By Outrider Editorial Team · Updated August 20, 2026
How do you sell technology to the government?
Register the NAICS codes that federal IT money actually follows, which is usually Computer Systems Design (541512) over Custom Computer Programming (541511). Clear the gates your buyer faces: FedRAMP for cloud, CMMC for defense work, Section 508 for accessibility. Then reach program offices through SBIR, DIU, or a schedule contract.
Federal technology buying concentrates in a handful of codes, and the codes do not mean what their names suggest. PSC DA01, application development and support labor, moved $22.6 billion in FY2025, more than any other federal IT services code. Getting a share of it depends less on your product than on decisions you make during registration and compliance, most of which are invisible from the outside.
This guide covers what the data says about where technology money lands, the gates that decide whether you can bid at all, and the on-ramps designed for companies that build products instead of billing hours. For the registration sequence underneath all of it, see how to sell to the government.
The code that sounds right is often the wrong one to register
DA01 is literally the application development code. Inside it, Computer Systems Design Services (541512) collected $11.7 billion in FY2025. Custom Computer Programming Services (541511), the code that describes writing software, collected $3.6 billion. Other Computer Related Services (541519) sat between them at $4.2 billion.
The systems integration registration beats the programming registration by more than three to one on a code built for programming work. Zoom out to the whole federal market and the pattern holds: 541512 drew $32.07 billion in FY2025 across 18,087 contracts, 541519 drew $25.05 billion, 541511 drew $10.36 billion, and Computing Infrastructure Providers (518210) drew $3.35 billion.
The reason is structural. A PSC records what the government bought. A NAICS code records the industry of the company that sold it. Agencies buying application development overwhelmingly buy it from firms that present as systems designers, so a software company registered only under 541511 is fishing in the smaller pond by choice. The NAICS finder searches all 1,012 codes with current size standards; check whether 541512 belongs on your registration before your next bid.
Knowing the buyers matters as much as knowing the code. On 541512, DoD obligated $9.06 billion in FY2025, GSA $5.53 billion, VA $3.92 billion, HHS $3.37 billion, and DHS $2.57 billion. That is a civilian-heavy profile compared to most of the federal market, which is worth knowing before you build a defense-only pipeline.
License term decides which code your product lives in
Software companies routinely see half their federal footprint and conclude the market is small. The split is caused by one word in the PSC manual: perpetual.
Software licensed indefinitely is a product and lands in the 7 series. PSC 7A21, business application software on perpetual license, took $7.24 billion in FY2025, making it the largest IT product code in the government. Software licensed for a defined term is a service and lands in PSC DA10, which took $8.64 billion. Same product, same buyer, different code, decided entirely by contract structure.
Both codes point at something else uncomfortable for product companies. On 7A21, the reseller registration 541519 led at $3.1 billion while Software Publishers (511210) took $2.3 billion. On DA10, 541519 took $3.3 billion against $1.73 billion for 511210. Federal software revenue mostly arrives through partners, not direct. Plan the channel accordingly, and track both codes together or you will misread your own market by half.
Three gates that decide whether you can bid at all
FedRAMP, for anything cloud. FedRAMP scope covers cloud products and services "that create, collect, process, store, or maintain Federal information on behalf of a Federal agency," and agencies must promote the use of cloud products and services that are FedRAMP certified when the use falls inside that scope. Agency-specific deployments that no other agency would reuse are commonly outside it. Read the scope before you assume either that you need authorization or that you are exempt, because the answer changes what your first federal deal costs you.
CMMC, for defense. The DFARS final rule published September 10, 2025 took effect November 10, 2025 and inserts clause DFARS 252.204-7021 into defense contracts. Certification requirements flow down to subcontractors at all tiers that process, store, or transmit federal contract information or controlled unclassified information, which means a subcontract does not exempt you. Our CMMC compliance checklist covers Level 1 and Level 2 scope and realistic implementation cost.
Section 508, for anything with a user interface. Accessibility compliance is not filed where most vendors look for it. The PSC manual places Section 508 compliance measurement inside DJ01, the security and compliance code, alongside vulnerability scanning and breach response. DJ01 obligated $1.61 billion in FY2025. Treat an accessibility conformance report as a bid document you prepare once and reuse, because agencies will ask and a missing one is a fast way to be found technically unacceptable.
State IT does not run through the state's main portal
Registering with a state's general procurement system and waiting is how technology vendors miss the market they came for.
