The GovCon Playbook
A Solo Founder's Map to Federal Contracting

§ 1Legal Entity

Timeline: 1-2 weeks. Cost: $100-500 depending on state.

1.1 Pick your structure

Solo gov contractors almost always form an LLC. Sole proprietorship is fine for freelancing; it is bad for federal contracting because it mixes your personal liability with your business liability and it looks unserious to procurement officers. S-corp election is optional and tax-driven; worry about it after your first $100k in revenue.

1.2 Form the LLC

• File Articles of Organization with your state (in Maryland: Maryland Department of Assessments & Taxation, ~$100-200, online).
• Draft an Operating Agreement, even for a single-member LLC. Gov buyers will sometimes ask for it. A 3-page template is sufficient.
• Get your Registered Agent (yourself is fine if you're at a stable address; services like Northwest Registered Agent cost $100-150/yr).

1.3 Get an EIN

Free, online, 10 minutes: IRS SS-4 online application. You'll get your EIN immediately. Keep the confirmation PDF forever.

1.4 Open a business bank account

You cannot register in SAM.gov without a business bank account in your LLC's name. Regional/local banks work fine. Neobanks (Mercury, Relay) also work and often faster to open. Your bank name and account routing must match what's in SAM.

§ 2Federal Registration

Timeline: 2-4 weeks. Cost: $0 (everything free; beware third-party "registration services" charging $500+).

2.1 SAM.gov entity registration

This is the gate. Every federal contract touches SAM. Register at sam.gov. You'll auto-generate a UEI (Unique Entity Identifier) as part of registration. After review (1-14 business days), you'll get a CAGE code (Commercial and Government Entity).

• Have ready: EIN, bank info, physical address matching state filings, list of NAICS codes (next step).
• Annual renewal required. Set a calendar reminder for 335 days out. If your registration lapses, every active bid becomes invalid.

2.2 NAICS codes — the trap

You select NAICS codes at SAM registration. Each NAICS has a different small-business size standard (revenue or headcount cap). Picking the wrong code locks you out of opportunities or kicks you out of small-business status prematurely.

You can have up to 10 NAICS codes in SAM. Pick your primary NAICS carefully — it determines your "official" small-business status and drives the set-asides you qualify for.

§ 3State Registration

Required if you want to bid on state/local contracts in addition to federal. Parallel with § 2.

3.1 Maryland example

• eMaryland Marketplace Advantage (eMMA) — free, mandatory for state work. Register at procurement.maryland.gov.
• Small Business Reserve (SBR) — free, automatic qualification if you meet criteria. Gives preference on ~10% of state spend.
• MBE / VSBE / DBE — ethnic-minority, veteran, and disability-owned certifications.

3.2 Other states

Each state has an analogous registration system. Check your state's procurement portal. Most are free. Some (NY, CA) have more bureaucratic processes.

§ 4Optional Certifications

Certifications give you set-aside preference — ie. the contract is reserved for businesses with that certification. ROI varies widely.

§ 5Compliance Infrastructure

5.1 Cybersecurity baseline

• NIST SP 800-171 — 110 security controls for Controlled Unclassified Information (CUI). Required for most DoD work. Self-attested initially.
• CMMC 2.0 — replaces 800-171 for DoD contracts starting 2025-2027 rollout:
  • Level 1 (17 practices) — self-attest
  • Level 2 (110 practices) — third-party assessment (~$30k+)
  • Level 3 (rarely needed) — gov-led assessment
• NIST SP 800-218 (SSDF) — Secure Software Development Framework. SBIR-relevant.
• SOC 2 Type 2 — not required for most gov work but helps with enterprise/defense customers. Budget $15-40k/yr.

