This guide is the checklist behind a US bid: every registration, certificate and signature, grouped by when a solicitation asks for it, with who can lawfully do each one. For how federal contracting works overall (where opportunities are posted, thresholds, set-asides, evaluation, getting paid), see How to win US federal contracts.
Before you bid
Identity and tax numbers
1. Login.gov, one per person. Every person who works in SAM.gov signs in through their own Login.gov account with multi-factor authentication.
- Cost and time: free; minutes.
- Who does it: each individual. The Rules of Use require users to keep their login confidential and claim only their own identity, so your officer creates theirs and a consultant uses their own.
- From abroad: the same; foreign officers can create Login.gov accounts.
2. EIN (US companies). The IRS Employer Identification Number is the tax ID SAM.gov validates against IRS records, and state vendor systems such as Texas’s CMBL require it.
- Cost and time: free; minutes online for a company with a US principal place of business.
- Valid: permanent.
- Who does it: an accountant can file it with your responsible-party details. Use the legal name exactly as it will appear in SAM: a TIN mismatch causes delays of weeks.
3. NCAGE code (foreign companies). A foreign company needs an NCAGE code before SAM registration; US companies get a CAGE code automatically during SAM processing. More in How to register in SAM.gov.
- Cost and time: free; up to 3 business days per a GSA international guide.
- Valid: ongoing; keep the name and address in sync with SAM.
- Who does it: a consultant checks the NSPA eportal for an existing code and prepares the request. For India it goes to the Directorate of Standardisation with GST, PAN, Udyam and address proof. You supply the documents and confirm the legal name and address.
SAM.gov
4. Full entity registration (“All Awards”). Required by FAR 52.204-7: you must be registered when you submit an offer and remain registered through final payment. It gives your Unique Entity ID and CAGE.
- Cost and time: free; an average of 7–10 business days, or 2–8 weeks when the IRS name and TIN match fails.
- Valid: 365 days; renew every year.
- Who does it: your employee, officer or board member holds the Entity Administrator role and assigns a consultant the Data Entry role. The consultant registers, updates and renews under their own Login.gov, and SAM records their contract start and end dates. You enter or confirm the EFT bank details yourself.
- From abroad: NCAGE first; no TIN unless the company pays US taxes; a foreign or US bank account works for EFT.
5. Entity Administrator Appointment Letter (only if nobody holds the role). A notarized letter on company letterhead naming an insider as Entity Administrator. Since the 2025 OMB-approved change, GSA collects it only when nobody in the entity holds the role, for example after the previous administrator left. Since March 2023 the appointee must be an employee, officer or board member, never a consultant, and must already have a SAM.gov account under the email in the letter.
- Cost: free apart from the notary’s fee.
- Valid: until the administrator changes; each change needs a new letter.
- Who does it: the letter can be prepared from the current FSD template; your officer signs it before a notary and attaches it to a Federal Service Desk ticket. Abroad, a local notary can witness it.
6. Annual representations and certifications (FAR 52.204-8 / 52.212-3). Your standing answers on size, ownership, debarment, Buy American and TAA, telecom (Section 889), labor and other provisions. Submitting an offer verifies they were entered or updated within the last 12 months. The lobbying certification sits here too.
- Who does it: a consultant drafts the answers from your facts. Your authorized official reviews and attests every size, status, ownership, exclusion and origin answer before submission, because the company is liable for its agent’s errors (FAR 9.406-5).
- From abroad: a foreign firm with no US place of business cannot represent itself as small, and answers origin honestly: India and China are not TAA-designated countries.
Size and certifications
7. Small-business size status. You self-represent against SBA’s size standard for each solicitation’s NAICS code, measured as of the date of your initial offer including price. An accountant can compute your receipts or employees, including affiliates. Your authorized official signs the size or status certification (13 CFR 121.411(g)), and bidding on a set-aside is itself a deemed certification. Misrepresentation carries a presumed loss equal to the whole award, plus False Claims Act and criminal exposure. A foreign firm with no US place of business cannot be small; a US subsidiary may qualify.
