SBA Subcontracting Goals: What Primes Need

SBA Subcontracting Goals: What Prime Contractors Need from a Cloud Sub

Every federal prime contractor working on a contract above $750,000 carries a legal obligation that shapes how they staff and deliver: meeting the Small Business Administration's subcontracting goals. For IT and cloud programs, finding a qualified small business sub who can actually deliver — not just fill a checkbox — is consistently harder than it looks.

This article breaks down how those goals work, why they matter beyond compliance, and what primes should expect from a cloud engineering and DevSecOps subcontractor who can help them meet those goals while adding real technical capacity.

What SBA Subcontracting Goals Actually Require

Under the Federal Acquisition Regulation (FAR 52.219-9), any prime contractor with a federal contract exceeding $750,000 (or $1.5M for construction) must submit an acceptable Small Business Subcontracting Plan before award. That plan commits to specific dollar targets across socioeconomic categories:

• Small business (SB): typically 23–26% of subcontracted value
• Small disadvantaged business (SDB): 5–12%
• Women-owned small business (WOSB): 5%
• HUBZone small business: 3%
• Veteran-owned small business (VOSB): 3%
• Service-disabled veteran-owned small business (SDVOSB): 3%

These aren't aspirational targets — they're scored in CPARS and tracked in the Electronic Subcontracting Reporting System (eSRS). Underperformance affects a prime's competitive standing on future awards and can trigger liquidated damages clauses. Contracting officers notice.

Why Most Primes Struggle to Find a Good Cloud Sub

The challenge isn't finding a small business sub — the SAM.gov and DSBS databases list thousands. The challenge is finding one that can actually deliver cloud-native engineering work at the pace a government program demands, without creating oversight burden for the prime's program manager.

Common failure modes Rutagon has observed in the market:

• Body shops masquerading as cloud shops — staff aug firms that place W-2 resources labeled "cloud engineers" who have never written a Terraform module or managed an OIDC-federated pipeline in production
• Subs who need significant ramp time — companies that can deliver eventually, but burn the first 2-3 sprints figuring out the environment
• Compliance gaps — subs with no CMMC posture, no SPRS submission, no understanding of DFARS 252.204-7012 — creating downstream liability for the prime

A prime's program manager effectively takes on a second job when a sub can't self-manage. That cost rarely shows up in the subcontracting plan analysis, but it shows up everywhere else.

What Rutagon Brings to a Prime Teaming Arrangement

Rutagon (UEI: FB2FHEJHM493, CAGE: 19ZR7, active SAM.gov registration as of March 2026) is an Alaska-based cloud engineering and DevSecOps firm. The company was built for exactly the environment where primes need a sub who shows up ready.

Delivery readiness from day one:

Rutagon's infrastructure patterns are Terraform-first, OIDC-federated, and compliant by design. A production SaaS platform running 25+ AWS services with 24 Lambda functions and Aurora Serverless v2 was built from scratch with zero long-lived credentials in the CI/CD pipeline. Government programs get those same patterns, applied to their environment, from the first sprint.

DevSecOps integration, not bolt-on:

Security isn't an audit event at Rutagon — it's woven into every deployment pipeline. Vulnerability scanning (Trivy, AquaSec), SAST/DAST gates, signed container images (Cosign), and policy-as-code enforcement (Checkov, OPA) run on every commit. For primes delivering to DoD customers with CMMC Level 1 and Level 2 requirements, this eliminates an entire category of risk.

Compliance posture:

Rutagon maintains an active SPRS submission and tracks NIST 800-171 controls continuously — not as a point-in-time exercise. DFARS 252.204-7012 incident reporting infrastructure is configured and tested. CUI handling procedures are documented. A prime's subcontracting plan benefits from a sub that won't generate a compliance finding mid-program.

Alaska geographic advantage:

Alaska's defense infrastructure — JBER, Eielson AFB, Clear SFS, UAF Geophysical Institute, NOAA, Coast Guard District 17 — creates local relationships that national primes often can't access directly. For Alaska-based contracts or programs with Alaska elements, Rutagon's location is a meaningful differentiator in the teaming package.