5.2 Data rights posture

This is where most small businesses lose 3-6 months per proposal. Your options:

• Unlimited Rights — Government gets everything. Use for deliverables fully funded by Gov.
• Government Purpose Rights (GPR) — Gov gets federal-use rights; you retain commercial rights. Default for SBIR work.
• Limited Rights / Restricted Rights — You retain commercial; Gov gets constrained use. Typical for pre-existing IP.
• SBIR Data Rights — 5 years of protection post-delivery. Must be asserted per 37 CFR 401.
• Public Domain Dedication (Unlicense Baby) — No rights held by anyone. Simplest. Fastest. Hardest for lawyers to challenge. See § 10.

5.3 Insurance

• General liability — $1M/$2M typical, ~$500-1500/yr for solo consultancy
• Errors & Omissions (E&O) — $1M minimum for most professional services contracts, $1-3k/yr
• Cyber liability — increasingly required, $1-2M coverage, $500-2500/yr
• Workers comp — required if you have any employees, even part-time

5.4 Accounting posture

• Firm-Fixed-Price contracts — simple, regular accounting (QuickBooks fine)
• Cost-reimbursement / T&M contracts — require DCAA-compliant time tracking and cost accounting. Budget $10-30k/yr for compliant bookkeeping or avoid these contracts as a solo founder

§ 6Finding Opportunities

6.1 Free portals

• SAM.gov Contract Opportunities — federal master list
• SBIR.gov — all agency SBIR/STTR topics, unified
• sbir.nasa.gov — NASA-specific BAA hub
• seedfund.nsf.gov — NSF SBIR
• dodsbirsttr.mil — DoD SBIR/STTR
• grants.nih.gov — HHS/NIH
• FPDS.gov — historical federal award data (messy but free)

6.2 Paid aggregators

6.3 Subcontracting to primes

Every Top-20 prime has a small-business liaison office. Cold-outreach their SBLO:

• Lockheed Martin — lockheedmartin.com/en-us/suppliers/small-business.html
• Northrop Grumman — northropgrumman.com/suppliers/small-business-program
• Raytheon (RTX) — rtx.com/suppliers/small-business
• General Dynamics, Boeing, L3Harris, Leidos, SAIC, CACI, Peraton, ManTech, Booz Allen, Accenture Federal — same pattern

§ 7Writing the Proposal

7.1 Read the RFP three times

1. First read: is this winnable? Do you have past performance, required certs, schedule fit?
2. Second read: build a compliance matrix — every "shall" in the RFP becomes a row, with a pointer to where your proposal addresses it.
3. Third read: look for mandatory forms, attachments, page limits, font requirements, submission method (email vs portal vs physical). Missing any = automatic disqualification.

7.2 Standard volume structure

• Volume I — Technical
  • TAB A: Technical Approach (problem, solution, architecture, risks)
  • TAB B: Management Approach (team, schedule, QA, IP posture)
  • TAB C: Past Performance (3 similar projects, $ value, POC, description)
  • Key Personnel Resumes
• Volume II — Price/Cost
  • Detailed cost breakdown (labor categories, rates, hours, ODCs)
  • Basis of estimates
  • Travel, materials, subcontractor costs
• Volume III — Attachments
  • Representations and Certifications
  • COI disclosures
  • Affidavits (bid, contract, non-collusion)

7.3 Past performance — the chicken-and-egg problem

You need past performance to win contracts. But you need contracts to build past performance. How to break the cycle:

• Subcontract first — your first 3 "projects" can be sub work under a prime
• State + local contracts count as past performance for federal
• Commercial work counts if it's similar in scope and $ value
• SBIR Phase I awards count as past performance for Phase II
• SkillBridge placements — if you've hosted a service member as an intern, that's past performance with DoD visibility
• Be honest — "limited past performance" is a known small-business condition, and some evaluations weight technical over past performance

§ 8Executing the Award

• Invoicing — read the contract clause on invoicing schedule. Federal contracts typically use Wide Area Workflow (WAWF) / iRAPT for submissions.
• Progress reports — monthly typically, with specific format per agency.
• CDRLs (Contract Data Requirements Lists) — every deliverable has a DI-form number and specific format. Read these BEFORE you sign.
• IP markings — every deliverable must carry rights legends per DFARS 252.227-7013/7014. See § 10 for the Unlicense Baby shortcut.
• Security requirements — each contract specifies clearance and facility needs. Budget and plan ahead.
• Closeout — final invoice, final CDRLs, CPARS evaluation (your permanent past-performance record).