8. SBA certifications, where you bid on program set-asides. Who qualifies for each program is covered in US small-business set-asides explained. For the paperwork:
| Certification | Cost | Decision time | Valid for | What only you do |
|---|---|---|---|---|
| 8(a) Business Development | Free | SBA has 90 days after the application is complete | Up to 9 years (4 developmental, 5 transitional), with annual reviews; once per lifetime | The disadvantaged owner applies and attests in their own SBA account |
| WOSB / EDWOSB | Free through SBA; third-party certifiers charge their own fees | SBA aims for 90 calendar days of a complete package “whenever practicable” | Program examination every 3 years; SAM updated annually | The woman owner applies and attests |
| HUBZone | Free | — | Recertify every 3 years | The owner applies and attests employee residency |
| VetCert (SDVOSB / VOSB) | — | — | — | The veteran owner applies, attests and genuinely controls the firm |
The package (ownership, tax and financial documents, payroll and residency evidence, the 8(a) disadvantage narrative) can be assembled for you by an accountant or consultant; the owner files and attests personally. Since January 2026 the 8(a) race-based presumption is inoperative and individual narratives are required. VetCert self-certification ended on 22 December 2024. None of these programs is open to foreign-owned firms.
Defense, GSA and cyber
9. DoD PIEE account. Since 1 October 2026 most unclassified DoD solicitations receive offers only through the PIEE Solicitation Module, and only a user with the Proposal Manager role can submit (exceptions include single-source, FAR 13.3 simplified buys, emergencies and awards outside the US).
- Cost: free; get roles approved well in advance of the closing date.
- Who does it: the PIEE help desk places your CAGE in a vendor group. Your employee acts as Contractor Account Manager and approves each user and role; each user self-registers under their own ID, with the PIEE email matching the SAM record. Whether a non-employee may hold Proposal Manager is unverified, so by default your employee clicks submit.
- From abroad: the same, keyed to the NCAGE in SAM.
10. NIST SP 800-171 score in SPRS, and CMMC. DoD contracts with DFARS 252.204-7012 (Controlled Unclassified Information) need a current NIST SP 800-171 assessment summary score posted in the Supplier Performance Risk System: free to submit, posted within 30 days of the assessment, valid 3 years unless the solicitation says less. A cyber consultant can help run the self-assessment and system security plan; your senior official affirms the score under their own PIEE access. Where a solicitation names a CMMC level, only Level 1 (Self) and Level 2 (Self) can currently be designated, because DoD suspended Phase 2 on 13 July 2026; Level 2 assessments are valid 3 years with an annual affirmation your affirming official signs.
11. GSA Multiple Award Schedule pre-steps. New MAS offerors complete Pathways to Success training (about 4 hours) and the Readiness Assessment (under a day), both free, within one year before submission. The assessment expects 2 years in business with 2 years of financial statements, plus past performance; firms under 2 years use Startup Springboard. Under SCP-FSS-001 an Authorized Negotiator who is your employee must complete both personally. Each negotiator registers their own FAS ID with multi-factor authentication (free), and new offerors must be listed as a SAM point of contact. Products must be TAA-compliant.
State and local registrations
| Registration | Cost | Time | Valid for | What only you do |
|---|---|---|---|---|
| California: Cal eProcure supplier registration, plus SB, Microbusiness or DVBE certification | Free | SB reportedly instant; DVBE 4–6 weeks | Certifications up to 2 years | The owner attests eligibility; an officer signs bids |
| Texas: Centralized Master Bidders List (CMBL) | $70 per year | Mailed applications or payments up to 30 days | Annual | Create your own eSystems login, pay the fee; a VetHUB owner attests eligibility |
| New York State: Vendor Responsibility Questionnaire (VendRep), plus MWBE certification | Free | MWBE “in as little as 90 days” | VRQ recertified every 6 months or on change | Your officer certifies the VRQ online; the owner attests MWBE |
| New York City: PASSPort Vendor Enrollment Package | — | — | 3 years, confirmed at each award | Your designated Signatory e-signs with their own NYC.ID |
| NYS DOL Contractor & Subcontractor Registry (public works) | $200 ($100 for certified MWBEs) | — | — | The license holder or qualifying officer signs |
California’s SB certification gives a 5% bid preference and DVBE up to a 5% incentive, but both need a California-principal-office small business; plain registration is open to anyone. Texas requires an IRS EIN (SSNs are not accepted), and VetHUB, which replaced HUB, serves only Texas-based small businesses at least 51% owned by service-disabled veterans with a rating of at least 20%. NY’s VRQ must be certified within 6 months of the proposal due date. In PASSPort, signing is a separate step from “Submit Package”. State trade licenses (such as CSLB in California or TDLR in Texas) may need an exam and usually a US entity.
