Unique Entity ID UEI
The 12-character alphanumeric ID that identifies your business across the federal award system. It replaced the DUNS number in 2022 and is assigned in SAM.gov.
Register in SAM.gov →
DECODE THE ALPHABET SOUP
Govcon, in plain English.
UEI, CAGE, SAM, NAICS, SPRS, 800-171, CMMC, POA&M, set-asides. Federal contracting runs on acronyms. Here’s a clear, no-jargon glossary of the terms that actually matter when you’re registering, bidding, and staying compliant. Search it, then put it to work with our free tools.
THE TERMS
Search the glossary
Every entry links to the tool or service that puts it into practice.
CAGE Code CAGE
Commercial and Government Entity code: a 5-character ID assigned by the DoD to identify a contractor at a specific location. Required for most defense work.
See our capabilities →SAM.gov Registration SAM
System for Award Management: the official, free federal registration every entity must hold (and renew annually) to receive contracts or grants.
Step-by-step SAM guide →NAICS Code NAICS
North American Industry Classification System code that classifies your business activity. Each solicitation lists a NAICS code with an associated small-business size standard.
Find your NAICS code →NIGP Commodity Code NIGP
The classification system most U.S. state and local governments use (instead of NAICS) to categorize the goods and services they buy.
Our NIGP codes →SPRS SPRS
Supplier Performance Risk System: the DoD database where contractors post their NIST SP 800-171 Basic Assessment score. Scores range from 110 down to negative values.
How the SPRS score works →NIST SP 800-171 800-171
The federal standard of 110 security requirements for protecting Controlled Unclassified Information (CUI) on non-federal systems. Compliance is scored via the DoD Assessment Methodology.
Read the 800-171 guide →CMMC CMMC
Cybersecurity Maturity Model Certification: the DoD program that will require third-party assessment of NIST 800-171 (and beyond) for many contracts. Most firms today pursue readiness, not certification.
What CMMC requires →Controlled Unclassified Information CUI
Government-created or -owned information that is sensitive but not classified, and that requires safeguarding under federal rules (the data NIST 800-171 protects).
What counts as CUI →Plan of Action & Milestones POA&M
A documented plan listing each unimplemented security requirement, the remediation steps, resources, and target dates. Required alongside an SSP for SPRS.
Find your gaps →System Security Plan SSP
The document describing how your system meets each NIST 800-171 requirement: system boundary, controls, and responsibilities. Required for a valid assessment.
Where the SSP fits →Section 508 508
The federal law (29 U.S.C. § 794d) requiring electronic and information technology procured by federal agencies to be accessible to people with disabilities.
Section 508 explained →WCAG 2.1 AA WCAG
Web Content Accessibility Guidelines, Level AA: the technical standard Section 508 conformance is measured against. The bar most government web work must meet.
The WCAG 2.1 AA standard →Set-Aside
A contract (or portion) reserved for competition among a specific category of small business, e.g. small-business, 8(a), HUBZone, SDVOSB, or WOSB set-asides.
Compare set-aside programs →8(a) Business Development 8(a)
An SBA program for small businesses owned by socially and economically disadvantaged individuals, offering sole-source and set-aside contracting advantages for up to nine years.
The 8(a) program guide →HUBZone HUBZone
An SBA program for small businesses located in Historically Underutilized Business Zones, providing competitive and sole-source set-asides and a price-evaluation preference.
The HUBZone guide →SDVOSB SDVOSB
Service-Disabled Veteran-Owned Small Business: a designation that qualifies a firm for veteran set-aside and sole-source federal opportunities.
SDVOSB set-asides →WOSB / EDWOSB WOSB
Woman-Owned Small Business (and the Economically Disadvantaged variant): federal designations qualifying firms for women-owned set-aside contracts.
WOSB & EDWOSB guide →Capability Statement
The one-page govcon calling card summarizing your core competencies, differentiators, past performance, and company data (UEI/CAGE/NAICS) for contracting officers.
Build one free →Past Performance
A record of relevant prior work used by evaluators to judge your ability to deliver. New entrants build it via subcontracting, small awards, and commercial references.
Build past performance →Sources Sought / RFI RFI
A pre-solicitation Request for Information (or Sources Sought notice) used by agencies for market research. Responding shapes the eventual solicitation and signals interest.
Watch the opportunity board →Solicitation (RFP / RFQ / IFB) RFP
The formal request for offers (Request for Proposal, Request for Quote, or Invitation for Bid) that defines requirements, evaluation criteria, and the submission deadline.
See open solicitations →
COMMON QUESTIONS
Govcon basics, answered
The questions behind the acronyms.
What is the difference between a UEI and a CAGE code?
A UEI (Unique Entity ID) is the 12-character ID that identifies your business across the entire federal award system, assigned in SAM.gov. It replaced the DUNS number in 2022. A CAGE code is a separate 5-character code assigned by the DoD that identifies a contractor at a specific physical location. Most defense work requires both.
Do I need to know all of these terms to bid?
No, but a handful are unavoidable: SAM registration, your NAICS code and its size standard, the set-aside types you may qualify for, and, for DoD work, SPRS and NIST 800-171. The rest you pick up as you respond to solicitations.
What is the most common term new contractors get wrong?
Two things: confusing NAICS codes (used federally) with NIGP commodity codes (used by most state and local governments), and assuming a “set-aside” guarantees an award. It only restricts which businesses are allowed to compete.
Is this glossary specific to IT contracting?
It is written for IT and software contractors, but most entries, including UEI, CAGE, SAM, set-asides, past performance, and capability statements, apply to any federal vendor regardless of industry.