Government software contracts mostly do not buy software. Overall, in FY2025 federal agencies obligated $39.9 billion across the four codes that describe application software, per USASpending.gov. Of that, $22.6 billion bought development labor rather than a licensed product. Labor is 56.8 percent of the market. Software-as-a-service is 21.7 percent and perpetual licenses are 21.6 percent.
That split decides your whole federal strategy. I run a small veteran-owned engineering firm and I read federal solicitations every week. Founders arrive expecting a procurement problem and find a classification problem instead. The code a contracting officer writes on the solicitation sets your size standard and your competition. It also decides whether the thing you sell is legally a product or a service.
How much do federal agencies spend on government software contracts?
The four application-software codes carried $39,872,082,480 in FY2025 across 44,419 contract actions. Meanwhile, small businesses took $16.5 billion of it, or 41.5 percent. For a $40 billion federal market that share is unusually high, and the cause is simple. Most of this work arrives as discrete task orders rather than as decade-long platform awards.
Growth is the other half of the story. Also, the same four codes carried $12.2 billion in FY2021. Four years later the total is 3.3 times larger, a rise of 226.7 percent. No other vertical I have measured in this series comes close to that rate. Federal welding and fabrication work was flat over the same period and federal staffing work declined by a third.
Small firms gained ground as the market grew, but not evenly. Their share climbed from 36.3 percent in FY2021 to a peak of 44.9 percent in FY2023, then settled back to 41.5 percent. In dollar terms the small-business take still nearly quadrupled, from $4.4 billion to $16.5 billion.
Data table: obligations by fiscal year, FY2021-FY2025
| Fiscal year | Obligations | To small business | Small-business share |
|---|---|---|---|
| FY2021 | $12,202.7M | $4,427.0M | 36.3% |
| FY2022 | $22,209.5M | $8,543.0M | 38.5% |
| FY2023 | $27,074.6M | $12,165.1M | 44.9% |
| FY2024 | $34,901.8M | $15,116.3M | 43.3% |
| FY2025 | $39,872.1M | $16,538.2M | 41.5% |
Which code describes how you sell software?
Four Product Service Codes carry federal application software, and they follow the delivery model rather than what the software does. In fact, that is the single most useful fact in this article. Read the code and you know how the government thinks about the purchase.
A code ending in 01 buys labor. However, a suffix of 10 buys the same capability as a hosted service. Codes in the 7A family buy a perpetual license as a supply item. One market, three contract shapes, and a different rulebook behind each one.
| PSC | What it buys | FY2025 obligations | Share of market | To small business | Small-business share |
|---|---|---|---|---|---|
| DA01 | Business application and application development support services (labor) | $22,627.6M | 56.8% | $8,704.1M | 38.5% |
| DA10 | Business application and application development software as a service | $8,637.0M | 21.7% | $4,040.1M | 46.8% |
| 7A21 | Business application software, perpetual license | $7,240.6M | 18.2% | $3,135.2M | 43.3% |
| 7A20 | Application development software, perpetual license | $1,366.9M | 3.4% | $658.8M | 48.2% |
Note which column rewards a small firm. Specifically, software-as-a-service and perpetual licenses each run above 43 percent small business. Labor runs at 38.5 percent, the lowest of the four, because that is where the large integrators compete with cleared staff and incumbent positions. A product company that chases the $22.6 billion labor pool bids into the one part of this market where its size works against it.
Software-as-a-service is also the fastest-growing piece. Meanwhile, DA10 obligations went from $2.2 billion in FY2021 to $8.6 billion in FY2025, a rise of 287.8 percent. Perpetual licensing under 7A21 grew 156.6 percent over the same five years, and the application-development license code 7A20 grew only 65.7 percent.
The NAICS code problem nobody warns you about
Software Publishers moved in the 2022 NAICS revision. Specifically, the industry was 511210 and is now 513210. Both codes are still live in federal contract data, and the retired one carries four times more money.
In FY2025, $4.56 billion of application-software obligations sat under 511210 against $1.08 billion under 513210. Agencies are still writing solicitations against a code SBA retired. In practice, register the two codes and set your opportunity alerts on each. Otherwise you are invisible on four federal software dollars in five that name your actual industry.