Company setup, where needed
12. A US entity or subsidiary. A legal entity registered with a state Secretary of State gives a US place of business, which small-business status and set-asides need (13 CFR 121.105). It is not needed to register in SAM or to compete in full-and-open contracts. Annual state reports apply. Use an attorney: drafting formation documents for another person is unauthorized practice of law in some states, such as Ohio. You sign the formation documents as organizer or owner.
13. ITAR registration (defense articles and services). US manufacturers, exporters and brokers of defense articles or services register with the State Department’s DDTC before such activity. Fees are $3,000 a year for Tier 1, $4,000 for Tier 2, and $4,000 plus $1,100 per favorable determination over five for Tier 3; registration is annual. An export-control lawyer or consultant can prepare the DS-2032; a senior officer signs it. Foreign firms work through their US partners’ licenses.
With your offer
14. The offer itself. The signed SF 1449, SF 33 or SF 1442, the technical, management, past-performance and price volumes, and the amendment acknowledgements, delivered by the channel and deadline in Section L: email to the contracting officer, an agency portal, PIEE or GSA eBuy. Late offers are generally rejected. It goes from your own email or portal account, never a shared login. You set the price.
15. Signing authority (FAR 4.102). Offers are signed in the corporate name by someone with authority to bind the company. The default is your officer’s electronic signature, which FAR 4.502 allows where the agency accepts it. An agent may sign only with evidence of authority satisfactory to the contracting officer: an attorney drafts a bid-specific power of attorney or certified board resolution. Contracting officers may reject one, and many state forms require a corporate officer. A foreign power of attorney may need notarization or an apostille if the agency asks.
16. Buy American and Trade Agreements certificates (FAR 52.225-2, -4, -6). You certify the origin of each end product. Buy American needs 65% domestic content for 2024–2028 deliveries (75% from 2029). TAA-covered buys (GSA MAS always; supplies and services of $174,000 or more since 1 January 2026) accept only US-made or designated-country products. Origin can be mapped for you from your bill of materials, but your authorized official certifies, because a false certification carries False Claims Act risk; GSA TAA settlements have topped $28M.
17. Lobbying certification and SF-LLL (31 U.S.C. 1352). You certify that no appropriated funds were paid to influence the award and disclose any paid lobbying on SF-LLL, for contracts above $200,000 under the RFO text (historically $150,000). Your authorized official certifies and discloses.
18. Non-collusion affidavit (state and local bids). A sworn statement that your prices were arrived at independently, under laws such as NY State Finance Law §139-d or California Public Contract Code §7106, often notarized for local bids. A person with personal knowledge signs under penalty of perjury, so your officer signs it, before a notary where required; the form can be pre-filled for you.
19. Bid guarantee (SF 24), where bonds are required. Mainly federal construction above $150,000 and state or local public works. The guarantee must be at least 20% of the bid price, capped at $3 million, from a Treasury-listed surety (Circular 570) or by cash, certified check or letter of credit. A surety bond producer issues it in your name; you sign as principal and sign the indemnity agreement. Small contractors that standard markets decline can use the SBA Surety Bond Guarantee, for contracts up to $9 million (non-federal) and $14 million (federal): no fee on bid bonds, and 0.6% of the contract price on performance and payment bonds, refunded if the bond is not issued.
