Finding Your First Prime Relationship

Nobody at a prime wakes up wanting to add a supplier. Adding you creates work for a buyer, a quality engineer, a lawyer and now a cybersecurity analyst. So the question that gets you in the door is never “will you buy from us.” It is “which of your problems am I cheaper than?”

The good news for a very small company is that primes have a specific, documented, federally audited problem that you may be uniquely well shaped to solve. Most small contractors have no idea it exists.

The gap you are filling has a number on it

Under FAR 19.702, any contract expected to exceed $900,000 — $2 million for construction — awarded to a company that is not itself small, and that offers subcontracting possibilities, requires an accepted small business subcontracting plan. Those thresholds went up from $750,000 and $1.5 million effective 1 October 2025, so a checklist written before then has the old numbers on it.

FAR 52.219-9 says what has to be in the plan. Separate dollar and percentage goals for small business, veteran-owned, service-disabled veteran-owned, HUBZone, small disadvantaged and women-owned. A named Small Business Liaison Officer. A description of how sources will be identified. Reporting through the Individual Subcontract Report and the Summary Subcontract Report. And a written explanation when goals are missed.

That last clause is the whole opportunity. Somebody at that prime has their name on a document promising a percentage, files a report twice a year on how it is going, and has to explain a shortfall in writing. When you show up in the right socioeconomic category with a real capability, you are not asking for a favour. You are helping a specific person meet a specific commitment.

For scale: the statutory government-wide prime goals are 23% to small business overall, with 5% small disadvantaged, 5% women-owned, 3% HUBZone and 3% service-disabled veteran-owned. The Department’s subcontracting goal for small business sits considerably higher than the prime goal. These are not aspirations somebody mentions at a conference; they are scored.

Be findable before you try to be memorable

Supplier diversity teams search databases. If you are not in them, cleanly, you do not exist.

• SAM.gov registration, complete and active. Free, and you do not need a third party to do it. Entity validation, then a 12-character UEI, then core data with your TIN and banking, then a CAGE code issued by DLA, then NAICS assertions and the representations and certifications. Budget a couple of weeks of elapsed time — the TIN match and entity validation are queued reviews, not instant. Renew every 365 days, and put that date on a calendar, because a lapsed registration makes you unawardable overnight.
• Your NAICS codes, chosen deliberately. This is the field buyers filter on. Pick the codes that describe what you sell, not everything you could conceivably do. A profile claiming 40 NAICS codes reads as a broker.
• SBA’s small business profile search. SBA has consolidated its small business and certification search at search.certifications.sba.gov. If the last time you looked at your profile it was in DSBS, go check that it carried over, that it is claimed, and that the capability narrative is not the placeholder text from 2019.
• SBA SUBNet. Large primes post subcontracting opportunities there directly. It is unglamorous and underused.

Certification is a multiplier, not a ticket

A certification does not make anyone buy from you. It makes you worth more per dollar to a buyer who already wants to buy from you, and it is often what gets a marginal award decided in your favour.

One thing has changed that a lot of firms have not caught up with: self-certification is over. Service-disabled veteran-owned firms had to be certified through SBA’s VetCert programme by 22 December 2024 to count toward set-asides, sole-source awards, or a prime’s subcontracting credit. Women-owned self-certification was eliminated as well. If your website says “self-certified SDVOSB,” it is doing you no good with a prime’s supplier diversity team — they are pulling from SBA’s certified list, and you are either on it or you are not.

We went through the certification ourselves; I wrote about it in Proudly Certified as an SDVOSB. The paperwork is tedious and the ownership-and-control documentation is stricter than people expect, but it is a one-time cost against a three-year term.

Find the primes that actually have an obligation

This is the part that separates a targeted approach from a mail-merge, and the data is all public.

• SBA publishes a directory of federal prime contractors with subcontracting plans — company, agency, NAICS, place of performance, contract number and value. That is a list of firms with a written obligation, filtered to your industry and your geography.
• Award and subaward data now lives in SAM.gov. FPDS ezSearch was decommissioned on 24 February 2026 and FSRS was retired in March 2025; contract awards, subcontract reports and subaward reports are all searchable in one place now. You will need a SAM.gov account to see it, but no special role.
• Read the subaward reports. Primes report subcontracts of $30,000 or more, and that data is public. It tells you who a prime actually pays, at what size, for what. A prime whose subawards are all six-figure and all to the same three companies is a hard target. A prime with a plan, a goal, and thin small-business subaward activity in your NAICS is a conversation worth having.
• Respond to sources sought notices and RFIs on SAM.gov. These are the cheapest thing in government contracting. A prime building a proposal is looking for named small business partners to put in it, and a sources sought response is how you get named.