The size standards differ too, and the gap favors you. For example, SBA sets Software Publishers at $47.0 million of average annual receipts. The three computer-services codes that capture most of this work sit at $34.0 million. A software company with $40 million in revenue is small under its own industry code and large under the services codes it competes in.
| NAICS | Industry | FY2025 obligations | Share of market | Size standard |
|---|---|---|---|---|
| 541512 | Computer Systems Design Services | $13,498.6M | 33.9% | $34.0M receipts |
| 541519 | Other Computer Related Services | $11,223.2M | 28.1% | $34.0M receipts |
| 541511 | Custom Computer Programming Services | $5,024.4M | 12.6% | $34.0M receipts |
| 511210 | Software Publishers (retired 2022 code, still in use) | $4,557.2M | 11.4% | Not in the current table |
| 513210 | Software Publishers (current code) | $1,081.7M | 2.7% | $47.0M receipts |
| 518210 | Computing Infrastructure Providers, Data Processing, Web Hosting | $1,005.2M | 2.5% | $40.0M receipts |
| 541513 | Computer Facilities Management Services | $340.3M | 0.9% | $37.0M receipts |
| 541519 (Exception) | Information Technology Value Added Resellers | Inside the 541519 row | — | 150 employees |
Why do services firms hold three quarters of the software money?
Software publishers hold 14.1 percent of federal application-software dollars. Meanwhile, computer services firms hold 74.6 percent. Those two numbers describe the real competitive problem for a product company, and no vendor guide I have read states them.
The $29.7 billion in the three services codes is not a mystery. For example, an agency with a mission system to modernize writes a services requirement. One award then pays for the software, the integration, the data migration and the sustainment. Your product becomes a line item inside somebody else’s contract.
Data table: share of FY2025 obligations by vendor NAICS code
| NAICS | Industry | FY2025 obligations | Share of market |
|---|---|---|---|
| 541512 | Computer Systems Design Services | $13,498.6M | 33.9% |
| 541519 | Other Computer Related Services | $11,223.2M | 28.1% |
| 541511 | Custom Computer Programming Services | $5,024.4M | 12.6% |
| 511210 | Software Publishers (retired 2022 code) | $4,557.2M | 11.4% |
| 513210 | Software Publishers (current code) | $1,081.7M | 2.7% |
| 518210 | Computing Infrastructure Providers, Data Processing, Web Hosting | $1,005.2M | 2.5% |
| 541513 | Computer Facilities Management Services | $340.3M | 0.9% |
Who the largest recipients are
The recipient list says the same thing in company names, and these are the ten largest recipients of application-software obligations in FY2025:
- Dell Marketing, $1.61 billion
- Accenture Federal Services, $1.36 billion
- Booz Allen Hamilton, $1.30 billion
- Carahsoft Technology, $1.25 billion
- General Dynamics Information Technology, $1.19 billion
- Dell Federal Systems, $1.06 billion
- Leidos, $1.05 billion
- CACI Federal, $782.5 million
- Science Applications International, $769.7 million
- Oracle Health Government Services, $714.6 million.
Count the software publishers in that list. One. The rest are resellers and systems integrators, and two of the top six are the same reseller under two contracting entities. V3Gate at $655.7 million and Minburn Technology Group at $641.4 million sit just outside the ten, and both are resellers as well.
This is why a federal software strategy is usually a channel strategy. The market is not concentrated in the way that list implies, though. Overall, the top five recipients hold 16.8 percent of the dollars and the top twenty hold 39.0 percent. Across 44,419 contract actions there is no incumbent to displace, only a crowded middle. That makes software one of the more approachable federal markets for a firm with no past performance.
Does SBA treat SaaS as a product or a service?
As a service, and that one classification is worth more to a small software company than any certification it can earn. The rule sits at 13 C.F.R. 121.1203. SBA states that subscription services and remote hosting of software on somebody else’s servers are services and not the procurement of a supply item.
Two consequences follow, and each one is good news.
The nonmanufacturer rule and SaaS
First, the nonmanufacturer rule never reaches your SaaS product. Specifically, on a small-business set-aside with a supply code, a reseller must supply the end item of a small business manufacturer or hold an SBA waiver. Sell the identical capability as a hosted subscription and that requirement does not exist, because there is no end item to manufacture.
Second, and this is the provision almost nobody cites, your cloud bill can sit outside the subcontracting limit. Under 13 C.F.R. 125.6, a small business prime on a services set-aside faces a ceiling. It must not pay more than 50 percent of the contract amount to firms that are not similarly situated. The rule then lists other direct costs a prime can exclude, and cloud computing services is one of them by name.