20. Teaming or joint-venture agreement (FAR 9.6). For a JV acting as prime, or a prime with named subcontractors. An attorney drafts it; officers of each party sign. Teaming must be disclosed, and ostensible-subcontractor and affiliation rules affect size status. A JV with a US firm is a common route into US-performed work; foreign participation in a small-business JV is capped at 49%.
21. Past performance and financial evidence. Negotiated awards evaluate past performance (FAR 15.305): you may cite federal, state, local and private contracts, and an offeror with no relevant record is rated neutral. Your proposal writer assembles the write-ups; you confirm every fact and line up the references. Financial statements show the contracting officer you are responsible, and GSA and sureties rely on them; a CPA prepares, reviews or compiles them, and a CPA who audits you should not also sign as your representative.
22. Higher-level quality certification, when the solicitation imposes it (FAR 46.202-4). ISO 9001, AS9100, ASME NQA-1 and similar, from an accredited registrar, typically valid 3 years with annual surveillance audits. The consultant who helps implement your system should not be the firm that audits it.
If you win: before the contract and during performance
| Requirement | When it applies | Who arranges it | What only you do |
|---|---|---|---|
| Miller Act performance and payment bonds (SF 25 / SF 25A) | Federal construction above $150,000; between $35,000 and $150,000 the contracting officer picks alternative payment protections; states have “Little Miller Acts” | A surety bond producer, with a Treasury-listed surety | Sign as principal and the indemnity agreement |
| Insurance (FAR 28.307-2) | Work on government installations; state and local contracts set their own limits | An insurance broker, who issues certificates naming the agency | Sign the application and pay the premium |
| E-Verify (FAR 52.222-54) | Contracts over $150,000 with at least 120 days’ performance in the US | — | Your HR officer signs the MOU and enrolls |
| Prevailing wages (Davis-Bacon; Service Contract Labor Standards) | Federal construction over $2,000 and covered service contracts | Bids priced with the attached wage determination | Sign certified weekly payrolls |
| W-8BEN-E | Foreign contractors receiving US payments | An accountant, including any treaty article | An officer signs under penalty of perjury |
| FedRAMP | Cloud services used by federal agencies | A FedRAMP-recognized assessor validates the service | Submit as the cloud service provider and run continuous monitoring |
The FAR 28.307-2 minimums are employer’s liability of at least $100,000, general liability of at least $500,000 per occurrence for bodily injury, and auto liability of $200,000 per person and $500,000 per occurrence plus $20,000 property damage, with workers’ compensation as state law requires. E-Verify is free and does not apply to work performed only abroad, contracts under 120 days, or COTS items. FedRAMP 20x renames Low and Moderate as Class B and C and certifies them without an agency sponsor; no FedRAMP fee is published. And keep SAM active: renew every 365 days through final payment.
Who does what
| Step | Who can do it | What only you do |
|---|---|---|
| Login.gov, FAS ID, PIEE user ID | Each person, for themselves | Your officers create their own |
| EIN | An accountant | Supply responsible-party details |
| NCAGE | A consultant prepares the request | Confirm the legal name and address |
| SAM.gov registration and renewal | A consultant with the Data Entry role | Hold Entity Administrator; enter or confirm EFT data |
| Reps and certs, size status | Drafted for you; an accountant computes size | Your authorized official attests |
| SBA certifications | Package assembled for you | The owner applies and attests |
| PIEE roles and submission | Prepared for you | Your employee is Contractor Account Manager and, by default, Proposal Manager |
| GSA MAS pre-steps | Evidence prepared for you | An employee Authorized Negotiator completes training and assessment |
| Offer volumes and forms | A proposal consultant | Set the price; your officer signs |
| Power of attorney, board resolution, teaming and JV agreements, entity formation | An attorney | Officers sign |
| Buy American / TAA certificates | Origin mapped for you | Your authorized official certifies |
| Non-collusion affidavits | Pre-filled for you | Your officer swears, before a notary where required |