In Texas, the Comptroller's Statewide Procurement Division handles non-IT goods and services. Information technology is bought through Texas Department of Information Resources contracts, which are then ordered through SmartBuy. The CMBL registration still matters, but a DIR vehicle is what puts you in front of Texas IT buyers, and a company that only registers on the CMBL will watch its market transact somewhere else.
California draws the line differently and in your favor. Under the State Contracting Manual, non-IT goods and IT goods must be advertised above $50,000, but IT services must be advertised above $4,999.99. Nearly every California IT services engagement is publicly posted, so the California State Contracts Register is a genuinely complete feed for a services company, provided you attach UNSPSC commodity codes during registration. Skip that step and you receive no notifications at all.
On-ramps built for companies that ship products
Standard procurement assumes a documented requirement and a priced solution. Product companies usually have the solution first, which is what these programs exist to handle.
SBIR is the funded starting line. Eleven agencies participate, and as of April 2026 sbir.gov lists Phase I awards up to $323,090 and Phase II up to $2,153,927. The money is non-dilutive, but the durable asset is the program office relationship and the Phase III sole-source pathway that a completed Phase II unlocks. Our SBIR playbook covers proposal mechanics and the reviewer rubric.
DIU buys commercial technology through Commercial Solutions Openings under Other Transaction authority at 10 U.S.C. 4022. DIU states it can award prototype agreements in as few as 60 to 90 days, and a successful prototype earns a Success Memo that lets any federal agency adopt the solution without re-competition, with no time limit on its use. One successful prototype therefore becomes a standing sales asset across the federal government. See the DIU agency guide and our breakdown of how a CSO submission actually works.
Live test events put your hardware or software in front of operators before any requirement exists. ANTX and REPMUS are the two most visible in the naval and unmanned systems world, and Outrider runs the event management infrastructure behind both. Program managers post a problem set, matching companies apply, and the after-action reporting becomes the record a program office cites when it writes the requirement six months later.
The unglamorous path that actually closes deals
Everything above is preparation. The sequence that converts it looks like this.
- Register where the money is. Confirm your codes against FY2025 obligations on our NAICS pages, not against what your industry calls itself.
- Get on the vehicles your buyers already use. A GSA schedule, a DIR contract, or a state term contract turns a nine-month procurement into a purchase order. Compare the options with the contract vehicle tool, and see the GSA schedule application walkthrough for what that filing involves.
- Sell to program offices, not to procurement. Contracting officers execute requirements. Program offices write them. By the time a solicitation posts, the technical approach is usually settled, which is why Sources Sought notices and industry days are worth more of your calendar than proposal season is.
- Show up before the requirement hardens. Outrider exists for this part: it surfaces the contracts, grants, and bills that match what you build and tells government buyers you exist. Start on the industry side if that is the gap in your pipeline.
Federal technology buying rewards patience applied to the right codes. Pick them from the data, clear your compliance gates once, and spend the rest of your effort where the requirement is still being written.
Frequently Asked
Common questions.
Which NAICS code should a software company register?
Look at where the money lands, not at the code name. Computer Systems Design Services (541512) drew $32.07 billion in FY2025 against $10.36 billion for Custom Computer Programming Services (541511). Inside PSC DA01, the federal application development code, 541512 took $11.7 billion and 541511 took $3.6 billion. Register both if you qualify.
Do I need FedRAMP authorization to sell software to the government?
You need it if your product is a cloud service that creates, collects, processes, stores, or maintains federal information on behalf of an agency. That is FedRAMP's stated scope. Agencies must promote the use of FedRAMP-certified services within that scope. On-premises software and agency-specific deployments outside the scope are handled differently.
What is CMMC and does it apply to me?
CMMC is the Defense Department's cybersecurity certification. The DFARS final rule published September 10, 2025 took effect November 10, 2025, adding clause DFARS 252.204-7021 to defense contracts. Requirements flow down to subcontractors at every tier that processes, stores, or transmits federal contract information or controlled unclassified information.
Is SBIR worth it for a software company?
It is the cheapest funded entry point into a federal agency. Eleven agencies participate. As of April 2026, sbir.gov lists Phase I awards up to $323,090 and Phase II up to $2,153,927, and the funding is non-dilutive. The real asset is the agency relationship and the Phase III sole-source pathway it creates.