Read the condition carefully before you rely on it. However, the exclusion holds only where the cost is not the principal purpose of the acquisition and no small business provides the service. A six-person SaaS firm that primes an agency’s case-management requirement and runs it on a hyperscaler fits that test. Its hosting invoice stays outside the 50 percent count. A firm whose contract is the hosting itself does not fit it, and the same invoice counts against the ceiling.
A trap inside the same rule
One trap sits inside the same rule and it catches perpetual-license sellers. 13 C.F.R. 121.1203 lets SBA waive the nonmanufacturer rule for commercial software. That software must be sold to the general public in substantial quantities, and it must go to the government without modification. But if the services bundled with the license cost more than the license itself, the procurement becomes a service procurement. When a contracting officer cannot value the services, SBA assumes they are worth more and refuses the waiver.
A pointer in the regulation is worth knowing before you go looking. Also, footnote 15 to the size-standard table sends a reader to 121.1203(d) for the software waiver. Those provisions sit one paragraph later, at 121.1203(g). The rule misdirects a reader twice, because 121.1203(g)(2) also points back to a paragraph (d)(1) that does not exist.
How SBA treats each way you sell software
| How you sell it | SBA treats it as | Nonmanufacturer rule | Subcontracting limit on a set-aside | Citation |
|---|---|---|---|---|
| Hosted subscription or remote-hosted application | A service | Does not apply | 50% to firms that are not similarly situated, with cloud computing services excluded | 13 C.F.R. 121.1203(g)(3); 125.6(a)(1) |
| Perpetual license delivered as a supply item | A supply | Applies, waiver possible for commercial software | 50% of the amount paid, with the cost of materials excluded | 13 C.F.R. 121.1203(g)(1); 125.6(a)(2) |
| License plus services worth more than the license | A service procurement | No waiver granted | Services rule applies | 13 C.F.R. 121.1203(g)(2) |
| Multi-vendor hardware and software with 15% to 50% value-added services | An IT value added reseller | Applies, with the non-manufacturer rule or a waiver | Reseller rules apply, 150-employee size standard | 13 C.F.R. 121.201, footnote 18 |
One more line on the reseller row, because it explains the Carahsoft and Dell numbers above. The IT value added reseller exception carries a 150-employee size standard instead of a receipts cap. Specifically, to use it, a procurement must carry between 15 and 50 percent value-added services, measured against the total contract price. Below 15 percent the work is reclassified as manufacturing. Above 50 percent it becomes whatever service predominates.
What rights does the government get in your software?
Only the rights your commercial license already gives everyone else. FAR 12.212 is the shortest clause in federal acquisition that matters to a software founder, and it has not changed since 2007. Commercial computer software must be acquired under licenses “customarily provided to the public”, as far as those licenses agree with federal law and “otherwise satisfy the Government’s needs”.
That second qualifier is the hook, and it is how a contracting officer asks for non-standard terms. Also, beyond it, the clause closes the obvious gap. An agency that wants rights “not customarily provided to the public” must negotiate for them in writing. Without that negotiation, FAR 12.212(b) gives the government only the rights in the license attached to the contract.
Defense works the same way with one addition. DFARS 227.7202-1 repeats the customary-license rule, and then carves out the “information documenting the specific modifications” a contractor makes at government expense. For example, build a custom feature on the government’s money, and the documents that describe it are not yours alone. The base product stays under your commercial terms.
License terms off the GSA Schedule
Off the GSA Schedule, no clause grants the government rights in commercial software at all. FAR 27.405-3 covers an agency contracting other than from a Multiple Award Schedule contract. As a result, in that case no specific clause in the subpart needs to be used. The contract itself must then address the government’s rights to use, disclose, modify, distribute and reproduce the software. Also, that same section tells contracting officers to “exercise caution” with a vendor’s standard terms. On a Schedule order the Schedule contract already carries terms, so read those before you assume your own license governs.
All three of these provisions move in the proposed rules. However, the FAR overhaul would send FAR 12.212 to FAR 12.107 and FAR 27.405-3 to FAR 27.502. The two proposals appeared on September 18, 2026, at 91 FR 59406 and 91 FR 59584, and the comment period closes on October 19, 2026. Not one overhaul rule is final today. The text above is the operative text, and the proposed text is a signal of direction.
Part 27 is not a simple renumbering, and two changes inside it are worth watching. Specifically, draft FAR 27.502-2(b) would state plainly that no contract clause governs the government’s rights in commercial computer software. That imports the Defense model into the civilian FAR. The instruction telling contracting officers to exercise caution over vendor terms does not appear in the proposed text at all. Draft FAR 12.107(b) would also replace the mandatory verb in the current sentence with a recommending one. Track that single word if license terms are your defensible asset.
