core data. The TIN, the business types that apply to you, general information about the entity, and the financial information the government uses to pay you.
- Assertions. Your NAICS codes and product and service codes, size metrics such as annual receipts and employee count, and whether you accept government purchase cards or have EDI capability.
- Representations and certifications. The FAR and DFARS representations that would otherwise be repeated in every proposal. Read them rather than clicking through: they are legally binding statements, and several concern the business's ownership, size status, and past performance. The current FAR overhaul is moving some representations from the registration to individual solicitations, so expect the set to change between renewals.
- Points of contact. The people the government may contact about the registration, past performance, and electronic business. Keep the Entity Administrator role with someone inside the company, not a consultant.
- Submit. SAM.gov sends the TIN to the IRS for matching and, for a registration that includes contracts, sends the entity to the Defense Logistics Agency, which assigns the CAGE code. Registration can take up to 10 business days to become Active, longer if validation or corrections are needed.
UEI and CAGE code are two different identifiers
- UEI is the 12-character Unique Entity ID that SAM.gov assigns. It replaced the DUNS number in April 2022 and identifies your entity across federal systems.
- CAGE code is the 5-character Commercial and Government Entity code assigned by the Defense Logistics Agency. It identifies the location and is what DoD contracts, SPRS, and most defense systems key on.
- You do not apply for either separately. Both are assigned during the SAM.gov registration.
- Cyberneza's own: UEI T97XZHE7C5D5, CAGE 1AVJ5. You will see both on every capability statement and quote from a registered contractor.
Keep it Active
- The registration must be renewed every 365 days. There is no auto-renewal, and an expired registration cannot receive new awards.
- Set the reminder for 60 days before expiry. A renewal is faster than the first registration, but the IRS and CAGE checks still run.
- Update the registration when the legal name, address, ownership, size status, or bank details change. The representations are made as of the day you certify them.
- Since August 2025, a lapse between proposal submission and award no longer disqualifies an offer on its own; the registration still has to be Active when you submit and when the contract is awarded.
Step 3 · Active. Now what
Six things a new registration should lead to.
1. Complete your SBA small business profile
If you registered as a small business, SAM.gov feeds the SBA's Dynamic Small Business Search, which is where contracting officers and primes look for small businesses by NAICS and capability. Finish the profile: capabilities narrative, keywords, past performance references.
2. Pursue the certifications you qualify for
Veteran-Owned and Service-Disabled Veteran-Owned (VetCert), Women-Owned, HUBZone, and 8(a) are certified through the SBA, not through SAM.gov. Each is a set-aside category that limits the competition. Cyberneza is an SBA-certified Veteran-Owned Small Business; the certification is a separate application with its own document review.
3. Write a one-page capability statement
The document a contracting officer or a prime's small business liaison expects to receive: core competencies, differentiators, past performance, company data with UEI, CAGE, NAICS, and certifications. See Cyberneza's one-page capability statement as an example of the format.
4. Start reading Contract Opportunities
SAM.gov's Contract Opportunities lists solicitations, sources sought, and pre-solicitation notices. Save searches for your NAICS codes. Responding to a sources sought notice is how a new contractor gets on an agency's radar before a solicitation is written.
5. Find the primes, and expect to subcontract first
Most first federal revenue comes through a prime contractor, not a direct award. Primes with large contracts carry small business subcontracting goals and publish points of contact for exactly this. A subcontract still flows down the cybersecurity clauses, which is the next item.
6. Find out which cybersecurity clauses you will be signing
This is the step new registrants skip, and it is the one with a lead time measured in months. The clauses arrive in the contract or the prime's flow-down, and a contractor who reads them for the first time at proposal time usually cannot bid. The rest of this page covers what they require.
The requirement that comes with the contract
SAM.gov registration does not make you eligible to handle government information. The cybersecurity clauses do.
Two categories of information decide what you must implement. Federal Contract Information (FCI) is information provided by or generated for the government under a contract that is not intended for public release. Nearly every contractor handles it: statements of work, delivery schedules, correspondence about the contract. Controlled Unclassified Information (CUI) is information the government is required to protect under law or policy: technical drawings, specifications, export-controlled data, certain personnel and financial data. Handling CUI puts an organization in a different tier of requirements.
For any federal contract involving FCI, FAR 52.204-21 requires 15 basic safeguarding requirements on the systems that process it. For Department of Defense contracts involving CUI, DFARS 252.204-7012 requires implementing NIST SP 800-171, 252.204-7019 and 7020 require a current NIST SP 800-171 assessment score in the Supplier Performance Risk System (SPRS) before award, and 252.204-7021 carries the CMMC level the contract requires. CMMC is the Department's mechanism for verifying that those requirements are actually met, and it is now appearing in solicitations.
Under the current Phase 1 implementation, contracts may require Level 1 Self or Level 2 Self. Mandatory third-party (C3PAO) assessment requirements are suspended while the program is under review. The requirement in your contract is what binds you, not the phase schedule.
If you will handle FCI only: CMMC Level 1
- Applies to contractors that receive FCI but no CUI. Most first contracts and most non-defense contracts fall here.