| Bonds | A surety bond producer | Sign as principal and indemnitor |
| Insurance | A broker | Sign the application, pay the premium |
| NIST 800-171 / CMMC | A cyber consultant helps | Your senior official affirms in SPRS |
The professionals involved
| Professional | Licensed or regulated by | What they do for a bidder |
|---|---|---|
| Proposal or capture consultant | No license needed | Find and qualify opportunities; create, update and renew your SAM registration as Data Entry user; draft the volumes against Sections L and M; prepare SF 1449, SF 33, SF 1442 and SF 18 forms and amendment acknowledgements; prepare GSA MAS eOffer content |
| Certified Public Accountant (CPA) | State boards of accountancy; AICPA Code of Professional Conduct for members | Prepare or review financial statements; calculate size under SBA standards; assemble financial documents for 8(a), EDWOSB and HUBZone; prepare EIN, W-8BEN-E and SAM tax data; support surety prequalification |
| Attorney | The state bar or supreme court of admission | Draft powers of attorney and board resolutions; draft teaming and JV agreements; advise on size, affiliation, Buy American and TAA, ITAR and EAR; handle SBA size protests and bid protests (GAO, Court of Federal Claims, agency); form a US subsidiary |
| Notary public | The commissioning state’s Secretary of State (or a home-country notary) | Notarize the SAM Entity Administrator letter, sworn bid affidavits, and officer signatures on resolutions or powers of attorney |
| Surety bond producer | State insurance departments; US Treasury (Circular 570); SBA Office of Surety Guarantees | Prequalify you and arrange bid bonds (SF 24), performance and payment bonds (SF 25 / SF 25A), annual bid bonds (SF 34) and SBA Surety Bond Guarantees |
| Accredited assessors | ANAB for ISO registrars; Cyber AB and DoD for C3PAOs; FedRAMP PMO for cloud assessors | ISO 9001 and AS9100 certification, CMMC assessments, FedRAMP validation |
| Insurance broker | State insurance departments | Place the coverages the contract’s insurance clause demands and issue certificates of insurance |
| APEX Accelerator counselor | DoD Office of Small Business Programs | Free SAM.gov registration help, classes and proposal counseling |
If your company is from abroad
You don’t need a US company for full-and-open contracts; only set-asides and the SBA programs need a US place of business. Who may bid from abroad, and which products qualify, is explained in How to win US federal contracts and, for EU firms, in EU companies bidding for US government contracts. For the paperwork:
Get an NCAGE code instead of waiting for a CAGE; leave the TIN blank in SAM unless you pay US taxes, since the online EIN tool is not available to firms whose principal place of business is abroad; use a foreign or US bank for EFT; and give paying agencies a W-8BEN-E, claiming any treaty article such as the India–US DTAA. Home-country financial statements are usually accepted with an English translation, overseas and commercial references count if relevant, and certificates from accredited foreign registrars are generally accepted. A Treasury-listed surety is needed for bonds; others are acceptable only for work abroad when listed sureties are impracticable. US-site work usually needs a US-admitted insurance policy and prevailing wages apply, while E-Verify is not required when all work is performed outside the US. ITAR registration is for US persons, so you work through your US partners’ licenses.
Pitfalls
- Match your legal name exactly across IRS (or NCAGE) and SAM records; a mismatch costs weeks.
- Never let a consultant be your Entity Administrator. Since March 2023 it must be an employee, officer or board member; if nobody inside holds the role, restoring it takes a notarized letter.
- Never share Login.gov, FAS ID, PIEE or NYC.ID credentials. Every adviser acts under their own account, and offers go from your own account.
- Renew SAM every 365 days and keep reps and certs updated within 12 months.
- Bidding on a set-aside certifies your size. Never claim status you lack or use “front” ownership: rent-a-vet fronting has been prosecuted, for example 27 months and a $1.75M fine.
- Certify origin line by line. India and China are not designated countries; substantial transformation must be documented.
- Activate PIEE roles early, before the closing date.
- Report CMMC honestly. Phase 2 is suspended, but NIST SP 800-171 and the SPRS score still apply.