APEX Accelerators are free, and hardly anyone uses them

The old Procurement Technical Assistance Centers were renamed APEX Accelerators and moved under the Department. There are roughly ninety of them nationwide, they are funded by the Department rather than by you, and one-on-one counselling costs nothing.

What they will actually do: walk your SAM registration, review your capability statement, help you pick NAICS codes, review a bid before you submit it, and — the useful one — put you in front of primes at matchmaking events you would not otherwise get into. Find your local one at apexaccelerators.us. For a company with no business development staff, this is the highest-return hour available.

The capability statement, and what it is for

One page. It exists so that a buyer can forward it to someone else without explaining you. Everything on it should survive that forward.

• Core competencies — what you do, in the buyer’s vocabulary, not yours.
• Differentiators — why you rather than the incumbent. This is the only section that is hard to write and the only one anyone reads twice. “Quality and customer service” is not a differentiator.
• Past performance — named customers, relevant contracts, with contract numbers if you can. Two relevant ones beat eight assorted ones.
• Company data — UEI, CAGE, NAICS and PSC codes, certifications, and one named human with a direct phone number.

Make several versions, one per prime or per programme. A statement tuned to the specific work being bought is obviously different from a generic one, and the difference is visible in about four seconds.

Teaming, subcontracting and mentor-protégé are three different things

People use these interchangeably and then are surprised by what they signed.

Instrument	When	What it actually does
Teaming agreement	Before award	Contingent. Commits the parties to pursue a specific opportunity together and, usually, to negotiate a subcontract in good faith if the prime wins. FAR 9.6 recognises team arrangements when disclosed in the offer.
Subcontract	After award	The binding instrument. This is where scope, price, flow-downs and cybersecurity obligations actually live.
SBA Mentor-Protégé	Ongoing relationship	A formal SBA-approved agreement, up to six years, that lets a mentor and protégé form a joint venture treated as small for small business awards. Apply through SBA; expect roughly three to four months.

A teaming agreement is not a sale. Read the exclusivity clause specifically — some of them lock you out of pursuing the same work with anyone else, in exchange for nothing enforceable if the prime loses or changes its mind. Expect to sign a nondisclosure agreement before anything substantive is shared, and read what it says about your own background material.

The cybersecurity questions are now part of onboarding

This is the part that has changed most in the last two years, and it is where small suppliers most often stall out after doing everything else right.

A prime’s supplier portal will ask for your UEI and CAGE, your certifications, your quality registrations — and then a cybersecurity questionnaire. Several large primes run supplier cyber assessment through shared platforms, with question sets drawn directly from NIST SP 800-171, plus an attestation form. Expect:

• A current SPRS score. Primes can see whether you have one and how old it is. “None posted” is an answer, and not a good one.
• DFARS 252.204-7012 flow-down. Where the subcontract involves covered defense information or operationally critical support, the clause flows to you in full — including 72-hour incident reporting and media preservation.
• A CMMC question, suspension or not. The July 2026 Phase 2 suspension paused what the Government can require as a condition of award. It did not touch what a prime can require of you in a private contract, and several primes have kept their supplier deadlines in place. If your customer is a prime, the suspension may be irrelevant to your timeline.

Which means the honest sequencing is: get findable, get certified, get your SPRS score posted, and then go talk to primes — because the conversation will reach the questionnaire faster than you expect, and “we’re working on it” is where a promising supplier introduction goes quiet.

What I would do in the next thirty days

• Week 1. Verify SAM registration is active and the renewal date is on a calendar. Fix the NAICS list. Claim and update the SBA profile.
• Week 2. Write the one-page capability statement. Book a free APEX appointment and have them tear it apart.
• Week 3. Pull the SBA prime directory and SAM subaward data for your NAICS and state. Build a list of ten primes with a real obligation and thin activity in your lane. Find the Small Business Liaison Officer for each.
• Week 4. Register in the supplier portals for the top three. Respond to at least one sources sought notice. Post or refresh your SPRS score so the cyber question has an answer.

None of that is a sales pitch. It is removing the reasons someone would say no before you ask them anything.

And before you chase a specific opportunity, decide whether it is worth chasing. That is a separate discipline, and I went through it in Bid/No-Bid Decisions for Small Defense Contractors.

---

Where to go next

• Before a prime asks: the CMMC readiness quiz takes about five minutes and tells you what a supplier questionnaire would find.
• Our CMMC guide for small contractors covers what flows down to you and what it costs.
• Need the documentation a prime’s onboarding will ask for? Start with our CMMC packets.