§ 9Scaling

9.1 DoD SkillBridge — the solo founder cheat code

DoD SkillBridge lets transitioning service members intern at your company for up to 180 days. The service member's pay continues to come from DoD — you pay nothing. Over 85% of SkillBridge interns get hired by their host. You get:

• Cleared talent pipeline (many have security clearances)
• Real productive capacity at zero labor cost
• Past performance ("hosted N SkillBridge fellows")
• DoD visibility through the program office
• Pathway for your company to grow past sole-proprietor

Apply at skillbridge.osd.mil.

9.2 Teaming Agreements

When you subcontract or get subcontracted:

• Teaming Agreement — pre-award, describes who does what if the team wins
• Subcontract — post-award, the actual binding agreement
• Watch for flow-down clauses — prime's obligations that cascade to you

9.3 Mentor-Protégé Program

SBA's Mentor-Protégé program pairs small businesses with larger primes. Primes get credit toward their small-business subcontracting goals; you get mentorship, joint ventures (including for set-asides you couldn't pursue alone), and a growth path.

9.4 The "too much success" trap

Once you cross your NAICS size standard, you lose small-business status. You go from competing on set-asides to competing with primes directly. Plan the transition:

• You can recertify as small under the new fiscal year's rules if revenue dropped
• You can pivot primary NAICS to one with a higher ceiling
• You can absorb the loss of set-asides if your full-and-open competitive position is strong

§ 10The Unlicense Baby Overlay

The shortcut for solo founders who don't want to negotiate IP rights with government lawyers ever again.

This is free and unencumbered software released into the public domain.

Anyone is free to copy, modify, publish, use, compile, sell, or
distribute this software, either in source code form or as a compiled
binary, for any purpose, commercial or non-commercial, and by any
means.

In jurisdictions that recognize copyright laws, the author or authors
of this software dedicate any and all copyright interest in the
software to the public domain. We make this dedication for the benefit
of the public at large and to the detriment of our heirs and
successors. We intend this dedication to be an overt act of
relinquishment in perpetuity of all present and future rights to this
software under copyright law.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
OTHER DEALINGS IN THE SOFTWARE.

For more information, please refer to <https://unlicense.org>

10.1 The IP section for your proposal (copy-paste)

10.2 The `unlicense-me` CLI tool

A single-command migration:

cargo install unlicense-me
cd /path/to/your/repo
unlicense-me

Checks dependencies for incompatible licenses, re-writes headers, generates the PR. ~8 seconds per repo.

10.3 Timeline of Invention & Proof of Artifacts

Unlicensed code is public domain — anyone can use it. But priority still matters. Maintain:

• TIMELINE_OF_INVENTION.md — each major contribution with date, one-line description, commit reference. Establishes prior-art dates for USPTO 102(a)(1) defense.
• PROOF_OF_ARTIFACTS.md — cryptographic signatures (BLAKE3, SHA-256, or FIPS-compliant equivalents) on every release artifact.
• Public git history — every commit is a legally-notarized timestamp. GitHub adds their own timestamps to the commit metadata.

10.4 What Unlicense does NOT do

• Civil law jurisdictions (Germany, France, Japan): those legal systems don't fully recognize "public domain dedication" — authors have inalienable moral rights. For projects with contributors in these countries, consider pairing Unlicense with CC0 (which has a permissive-license fallback).
• Patent grants: Unlicense doesn't grant patent rights explicitly (Apache 2.0 does). For projects in patent-heavy areas, add an explicit patent grant note.
• Copyleft missions: if your goal is to prevent proprietary enclosure, GPL/AGPL is the right tool, not Unlicense.
• Employee IP assignment: most employed developers cannot Unlicense their work repos — employer owns by assignment. This playbook targets solo founders.