How to vet a software subcontractor for federal work

Finding a small business that writes software is easy. Finding one that survives a size protest, accepts a CMMC flow-down, produces an Accessibility Conformance Report that a federal reviewer will accept, and still ships working code on your schedule is a narrower search.

Start with acquisition eligibility, then evaluate delivery evidence, named engineers, and an agreed handover. A registration or certification can answer whether a firm qualifies; a technical walkthrough and comparable work tell you more about whether it can perform.

Use the scorecard below before a subcontractor's name goes into a proposal. Our software subcontracting service describes the scopes Rainier can own and the information we need to assess a fit.

Where do primes actually find software subcontractors?

Five channels do most of the work. They answer different questions, and none of them answers the one that matters most.

The SBA directory changed recently. Use the SBA's current Small Business Search (SBS), the successor to Dynamic Small Business Search (DSBS). Check the underlying record and its currency; a directory result is a starting point for verification, not a delivery reference.

None of these channels tells you whether a team can build the thing. That is a separate exercise, and it is the one most often skipped.

What should you verify before a subcontractor goes in the bid?

Work through these in order. The early ones are cheap and disqualifying; the later ones take a conversation.

Registration and identity

Confirm the legal entity, check exclusions, and match any supplied UEI and CAGE code to the relevant record. A subcontractor does not automatically need the same full SAM registration as a prime. Collect the UEI when the subaward is reportable and check any additional requirements in the solicitation and subcontract.

For covered first-tier subcontracts, FAR 52.204-10 uses the threshold in FAR 4.1403(a): currently $40,000 or more. The clause includes exceptions, including certain contractors and subcontractors with prior-year gross income below $300,000. Apply the threshold in effect on the subcontract award date and the governing contract requirements. Reporting moved from FSRS to SAM.gov.

Size under the right NAICS code

Size is per-NAICS, not global. A firm can be small for custom programming and other than small for systems integration, so check size against the code you will assign to the subcontract.

For NAICS 541511, Custom Computer Programming Services, the size standard is currently $34 million in average annual receipts. Treat that number as unstable: on August 20, 2026 the SBA proposed new size standards, which would raise the 541511 threshold to $531 million. That rule is proposed, not final, and the comment period closed September 21, 2026. If it is finalized, a large share of the mid-market software firms you compete against become "small," and the competitive logic of your small business strategy changes.

Socioeconomic status, and which kind

This is where teams lose credit they thought they had. A state or corporate diversity credential is not the same thing as a federal small business program status, and the two earn credit in different places. Collect current, accurate representations under the subcontract NAICS code and verify SBA certification where the category requires it. FAR 19.703 permits specified written representations as well as SAM representations; it does not make SAM registration a universal condition for representing subcontractor status. A capability-statement logo alone does not establish eligibility.

The mechanics of which credential counts toward which goal are worth understanding properly before you build a subcontracting plan around them. We cover that in small business subcontracting credit: what actually counts.

The limitations on subcontracting math

If the prime contract is set aside, run the arithmetic before you commit work share. Under FAR 52.219-14, a small business prime on a services contract may not pay more than 50 percent of what the government pays it to subcontractors that are not similarly situated entities. Getting this wrong is not a paperwork problem; it is a performance breach and, on the size side, it invites an ostensible subcontractor affiliation finding.

Cybersecurity posture, and what you will flow down

For defense work, ask three questions: does the subcontractor have a current Supplier Performance Risk System (SPRS) score, what is its NIST SP 800-171 implementation status, and can it hold the CMMC level you will flow down.

Note the current state carefully. The CMMC program rule at 32 CFR Part 170 took effect December 16, 2024, and the acquisition rule putting CMMC into DoD contracts took effect November 10, 2025. On July 13, 2026 the Defense Department announced the suspension of Phase 2 pending a reform review. Check the current implementation guidance and the actual solicitation before setting a certification deadline. What did not pause: DFARS 252.204-7012, NIST SP 800-171 Revision 2 as the enforceable baseline, SPRS score postings, and annual affirmations. Under 32 CFR 170.23, flow-down tracks the data: a subcontractor handling Federal Contract Information needs Level 1, one handling Controlled Unclassified Information needs Level 2, and the obligation reaches past the first tier.