Do you need FedRAMP to sell software to the government?
Not always, and the legal shape of the requirement is widely misreported. In fact, fedRAMP is an obligation on agencies, not a license condition on vendors. The FedRAMP Authorization Act directs agency heads to “promote the use of cloud computing products and services that meet FedRAMP security requirements,” which is softer than most write-ups suggest.
The hard mandate comes from OMB. Memorandum M-24-15, issued July 25, 2024, tells agencies to get and keep a FedRAMP authorization for a cloud service inside its scope. Scope means services that create, collect, process, store or maintain federal information on an agency’s behalf.
M-24-15 is equally clear about what sits outside. Also, the memorandum states that FedRAMP does not apply to every use of an internet-based service by a federal agency, and lists six categories of exclusion. Single-agency systems that nobody offers as a shared service sit outside. So do social media and communications platforms used under agency policy. The list continues with search engines, widely available commercial information services that collect no federal information, and ancillary services whose compromise poses negligible risk.
If your product never touches federal information, read those exclusions first. In fact, they can save you a year of work on an authorization you do not need. If it does touch federal information, the authorization is the gate and nothing routes around it.
How many products are actually authorized?
543 certified cloud service offerings were listed on the FedRAMP Marketplace on October 14, 2026, out of 750 total listings. FedRAMP’s own program post reports 538 certified at the close of FY2026 two weeks earlier. For scale, 1,058 contractors hold the GSA software-license item number and 1,214 hold the cloud item number. The authorized field is a small fraction of the vendors already on a federal schedule.
Of the 543, agency-sponsored authorizations account for 456. Meanwhile, the old Joint Authorization Board path accounts for 52, and those are legacy designations. M-24-15 rescinded the December 8, 2011 Federal Chief Information Officer memorandum that had created the board, and it re-designated the provisional authorizations already issued. The statutory FedRAMP Board took the board’s place. A vendor shopping for a sponsor now needs an agency, not a board.
FedRAMP dates for a founder’s calendar
Two dates belong on a founder’s calendar. Then fedRAMP 20x moved into wide-scale adoption in FY26 Q3. Class B and Class C opened to all cloud service providers at the end of August 2026. FedRAMP Ready was retired at the end of July 2026. And FedRAMP stops processing new Rev5 certification applications on June 11, 2027, which makes 20x the only new path after that date.
One more date sits years out, and almost nobody discusses it, because the statute that created the program carries its own repeal. Section 5921(d)(1) of Public Law 117-263 repeals 44 U.S.C. 3607 through 3616 five years after December 23, 2022. On the current text that lands on December 23, 2027. Congress can extend it, and the OMB policy and the program would survive a lapse. But the sunset is in the law as written.
| FedRAMP status | Listings on October 14, 2026 |
|---|---|
| Certified, agency path | 456 |
| Certified, legacy Joint Authorization Board path | 52 |
| Certified, program path | 35 |
| Initial implementation | 88 |
| Legacy FedRAMP Ready | 62 |
| Agency authorization in process | 43 |
| FedRAMP in process | 13 |
| Total listings | 750 |
Is the secure software development attestation still required?
Not as a government-wide rule. In fact, this is the single most out-of-date fact in published guidance on federal software sales, and it changed on January 23, 2026.
On that date OMB issued Memorandum M-26-05, “Adopting a Risk-based Approach to Software and Hardware Security”, and one sentence in it does the work. M-22-18 and M-23-16 are “hereby rescinded” together, which removed the whole basis of the government-wide attestation rule. M-26-05 describes the old regime as having “imposed unproven and burdensome software accounting processes” that put compliance ahead of real security investment.
What replaces it is agency discretion. Instead, each agency now validates provider security with secure development principles and a full risk assessment. M-26-05 states that no “one-size-fits-all method” of reaching that result exists. Agencies must still keep a complete software and hardware inventory. The attestation form became optional for them. A software bill of materials is optional in the same way, as a contract term an agency can adopt.
The executive-order machinery behind the mandate came apart earlier. Executive Order 14144, signed January 16, 2025, built the enforcement machinery. It directed software producers to file machine-readable attestations and validating artifacts with a CISA repository. It also sent failures to the Attorney General for action. Executive Order 14306, published June 11, 2025 at 90 FR 24723, struck those subsections outright and replaced them with NIST tasking.