How the Subcontracting Goal Math Works

When a prime builds a subcontracting plan, they're committing specific dollar values to small business categories. Here's a simplified example for a $10M IT modernization contract:

A 12-month subcontract with Rutagon at $150/hr across 3 full-time equivalents represents roughly $936K annually — a significant portion of the SB category goal, delivered by engineers the prime's PM can rely on rather than monitor.

The value to the prime isn't just the checkbox. It's the pipeline reliability, the reduced overhead, and the CPARS rating that reflects a program that ran on time with a well-functioning team.

What to Expect in a Teaming Discussion

Rutagon approaches teaming arrangements as a delivery partnership, not a staffing relationship. Before engaging, a prime should have clarity on:

• NAICS codes and work scope — Rutagon's primary NAICS is 541512 (Computer Systems Design) with 541511, 541519, and 518210 as secondaries. The work should match.
• Clearance requirements — Rutagon is currently uncleared. All work must be at the unclassified or CUI level. Clearance sponsorship is actively pursued for future phases.
• Prime teaming vs. flow-down requirements — Rutagon accepts FAR/DFARS flow-down clauses including CMMC, DFARS 252.204-7012, and small business subcontracting plan requirements.
• Alaska presence value — If the program has Alaska components or the proposal benefits from local presence, Rutagon's Wasilla principal office provides geographic credibility.

Capability Statement and SAM Registration

Rutagon's capability statement (v4, updated March 2026 with active CAGE code) is available at rutagon.com/government. It covers core competencies, past performance references, differentiators, NAICS codes, and company data in the standard one-page federal format.

Active SAM.gov registration details:

• UEI: FB2FHEJHM493
• CAGE: 19ZR7
• Primary NAICS: 541512
• Status: Active (renewed annually, next renewal March 2027)

For primes building a teaming package or subcontracting plan, Rutagon can provide a completed Representation and Certification document, evidence of cyber insurance and general liability coverage, and a CMMC self-assessment score.

The Right Sub Changes the Whole Program

The best subcontracting plans aren't built around who can fill a slot — they're built around who can make the program run better. A cloud sub that eliminates the prime's infrastructure overhead, ships compliant code on day one, and tracks their own compliance posture is a force multiplier, not a burden.

If you're building a federal team and need a cloud engineering or DevSecOps sub with an active SAM.gov registration and zero-credential production infrastructure, explore teaming with Rutagon.

Explore teaming with Rutagon → rutagon.com/contact

Frequently Asked Questions

What percentage of a federal contract must go to small business subcontractors?

For most federal contracts over $750,000, primes must commit 23–26% of subcontracted value to small businesses, with additional targets for SDB, WOSB, HUBZone, and veteran-owned categories. Exact percentages are negotiated with the contracting officer and written into the subcontracting plan.

Does a prime contractor face penalties for missing subcontracting goals?

Yes. Missing subcontracting goals is reported in CPARS and tracked in eSRS. Persistent underperformance can affect a prime's competitive ratings on future awards. Some contracts include liquidated damages clauses for significant plan non-compliance.

What NAICS codes does Rutagon work under as a subcontractor?

Rutagon's primary NAICS is 541512 (Computer Systems Design and Related Services), with 541511 (Custom Computer Programming), 541519 (Other Computer Related Services), and 518210 (Data Processing and Hosting) as secondaries. These cover cloud architecture, DevSecOps, full-stack development, and government IT modernization work.

Does Rutagon have an active SAM.gov registration?

Yes. Rutagon's SAM.gov registration became active on March 17, 2026. UEI: FB2FHEJHM493, CAGE Code: 19ZR7. The registration is current and renewed annually through March 2027.

Can Rutagon work on classified federal programs?

Rutagon currently operates at the unclassified and CUI level. Clearance sponsorship is actively being pursued through prime teaming arrangements. Any program requiring Secret or above clearance is currently out of scope but is a target for Phase 2 operations (September 2026 onward).