- Implement all 15 FAR 52.204-21 safeguarding requirements: access control, identity, media handling, physical access, boundary protection, malware defense, patching, and a few more.
- Conduct a self-assessment every year and enter the result in SPRS.
- A senior official affirms compliance annually.
- Level 1 does not permit a Plan of Action and Milestones. Every requirement must be met, not planned.
- For a small business with a managed Microsoft 365 or Google Workspace environment, this is typically weeks of work, not months.
If you will handle CUI: CMMC Level 2
- Applies when the contract involves CUI. Defense manufacturing, engineering services, and anything with technical data or export-controlled information generally lands here.
- Implement the 110 NIST SP 800-171 Rev. 2 security requirements within a defined boundary, with a System Security Plan and supporting evidence.
- Produce a NIST SP 800-171 assessment score and post it in SPRS. DoD contracts with DFARS 7019 and 7020 require this before award, CMMC or not.
- Under Phase 1, Level 2 Self is a self-assessment every three years with an annual affirmation. POA&Ms are permitted only for specific requirements and must close within 180 days.
- Scope decides cost. Confining CUI to a small set of users and systems, sometimes with a secure enclave, keeps the rest of the company out of the assessment.
- Plan for months, not weeks, and start before the solicitation that needs it.
CMMC Level 2 Self readiness → · Free SPRS score worksheet → · Proposal security support →
Which one applies to you
Three signals that tell a new registrant which level to prepare for.
What the work produces or receives
Services delivered with no government technical data, drawings, or personal data usually mean FCI only and Level 1. Anything marked CUI, anything export-controlled, and most engineering or manufacturing work for DoD means CUI and Level 2. When the solicitation is silent, ask the contracting officer or the prime in writing.
Which agency you are selling to
Civilian agencies apply FAR 52.204-21 and their own agency-specific requirements. DoD applies the DFARS clause set and CMMC. If defense primes are your target customers, assume the DFARS requirements will reach you through the flow-down whether or not you ever hold a prime contract.
Where the information will live
Email, laptops, file shares, cloud applications, and a subcontractor's systems all count if government information passes through them. Deciding where CUI is allowed to live, before it arrives, is what keeps a Level 2 boundary small. Deciding afterwards means the whole company is in scope.
Common first-registration mistakes, and their cost
- Paying a third party to register. The registration is free. Worse than the fee, the vendor often becomes the Entity Administrator and the company cannot make its own updates.
- A name or address that does not match state and IRS records. The single biggest cause of a stalled validation. Fix the source record or use the exact form it carries.
- Letting the registration lapse. No new awards until it is renewed, and the renewal still waits on IRS and CAGE checks.
- Choosing NAICS codes by what sounds impressive rather than what you sell. Size standards and set-aside eligibility follow the code, and a mismatch shows up in a size protest.
- Treating the representations and certifications as click-through. They are certifications under the False Claims Act. Read the small business and ownership ones with care.
- Discovering the cybersecurity clauses at proposal time. A Level 1 gap can be closed in weeks; a Level 2 gap cannot. The proposal deadline is not the time to learn that a SPRS score is required before award.
Questions from first-time registrants
SAM.gov registration and CMMC, answered.
Is SAM.gov registration free?
Yes. There is no charge to register, renew, or obtain a UEI or CAGE code. Any site or service that charges to register you is a third party, not the government.
How long does SAM.gov registration take?
SAM.gov states that a registration can take up to 10 business days to become Active after submission. Entity validation problems, IRS TIN mismatches, and CAGE code review can extend that, which is why matching the legal name and address to state and IRS records before starting matters more than anything else.
Do I need a CAGE code?
For a registration that covers contracts, yes, and you do not apply for it separately: SAM.gov sends the entity to the Defense Logistics Agency, which assigns the CAGE code as part of the registration. DoD contracts, SPRS submissions, and CMMC assessment results are all recorded against the CAGE code.
Does being registered in SAM.gov mean I am CMMC compliant?
No. SAM.gov registration establishes that the entity exists and can be paid. CMMC compliance is demonstrated by implementing the required safeguards (15 for Level 1, 110 for Level 2), performing the required assessment, and recording the result and an annual affirmation in SPRS. The two are separate systems and separate obligations.
Which CMMC level does a new contractor need?
It depends on the information in the contract, not the size of the company. Federal Contract Information only means Level 1. Controlled Unclassified Information means Level 2. Under the current Phase 1 implementation, both are self-assessments; third-party C3PAO assessment requirements are suspended while the program is under review. The solicitation or the prime's flow-down states which level applies.
When should a new registrant start on CMMC?
Before the first solicitation that requires it. Level 1 is a matter of weeks for a small, well-managed environment. Level 2 involves a defined boundary, 110 requirements, a System Security Plan, and a SPRS score that DoD contracts require before award, and it takes months. Starting after registration, while the company is still building its pipeline, is what makes the first bid possible.
Registered, and want to know what the clauses will require of you?
Send Cyberneza the kind of work you plan to bid, the agencies or primes you are targeting, and the systems you run today. Cyberneza can identify whether you are looking at Level 1 or Level 2, define the preliminary boundary, and lay out the implementation, documentation, and evidence work in the order it needs to happen.