- Sworn affidavits are signed by your officer, never by a consultant.
- Keep your bid apart from your competitors’. No pricing or text may pass between rival offers on the same solicitation: shared preparers of competing bids are a bid-rigging red flag under the Sherman Act (§1), which the DOJ Procurement Collusion Strike Force pursues.
- An attorney may not represent you and a competing bidder on the same solicitation without informed consent.
- Never seek source-selection or competitors’ bid information. The Procurement Integrity Act bars obtaining or disclosing it (FAR 3.104).
- Check before hiring a former official. Former officials face a one-year compensation ban on contracts over $10M.
- On GSA MAS, a consultant acts only under an Agent Authorization Letter signed by your officer with the exact delegations; at least one Authorized Negotiator stays your employee.
Doing it with askTender
In the United States, your askTender Partner is added as a named user on your company’s account on SAM.gov and the agencies’ portals, and works under their own login: a Partner gets the SAM.gov Data Entry role under their own Login.gov, and offers go from your own account by default. You keep your own login and sign only what the law reserves to you: holding the Entity Administrator role, attesting size, ownership and origin, signing offers, affidavits and bonds. The askTender Desk prepares the registrations, forms and volumes, assembles the offer and coordinates the certificates; askTender Partners, such as a proposal consultant, a CPA, an attorney or a surety producer, do the steps their license covers.
Questions
Does SAM.gov registration cost anything?
No. Registration in SAM.gov is always free. It takes an average of 7–10 business days to become active, or 2–8 weeks when the IRS name and TIN match fails, and it must be renewed every 365 days. You must be registered when you submit an offer and stay registered through final payment.
Can a consultant manage my SAM.gov registration?
Yes. Your Entity Administrator, who must be an employee, officer or board member, assigns the consultant the Data Entry role, and the consultant registers, updates and renews under their own Login.gov. You still enter or confirm the EFT bank details, and your authorized official attests the reps and certs.
Who signs a federal offer?
A person with authority to bind the company, signing in the corporate name. By default that is your officer, by electronic signature where the agency accepts one. An agent may sign only with evidence of authority the contracting officer finds satisfactory, such as a bid-specific power of attorney or certified board resolution.
Do I need a bid bond?
Only where the contract requires a performance or payment bond, mainly federal construction above $150,000. The bid guarantee must then be at least 20% of the bid price, capped at $3 million, from a Treasury-listed surety or by cash, certified check or letter of credit.
Is CMMC certification required right now?
Not third-party certification. On 13 July 2026 DoD suspended Phase 2, so only Level 1 (Self) and Level 2 (Self) may be designated in solicitations. DFARS 252.204-7012 and the NIST SP 800-171 score posted in SPRS still apply to contracts handling Controlled Unclassified Information.
What does a foreign company use instead of an EIN?
An NCAGE code from its national codification bureau or the NSPA eportal, obtained before SAM registration. A foreign vendor may leave the TIN blank in SAM unless it pays US taxes, and gives the paying agency Form W-8BEN-E instead of a W-9.
Sources
- SAM.gov: entity registration
- Login.gov: rules of use
- IRS: get an Employer Identification Number
- FAR 52.204-8: annual representations and certifications
- 13 CFR 121.411: size and status certifications
- FAR 4.102: contractor’s signature
- FAR 52.225-6: Trade Agreements certificate
- FAR subpart 28.1: bonds and other financial protections
- FAR 28.307-2: insurance on government installations
- FAR 22.1803: E-Verify
- DFARS 252.204-7019: NIST SP 800-171 DoD assessment requirements
- GSA: Readiness Assessment for MAS offerors
- SBA: surety bonds
- IRS: about Form W-8BEN-E
- 22 CFR 122.3: ITAR registration fees
- Texas Comptroller: vendor registration
- New York State Comptroller: file your Vendor Responsibility Questionnaire
- NYC PASSPort: sign the Vendor Enrollment Package
This guide explains the rules in plain English; it isn’t legal advice. Procurement rules change, and each tender document sets its own conditions — it always prevails.