FAR, IDIQ, BPA, GWAC, OTA, CPARS — the federal procurement alphabet soup decoded. A no-nonsense guide to every acronym you'll encounter in government contracting.
Your first government meeting goes something like this: "We're looking at an IDIQ under the GSA MAS, possibly a BPA, unless the CO decides to go OTA through DIU. Make sure your SAM registration is active and your CPARS are clean."
You nod. You smile. You have no idea what just happened.
Federal procurement has more acronyms than the military — and that's saying something. The problem isn't that they're complicated. It's that nobody ever explains them in context. A glossary tells you that IDIQ stands for "Indefinite Delivery, Indefinite Quantity." It doesn't tell you why that matters to your business or when you'll encounter one.
This guide does both.
SAM.gov — System for Award Management. The federal government's registration portal for all contractors. If you're not registered here, you can't receive federal contracts. Period. Think of it as your business license for government work. (Our SAM.gov guide covers registration and competitive intelligence.)
UEI — Unique Entity Identifier. A 12-character alphanumeric code that identifies your business in SAM.gov. It replaced the DUNS number in April 2022. You get one automatically when you register in SAM.
CAGE Code — Commercial and Government Entity Code. A five-character identifier assigned to your company during SAM registration. You'll need this on virtually every proposal and contract document. Keep it somewhere accessible — you'll type it hundreds of times.
NAICS Code — North American Industry Classification System Code. A six-digit code that categorizes your business by industry. The government uses these to determine which contracts you're eligible for and whether you qualify as a "small business" in your sector. Picking the right NAICS codes isn't trivial — different codes have different size standards. (See our NAICS codes guide.)
PSC — Product and Service Code. Similar to NAICS but describes what you sell rather than what industry you're in. Used to classify contract actions. Less glamorous than NAICS, but contracting officers use these to search for vendors.
FAR — Federal Acquisition Regulation. The bible of government contracting. It's a 2,000+ page rulebook that governs how the government buys things. Every federal contract must comply with the FAR. You don't need to memorize it, but you need to know it exists and where to find the parts relevant to your work.
DFARS — Defense Federal Acquisition Regulation Supplement. The DoD's additions to the FAR. If you're selling to the military, DFARS rules apply on top of FAR rules. DFARS is where requirements like CMMC (cybersecurity certification) come from.
CO — Contracting Officer. The only person with legal authority to commit the government to a contract. Not the program manager, not the end user, not the general who loves your demo. The CO signs the contract. Build a relationship with them.
COR — Contracting Officer's Representative. The CO's designated person who monitors day-to-day contract performance. They can't modify the contract, but they can make your life easy or hard depending on how well you communicate and deliver.
KO — Same as CO. Some agencies use KO instead. Don't let it confuse you.
RFI — Request for Information. The government is exploring a need and wants to know what's out there. This is not a competition — there's nothing to "win." But responding shapes the eventual requirement. Think of it as the government asking "what's possible?" The companies that answer this question well often end up writing the playbook for the eventual RFP.
Sources Sought — Similar to an RFI but more focused. The government is specifically asking: "Who can do this?" Responding to a Sources Sought notice puts your company on the government's radar and can influence whether the eventual contract is set aside for small businesses.
RFP — Request for Proposal. The formal competition. The government has defined what they need and is asking companies to submit detailed proposals with technical approaches, pricing, and past performance. This is where contracts are won.
RFQ — Request for Quotation. Like an RFP but simpler — typically for commercial items or services where the government primarily cares about price. Less narrative, more numbers.
BAA — Broad Agency Announcement. Used for research and development. Unlike an RFP (which defines a specific solution), a BAA describes a broad problem area and invites innovative approaches. DARPA and other research agencies use BAAs extensively.
IDIQ — Indefinite Delivery, Indefinite Quantity. A master contract that establishes terms and conditions, with individual task orders issued as specific needs arise. Think of it as a fishing license — getting the IDIQ means you're allowed to compete for the fish (task orders). It doesn't guarantee you'll catch any.
BPA — Blanket Purchase Agreement. A simplified way for agencies to make repeat purchases from a vendor. If the government buys your software licenses every quarter, a BPA streamlines the paperwork. Smaller than an IDIQ, but steady revenue.
GWAC — Government-Wide Acquisition Contract. A special type of IDIQ that any federal agency can use, not just the one that issued it. Getting on a GWAC is hard, but it opens doors across the entire government. The major GWACs (like 8(a) STARS III, Alliant 2, VETS 2) are prestigious and competitive.
GSA Schedule / MAS — Multiple Award Schedule. The General Services Administration's catalog of pre-approved vendors. If you're on the GSA Schedule, any federal agency can buy from you using simplified procedures. It's like getting listed in the government's approved vendor catalog. The application process is thorough but worth it for commercial products and services.
OTA — Other Transaction Authority. The government's escape hatch from the FAR. OTAs let agencies award contracts for research and prototyping without following the full FAR process. DIU, AFWERX, and other innovation offices use OTAs to work with non-traditional companies that would otherwise be excluded by the traditional procurement process.
Set-Aside — A contract reserved exclusively for small businesses (or a specific category of small businesses). When a contract is "set aside," large companies can't compete. This is the government's way of ensuring small businesses get a fair share of federal spending.
8(a) Program — SBA's business development program for socially and economically disadvantaged small businesses. Nine-year program that provides access to sole-source contracts (no competition), mentorship, and management assistance. Getting 8(a) certification is competitive but transformative.
HUBZone — Historically Underutilized Business Zone. Certification for small businesses located in designated economically distressed areas. Provides access to set-aside contracts and a price evaluation preference in full-and-open competitions.
WOSB / EDWOSB — Women-Owned Small Business / Economically Disadvantaged Women-Owned Small Business. Certifications that provide access to set-aside contracts in industries where women-owned businesses are underrepresented.
SDVOSB — Service-Disabled Veteran-Owned Small Business. Certification for businesses owned by veterans with service-connected disabilities. Provides access to sole-source and set-aside contracts.
SBIR — Small Business Innovation Research. The largest source of early-stage R&D funding for small businesses. Eleven federal agencies participate, with over $4 billion awarded annually. Three-phase structure: feasibility, R&D, commercialization. (See our SBIR vs STTR comparison.)
STTR — Small Business Technology Transfer. Similar to SBIR but requires a formal partnership with a research institution. Five agencies participate. Ideal when your technology builds on university research.
CPARS — Contractor Performance Assessment Reporting System. The government's Yelp for contractors. After every contract, the government rates your performance. Good CPARS ratings are gold — they're weighted heavily in proposal evaluations. Bad ones can follow you for years. Take CPARS seriously from your very first contract.
CMMC — Cybersecurity Maturity Model Certification. The DoD's cybersecurity framework for contractors who handle Controlled Unclassified Information (CUI). If you want to work with the DoD, you'll likely need CMMC certification. The requirements vary by level, but even Level 1 requires documented cybersecurity practices.
CUI — Controlled Unclassified Information. Sensitive government information that isn't classified but still requires protection. If your contract involves CUI, you must meet specific handling and cybersecurity requirements (this is where CMMC comes in).
You don't need to memorize all of this today. But bookmark this page, because you will encounter every single one of these acronyms in your government contracting journey. The difference between the companies that navigate federal procurement successfully and those that don't isn't intelligence — it's fluency. Understanding the language is the first step to speaking it.
Blog post description goes here.