Where the attestation form still matters
The agency that collected the most forms then stopped. Then, on July 16, 2026, GSA Acquisition Letter MV-2026-01, Supplement 2, canceled MV-2023-02 and both of its supplements. In fact, that was the acquisition letter that had directed GSA to collect a common form on every new contract and option exercise involving software. GSA gives the reason in one line: the policy existed to implement M-22-18, and OMB rescinded that memorandum.
None of that means the form is dead. Still, it remains a cleared collection on its face, under OMB control number 1670-0052, valid through March 31, 2027. CISA’s own form page still names the two rescinded memoranda and Executive Order 14028 as its authority. A stale citation of that kind keeps a requirement alive in practice. Any single agency can still write the form into a solicitation, and M-26-05 says in terms that agencies can choose to use it.
So treat the attestation as a contract requirement rather than a legal one, and read the clause list in the solicitation in front of you. In practice, if the solicitation calls for the form, the chief executive signs it. A designated employee with authority to bind the company can sign instead. However, the alternative is an assessment by a third-party assessor organization. Four practice groups sit inside it: secure build environments, trusted source-code supply chains, component provenance, and automated vulnerability checking with a disclosure program.
The form carries one line worth reading twice. Its Privacy Act statement notes that willfully providing false or misleading information can violate 18 U.S.C. 1001, a criminal statute.
Which compliance gates actually stop a software bid?
Accessibility stops more software bids than security does, and it is the gate founders discover last. FAR 39.203(a) makes acquisitions for information and communication technology meet the accessibility standards at 36 C.F.R. 1194.1. A listed exception or exemption is the only way out.
The technical bar is older than most product teams expect. Appendix A to 36 C.F.R. part 1194 sets the bar at E207.2. User interface components and application content must conform to Level A and Level AA of WCAG 2.0. Not 2.1, and not 2.2. Non-web software gets four named exceptions, including bypass blocks and consistent navigation. Support documentation and services must conform as well, under E208.1.
Get the next point exactly right, because vendors get it wrong in two directions. Conformance is necessary. An Accessibility Conformance Report is not necessary in law. Section508.gov recommends that vendors generate a report for any information and communication technology. It calls that report a good way to address the accessibility requirements a solicitation defines. A report is the customary evidence, and a solicitation that names one as a deliverable makes it contractual in that procurement.
Relief for commercial products
Commercial products get real relief here. Specifically, FAR 39.203(d) tells an agency buying them to meet the accessibility standards that the commercial marketplace can satisfy. Then the product it picks must best address the agency’s needs. Where nothing conforming exists, FAR 39.205 lets the agency document nonavailability and buy the closest match. Each exception and exemption takes a written determination in the contract file.
The supply-chain representation is the other universal gate, and it is quick. For example, FAR 52.204-26 asks two questions: whether you provide covered telecommunications equipment or services, and whether you use any. Covered means Huawei and ZTE telecommunications equipment. It also means Hytera, Hikvision and Dahua video surveillance bought for security purposes. And it reaches anything the Secretary of Defense connects to the government of the People’s Republic of China.
Each answer follows a “reasonable inquiry”, which the clause defines as one that “excludes the need” for an internal or third-party audit. In practice, examine your vendors and your own stack. Record what you examined, then answer. The clause applies to every subcontract, including subcontracts for commercial products and services, with one internal paragraph left out.
Compliance gates for government software contracts at a glance
| Gate | What it requires | Who it binds | Citation |
|---|---|---|---|
| Section 508 accessibility | Conformance to WCAG 2.0 Level A and AA for interfaces, content and support documentation | The agency, enforced through the solicitation | FAR 39.203; 36 C.F.R. 1194.1, E207.2, E208.1 |
| Conformance report | Recommended, not required by law. Required when a solicitation names it as a deliverable | The vendor, per solicitation | Section508.gov guidance on conformance reports |
| Section 889 representation | Two representations on providing and using covered telecommunications equipment, after a reasonable inquiry | The offeror, with flowdown to all subcontracts | FAR 52.204-24, 52.204-25, 52.204-26 |
| Commercial software license rights | The government receives only the rights in the license customarily provided to the public | Both parties | FAR 12.212; DFARS 227.7202-1 |
| Secure development attestation | No government-wide requirement after January 23, 2026, and GSA canceled its own collecting policy on July 16, 2026. An individual agency can still ask | The software producer, per solicitation | OMB M-26-05; GSA Acquisition Letter MV-2026-01, Supplement 2 |
| FedRAMP authorization | Required of the agency when the service holds federal information. Six categories sit outside scope | The agency, which makes it a condition of award | OMB M-24-15; 44 U.S.C. 3613 |
Which set-asides move federal software contracts?
