NAICS code selection is one of the most consequential yet overlooked business decisions a defense IT contractor makes. Your NAICS codes determine size standard eligibility, which set-asides you qualify for, how agencies find you, and which small business certifications you can hold.
Getting this right — and keeping it updated — directly impacts your contract opportunities.
How NAICS Codes Work in Defense IT
The North American Industry Classification System (NAICS) classifies businesses by their primary economic activity. In government contracting, each solicitation identifies a NAICS code, and the offeror must be classified under that code to represent itself as a small business for set-aside purposes.
Your SAM.gov registration lists your primary NAICS code and any additional codes relevant to your business. Contracting officers search SAM.gov by NAICS code to identify potential sources, so the codes you list affect which solicitations find you — and whether you're visible at all.
Key NAICS Codes for Defense IT Companies
Cloud and Software Services
541511 — Custom Computer Programming Services
- Size standard: $34M annual receipts
- Covers: Custom software development, application programming, system integration
- Most common code for small software firms doing custom development for DoD
541512 — Computer Systems Design Services
- Size standard: $34M annual receipts
- Covers: Systems architecture, IT consulting, design services for IT systems
- Often used alongside 541511 for integrated development and design work
541519 — Other Computer Related Services
- Size standard: $34M annual receipts
- Covers: Database design, computer maintenance, network integration, data recovery
Cybersecurity and IT Services
541513 — Computer Facilities Management Services
- Size standard: $34M annual receipts
- Covers: IT infrastructure management, managed services, NOC/SOC operations
561990 — All Other Support Services
- Size standard: $19M or $34M (check current SBA table)
- Sometimes used for cybersecurity services when the primary activity is security operations vs. software development
Research and Development
541715 — Research and Development in the Physical, Engineering, and Life Sciences (except Nanotechnology and Biotechnology)
- Size standard: 1,000 employees or $1B receipts
- Covers: Technology R&D relevant to defense systems, software R&D
- Size standard is much higher — many "small" defense tech companies are actually small under this code
541714 — Research and Development in Computer Science
- Note: This code was restructured in recent NAICS revisions — verify the current applicable code
Size Standards: Why They Matter for Set-Asides
Small business size standards under each NAICS code determine:
- Which set-aside solicitations you can bid as a small business
- Whether your small business certifications (8(a), HUBZone, WOSB) are active for that code
- Your competitive tier in multiple-award contract competitions
Size standards are revenue-based for most services: $34M for most IT-related NAICS codes under 54151x. This means a company with $40M in annual revenue is large under these codes — ineligible for small business set-asides in these categories.
However, the same company may be small under 541715 (R&D) with a 1,000 employee standard. This is why many defense R&D firms choose 541715 as their primary NAICS — it maintains small business status at much higher revenue levels.
Multiple NAICS Codes in SAM.gov
You can list multiple NAICS codes in SAM.gov. List all codes that reflect your actual work — this broadens your visibility in searches and allows you to accurately represent your size status under different codes.
Important: For a specific solicitation, the contracting officer designates the NAICS code. Your self-certification as small (or large) for that solicitation uses the size standard for that specific code, not your primary code. Don't add NAICS codes you don't actually perform under — this can be seen as misrepresentation.
NAICS Code and Set-Aside Programs
NAICS code selection intersects with set-aside program eligibility:
- 8(a) BD: Apply under a primary NAICS code. SBA approval is code-specific.
- HUBZone: Size determination uses the solicitation's NAICS code
- WOSB/EDWOSB: Eligibility is industry-specific — only designated NAICS codes qualify for WOSB set-asides (SBA maintains the list)
- SDVOSB: Generally applicable across NAICS codes, but size determined per solicitation code
See Rutagon's small business set-aside IT federal guide and SBIR Phase III transition guide for related contracting strategy context.
Explore Rutagon's government contracting capabilities.
FAQ
How do I change my primary NAICS code in SAM.gov?
Log into SAM.gov and navigate to your entity registration. Update the primary NAICS code in the "Goods and Services" section. Your entity registration may need to be renewed or reviewed when making significant changes. The primary NAICS code change is reflected after SAM.gov processes the update (typically within 24–72 hours).
Can selecting the wrong NAICS code cost me a contract?
Yes. If you incorrectly self-certify as small under a NAICS code where you exceed the size standard, you risk disqualification, protest by competitors, and potential suspension/debarment for misrepresentation. SBA size protests can trigger detailed financial reviews. Verify your average annual receipts against the current size standard for every NAICS code before representing yourself as small.
What NAICS code is best for a defense cybersecurity company?
541513 (Computer Facilities Management Services) and 541511 (Custom Computer Programming) are both common for defense cybersecurity firms depending on whether the primary offering is managed security services (513) or security software development (511). Many firms use both. If you also conduct security R&D, 541715 provides a higher size threshold. Your actual primary business activity should drive the selection.
Do NAICS codes affect what contracts appear in my SAM.gov search results?
SAM.gov's procurement search allows filtering by NAICS code. Having the relevant codes in your registration helps contracting officers find you through capability searches. Additionally, some government-wide acquisition vehicles (GWACs, MACs) have NAICS code eligibility requirements — being registered under the right codes is necessary to qualify.
How often should a defense IT company review its NAICS codes?
Review your NAICS code list annually as part of your SAM.gov renewal. More importantly, review whenever your service offerings change significantly, when pursuing a new contract vehicle with specific NAICS requirements, or when evaluating a new set-aside certification. SBA updates size standards periodically — your revenue may push you over a threshold without any change to your business.