Ask for the applicable assessment date, scope, affirmation, and remediation ownership. The useful evidence is a current record that covers the systems in your scope, not whether a salesperson recalls a number.

Accessibility, with evidence

For federal ICT, establish the applicable Section 508 requirements and any documented exceptions. Under FAR Subpart 39.2, agencies must account for accessibility when they buy information and communication technology, and an Accessibility Conformance Report built on the VPAT template can document a product's conformance. Confirm the evidence the acquisition actually requests.

Ask to see one. Then read it. An ACR with "Supports" in every row and no methodology section is a marketing document. A useful one names the standard and version, states what was tested and how, and is honest about partial support. The Section 508 buyer guidance sets the expectation.

Supply chain prohibitions

FAR 52.204-25 flows down. Confirm the subcontractor can make the Section 889 representation about covered telecommunications equipment and services, including in whatever cloud and video conferencing it uses on your work.

Past performance that is actually comparable

Relevance beats prestige. A team that modernized a benefits eligibility system under an ATO is more relevant to your benefits modernization than a team with a larger logo and no regulated delivery history. Ask for the contract vehicle, the period of performance, the role (prime or sub), the technical scope, and a reference who will answer the phone.

What questions reveal whether a sub can actually build?

Compliance screening tells you a firm is eligible. It does not tell you it is competent. A short technical conversation does, and these questions tend to separate the two quickly:

• Who exactly will do the work? Named engineers, with availability dates. A proposal staffed by people who will be reassigned at award is the oldest problem in this industry.
• What will you not do? Firms that scope honestly will tell you where they are weak. Firms that say yes to everything are telling you something else.
• Walk me through your last ATO. Or last 508 audit, or last security assessment. The specifics of how someone handled a real review are hard to fake.
• How do you hand over? Documentation, knowledge transfer, and what the government owns at the end. If the answer is vague, assume lock-in.
• What is your position on data rights? This needs to be settled before award, not after. Our note on teaming agreement or subcontract covers how that gets papered.

A software subcontractor evaluation scorecard

Use this as a starting worksheet, not an agency-approved scoring method. Record the evidence and unresolved questions for each candidate. Resolve mandatory eligibility requirements before comparing technical scores; a high score cannot offset a missing requirement.

Score each area from 0 to 3: 0 means no usable evidence, 1 means an assertion without a supporting artifact, 2 means relevant evidence with unresolved gaps, and 3 means evidence that addresses your scope. Multiply each score by its weight and divide the sum by 3 for a percentage. Keep the notes beside the number; the notes explain the decision.

For example, scores of 3, 2, 2, 1, and 2 yield 71.7%. That is an illustrative calculation, not a recommended award threshold. A candidate still needs to resolve any mandatory security or staffing gap.

What comparable software evidence looks like

Rainier's Vennli scheduling portal engagement is a concrete example: a twelve-month subcontract covering a Python domain model, routing and deconfliction logic, and a React/Material UI portal for a U.S. Air Force program. The published case study identifies our role and scope. It does not establish eligibility or capacity for a different acquisition.

For a similar scope, ask the candidate to walk through a conflicting crew assignment: where the rule lives, how the API rejects it, how the interface explains it, and how the behavior is tested. That conversation connects the claimed architecture to an observable result. Our software acceptance checklist turns those questions into reviewable deliverables.

When should you start?

Earlier than most teams do. Verifying status, negotiating work share, agreeing data rights, and confirming a subcontractor can hold the cyber level you need all take longer than the days left before a proposal is due. Teams assembled in the final week tend to paper over exactly the questions above, and those are the ones that surface later as performance problems.

Rainier Software Solutions is a Washington-based software engineering firm that works as a prime or a subcontractor. Our registration record is public: UEI RGM1E2MJCBD9, CAGE 17PL6, primary NAICS 541511, active in SAM.gov. Review our contracting routes and teaming information alongside the technical evidence. If you need the software scope covered, send the requirements and we will assess the fit.

Talk to an engineer about your scope→