Set-asides carry less of this market than founders assume. Overall, across government software contracts of every kind they accounted for $7.39 billion in FY2025, which is 18.5 percent of the market. The other 81.5 percent was open competition, and small firms still took 41.5 percent of the whole market. Most small-business software money here is won without a socioeconomic preference.
Within the set-aside pool the ranking is not the one most founders expect. However, the plain total small-business set-aside carried $3.34 billion, or 45.2 percent of all set-aside dollars. Service-disabled veteran-owned set-asides came second at $1.91 billion, which is 25.9 percent. HUBZone produced $159.7 million and the whole women-owned family produced $161.8 million, together under 5 percent of the pool.
Data table: FY2025 obligations by set-aside type
| Set-aside type | FPDS code | Obligations | Share of set-aside dollars |
|---|---|---|---|
| Total small business set-aside | SBA | $3,340.7M | 45.2% |
| SDVOSB set-aside | SDVOSBC | $1,909.7M | 25.9% |
| 8(a) sole source | 8AN | $1,212.0M | 16.4% |
| 8(a) competed | 8A | $492.2M | 6.7% |
| HUBZone set-aside | HZC | $139.3M | 1.9% |
| WOSB set-aside | WOSB | $129.3M | 1.8% |
| SDVOSB sole source | SDVOSBS | $68.7M | 0.9% |
| Partial small business set-aside | SBP | $41.2M | 0.6% |
| WOSB sole source | WOSBSS | $24.0M | 0.3% |
| HUBZone sole source | HZS | $20.4M | 0.3% |
| EDWOSB set-aside | EDWOSB | $7.3M | 0.1% |
| EDWOSB sole source | EDWOSBSS | $1.2M | 0.0% |
Two patterns in the set-aside data
Two patterns in that table change what a founder does next.
The 8(a) channel runs on sole source. For example, sole-source 8(a) awards carried $1.21 billion against $492.2 million competed, a ratio of 2.5 to one. In the perpetual-license code 7A21 the imbalance is extreme: $111.8 million sole source against $10.5 million competed. An 8(a) certification in this market buys direct conversations with program offices far more than it buys a protected competition.
Veteran status is worth more in software-as-a-service than anywhere else in the market. Meanwhile, in the DA10 code alone, service-disabled veteran-owned set-asides carried $951.9 million against $700.4 million for the plain small-business set-aside. That is the only one of the four codes where SDVOSB outranks the general set-aside, and it is a genuinely unusual result.
When does the money actually move?
September is more than a fifth of the year. Specifically, these four codes saw $8.63 billion obligated in September 2025 alone, which is 21.7 percent of the annual total, against $1.86 billion in October 2024. That is a 4.7-fold difference between the last month of the fiscal year and the first, and September ran 2.3 times the next-busiest month.
The federal fourth quarter, July through September, carried $15.64 billion, or 39.2 percent of the year. The first quarter carried 16.8 percent. In fact, software is close to the worst case for year-end concentration. A license or a subscription can be obligated in a day, with no production lead time at all.
Data table: FY2025 obligations by month
| Month | Obligations | Share of year |
|---|---|---|
| Oct 2024 | $1,858.7M | 4.7% |
| Nov 2024 | $2,338.6M | 5.9% |
| Dec 2024 | $2,491.4M | 6.2% |
| Jan 2025 | $2,771.8M | 7.0% |
| Feb 2025 | $2,185.9M | 5.5% |
| Mar 2025 | $3,788.2M | 9.5% |
| Apr 2025 | $2,505.9M | 6.3% |
| May 2025 | $3,381.2M | 8.5% |
| Jun 2025 | $2,915.4M | 7.3% |
| Jul 2025 | $3,338.9M | 8.4% |
| Aug 2025 | $3,661.7M | 9.2% |
| Sep 2025 | $8,634.6M | 21.7% |
Two practical consequences follow for a small software company. As a result, your renewal and new-business pipeline is a July-through-September business whether you planned it that way or not. Your implementation capacity must survive a September that is four times an average month. A quote you offer in October competes in a thin field. October is the best month of the year to win a first small award.
Who buys, and how big are the awards?
Defense obligated $15.10 billion of the market total, or 37.9 percent. Meanwhile, Veterans Affairs is the single largest subagency buyer at $5.24 billion. The Air Force follows at $4.44 billion and the GSA Federal Acquisition Service at $3.36 billion. Health and Human Services took $3.48 billion and Homeland Security $3.02 billion.
The civilian concentration is the opportunity. Welding and staffing markets are 88 percent and 17 percent Defense respectively. Software sits in between. A founder without a cleared team or a facility clearance has roughly $24.8 billion of civilian buying to work with. Veterans Affairs leads that group, then the Centers for Medicare and Medicaid Services at $1.78 billion. The Internal Revenue Service follows at $1.12 billion.
Award sizes in government software contracts
Award sizes split sharply, and the split favors a first-time bidder more than the headline suggests. Of 44,419 contract actions, 35,965 came in at less than $1 million. However, those 80.9 percent of the awards carried 6.6 percent of the dollars. At the other end, 167 actions above $100 million carried $13.46 billion, or 33.8 percent of the market.
| Award size | Actions | Share of actions | Obligations | Share of dollars |
|---|---|---|---|---|
| Under $25,000 | 12,029 | 27.1% | $102.1M | 0.3% |
| $25,000 to $100,000 | 11,285 | 25.4% | $386.7M | 1.0% |
| $100,000 to $1M | 12,651 | 28.5% | $2,140.5M | 5.4% |
| $1M to $10M | 6,394 | 14.4% | $7,948.7M | 19.9% |
| $10M to $100M | 1,937 | 4.4% | $15,838.3M | 39.7% |
| Over $100M | 167 | 0.4% | $13,459.3M | 33.8% |
The three smallest bands matter because of where they sit against the thresholds. Specifically, FAR 2.101 sets the micro-purchase threshold at $15,000 and the simplified acquisition threshold at $350,000. Each one rose on October 1, 2025, from $10,000 and $250,000. A subscription of less than $15,000 can be bought on a government purchase card with no competition at all. Between $15,000 and $350,000, FAR 19.502-2 reserves the work for small business. Cost accounting becomes a question only on cost-reimbursement work, which is where DCAA-compliant accounting starts to matter.
Above that, simplified procedures still reach a long way for commercial software. Also, FAR 13.500(a) lets a contracting officer use simplified procedures for commercial products and services up to $9 million. That ceiling rises to $15 million for the cases at FAR 13.500(c). That ceiling is the quiet advantage of selling something genuinely commercial.
How do you get on a contract vehicle?
Four GSA Multiple Award Schedule item numbers carry government software contracts, and the one you choose follows the delivery model again. Getting on the GSA Schedule takes months, so pick the item number before you start rather than after. One number causes confusion worth heading off: GSA’s software-license item number is 511210, which reuses the NAICS code SBA retired in 2022. They are different numbering systems that happen to collide.
| Item number | Title | Subcategory | Contractors | Use it for |
|---|---|---|---|---|
| 511210 | Software Licenses (a GSA item number, not the retired NAICS code) | IT Software | 1,058 | Term and perpetual licenses, including maintenance |
| 54151 | Software Maintenance Services | IT Software | 600 | Customized changes to software, priced apart from the license |
| 518210C | Cloud Computing and Cloud Related IT Professional Services | Cloud Services | 1,214 | Infrastructure, platform and software as a service |
| 54151S | Information Technology Professional Services | IT Services | 5,074 | Implementation, integration, migration and development labor |
Pricing and subcontracting paths
One development belongs on the price side of your plan. GSA’s OneGov strategy negotiates government-wide discounts directly with software publishers, and 26 of those agreements were live on October 14, 2026. The published terms are steep. Adobe runs at 70 percent off and SAP at up to 80 percent. Salesforce lists Slack Enterprise Plus at $132.30 a year. Several artificial-intelligence vendors sit at less than a dollar per agency for an initial term.
Those are the price points a contracting officer now has in view when your quote arrives. GSA states that an agency must still obey FAR 8.4 ordering procedures and document fair opportunity. A OneGov agreement is a pre-negotiated price rather than a sole-source award. GSA also notes that the early limited-time offers run through resellers, which is one more reason the channel question comes before the pricing question.
Subcontracting is the other way in, and in this market it is a serious one. The $29.7 billion held by systems integrators is work that needs software inside it. Winning federal subcontracts puts your product on a program without a schedule, a sponsor or a past-performance record of your own.
What does a software company need before it can bid?
The entry list is short, and almost all of it is free. Do these seven things in order:
- Register the entity in SAM.gov and get a UEI and a CAGE code
- Claim both 513210 and 511210, plus the services codes your delivery model touches
- Decide whether you sell a license, a subscription or labor, because that answer drives every rule above
- Produce an accessibility conformance report against WCAG 2.0 Level AA before a solicitation asks for one
- Complete the Section 889 reasonable inquiry and write down what you checked
- Price a FedRAMP path only after you read the six exclusions in OMB M-24-15
- Post a NIST SP 800-171 self-assessment if Defense is a target, which is the same control set behind CMMC Level 1
- Write a one-page capability statement that names your delivery model, your authorizations and your federal references.
The hard part after registration
None of that is the hard part. The hard part is the 44,419 contract actions. They arrive across six agencies, four item numbers and four codes, and a fifth of them land in September.
The document that tells you whether your product can be bid is almost never the solicitation itself. It is an attachment. A performance work statement can hide the accessibility clause. A security addendum can name an authorization you do not hold. Or a license schedule can fight commercial terms you have no room to change.
That is the problem Procura was built for. It reads every solicitation including the attachments, and scores each opportunity against your capability statement. The compliance requirements that decide whether you can bid at all come flagged. Procura costs $399/month, against five-figure annual subscriptions for the legacy market-intelligence platforms.
Research this market for free. Procura’s free explorer has pages for NAICS 513210 (software publishers) and NAICS 541511 (custom computer programming), each showing the agencies that buy under the code, the largest contractors and open opportunities. Browsing is free and needs no login, and a free Procura account lets you save what you find and export the data.
Frequently asked questions
What NAICS code do I use for government software contracts?
Claim 513210 for Software Publishers, and claim the retired 511210 alongside it. Agencies still write solicitations against the old code, and it carried four times more money in FY2025. If you sell development or integration labor, add 541511, 541512 or 541519. If you sell hosting, add 518210. Your size standard changes with the code: $47.0 million of receipts under 513210 against $34.0 million under the three services codes.
Can I sell SaaS to the government without FedRAMP?
Sometimes. OMB M-24-15 calls for an authorization when a cloud service holds federal information for an agency. It also lists six categories that sit outside that scope. A tool that holds no federal information can fall outside. Read the exclusions against your own data flows first. The obligation sits on the agency, and the agency then makes it a term of the award.
Do I still have to sign the secure software development attestation?
Only when a contract calls for it. OMB M-26-05 rescinded M-22-18 and M-23-16 on January 23, 2026, which removed the government-wide requirement and made the form optional for agencies. GSA then canceled its own collecting policy, Acquisition Letter MV-2023-02, on July 16, 2026. The CISA form remains a cleared collection through March 31, 2027, so any agency can still ask. Read the clause list in your solicitation rather than a blog from 2024.
Does the government get the source code?
No, not for commercial software. FAR 12.212 limits the government to the rights in the license you customarily provide to the public, and anything beyond that takes a negotiated addendum. DFARS 227.7202-1 adds one Defense-specific carve-out for documentation of modifications made at government expense. A custom development contract under a services code is a different matter and allocates rights under FAR part 27.
How do small software companies compete with Carahsoft and Dell?
Usually through them rather than against them. Resellers hold the schedule, the ordering relationships, and the 150-employee size standard that the IT value added reseller exception grants. A reseller agreement puts your product on contract vehicles you have not won. The alternative route is prime work below $350,000, where FAR 19.502-2 reserves the competition for small business and 35,965 of last year’s actions landed.
Is a VPAT required to sell software to the government?
Conformance is necessary and the report is not, in law. FAR 39.203 makes information and communication technology acquisitions meet the standards at 36 C.F.R. 1194.1. Those standards set the bar at WCAG 2.0 Level A and AA. Section508.gov recommends that vendors supply an accessibility conformance report as evidence. A solicitation that lists one as a deliverable makes it mandatory for that procurement. Produce one anyway, because it is the cheapest gate on this list to clear early.
Which agencies buy the most software from small companies?
Veterans Affairs leads the subagencies at $5.24 billion, and the whole market ran 41.5 percent small business in FY2025. Software-as-a-service is the friendliest code at 46.8 percent small business, and civilian buyers hold about $24.8 billion of the total. For a company without a cleared team, three doors are the largest. They are Veterans Affairs, the Centers for Medicare and Medicaid Services, and the Internal Revenue Service.
Book a demo
Bring a solicitation you were not able to judge. We will run it through Procura, and you can compare the fit score and the compliance flags against what you found by hand.
