Checklist · Government Contracts

Bidding on a Federal Contract: A Proposal and Compliance Checklist

41 U.S.C. §§ 2101

Type
Checklist
Jurisdiction
National
Date
2024-03-14
Topic
Government Contracts

Federal proposals are won and lost on process, not eloquence. This checklist walks a contractor through fifteen phases, from eligibility to award: registering in the System for Award Management and obtaining a Unique Entity Identifier, confirming the NAICS code and computing size status with affiliates, and then reading the solicitation the way the evaluators will, because Sections L and M control everything. It shows how to decode the evaluation approach (best-value tradeoff versus lowest price technically acceptable), make an honest bid/no-bid call, raise solicitation defects before the deadline while the objection still exists, and build the technical volume to the stated evaluation factors rather than to your marketing deck. It then covers past performance and CPARS, pricing for reasonableness and realism, the representations and certifications that carry False Claims Act exposure, teaming agreements and subcontracting limits, small-business and domestic-preference compliance, and cybersecurity flow-downs. Assembly and submission get their own phase, because the late-proposal rule is the harshest rule in federal procurement and it is not a bluff. It closes with debriefing and protest-preservation steps, a list of common mistakes, a consolidated one-glance checklist, and the primary authority behind each phase. Federal procurement rules, thresholds, and clause lists change constantly, so every figure here is illustrative and must be checked against your own solicitation.

Bidding on a Federal Contract: A Proposal and Compliance Checklist

Government Contracts > Federal Procurement | Published 14 March 2024 - Updated 26 August 2025 | UpLaw - uplaw.us

The federal government is the largest buyer on earth, and it buys by rule. A proposal that ignores the rules is not a weak proposal — it is frequently not a proposal at all. This checklist is about the rules.

Keywords: federal contract bidding, SAM registration, UEI, NAICS code, size standard, Section L, Section M, best value tradeoff, LPTA, past performance, CPARS, cost realism, representations and certifications, False Claims Act, Buy American Act, CMMC, late proposal, debriefing

How to use this checklist

Commercial selling rewards relationships, persuasion, and flexibility. Federal selling rewards compliance, responsiveness, and traceability. The Federal Acquisition Regulation (FAR, codified at 48 C.F.R. Chapter 1) is the rulebook, and the source selection team is bound by the solicitation it published. Your proposal will be scored by strangers, against a matrix, in a room you will never see.

Work the phases below in order. Each phase has check items you can actually tick, followed by a short "Why it matters, and the traps" explanation. For the doctrinal foundation behind all of this — authority of the contracting officer, contract types, the Christian doctrine, changes and claims — start with Government Contracts: A Comprehensive Guide to Federal Procurement. For the full map of resources, see The Government Contracts Toolkit.

Our running example. Cobalt Ridge Analytics is a nine-person data-analytics firm in Ohio. It has never held a prime federal contract. It has spotted a small-business set-aside for data-migration and dashboard support at a civilian agency, ceiling roughly $4.2 million over five years. Cobalt Ridge will appear throughout — including the night it nearly blew the deadline.

Phase 1 — Get eligible: SAM registration, UEI, NAICS code, and size status

  • [ ] Register the entity in the System for Award Management (SAM) at sam.gov and complete every section, including the financial/EFT data and the Reps and Certs.
  • [ ] Obtain the Unique Entity Identifier (UEI) issued through SAM (the UEI replaced the DUNS number for federal award purposes in April 2022).
  • [ ] Verify the registration is active — not "submitted," not "pending validation." Entity validation can take weeks.
  • [ ] Calendar the annual renewal; SAM registration lapses and a lapsed registration can cost you an award.
  • [ ] Identify the NAICS code the agency assigned to the solicitation and pull the corresponding size standard (receipts- or employee-based) from SBA's table at 13 C.F.R. § 121.201.
  • [ ] Compute size including all affiliates under SBA's affiliation rules (13 C.F.R. § 121.103) — common ownership, common management, identity of interest, and the ostensible-subcontractor rule all count.
  • [ ] Confirm any socioeconomic status you intend to claim (8(a), HUBZone, SDVOSB, WOSB/EDWOSB) is certified and current where certification is required.
  • [ ] Check that neither the entity nor its principals appear as excluded parties in SAM.
  • [ ] Confirm no active tax delinquency or felony conviction disclosure problem that would trigger an appropriations-act prohibition.

Why it matters, and the traps. FAR 4.1102 conditions award on active SAM registration, and FAR 52.204-7 puts the burden squarely on the offeror. Contracting officers routinely eliminate otherwise excellent proposals for an inactive registration, and the Government Accountability Office (GAO) has consistently declined to rescue offerors from their own lapses. The registration is not paperwork you do the week the proposal is due; it is infrastructure you build months earlier.

Size status is the other silent killer. Size is measured as of the date of the initial offer including price, and it sweeps in affiliates. A firm that is small on its own but jointly controlled with a larger company by the same family may be other than small — and a size protest after award unwinds the whole thing. Cobalt Ridge's owner also holds 45% of a staffing company; before bidding a set-aside, that relationship has to be run through the affiliation rules, not waved away. The certification-and-eligibility mechanics are worked in detail in Small Business Set-Asides and SBA Certification: A Practical Checklist. If your entity structure is still forming, The Small Business Legal Toolkit covers the corporate housekeeping that affiliation analysis will later depend on.

Accuracy note: SAM's validation process, NAICS size standards, and the socioeconomic certification programs change regularly, and dollar thresholds are periodically adjusted for inflation. Verify current requirements at sam.gov and sba.gov before relying on any figure in this document.

Phase 2 — Find the opportunity and read the ENTIRE solicitation

  • [ ] Search and set alerts on SAM.gov (Contract Opportunities) for your NAICS codes and agencies.
  • [ ] Read sources sought notices and requests for information — they are how requirements get shaped, and they run months before the solicitation.
  • [ ] Download every attachment, amendment, wage determination, Q&A file, and appendix. Not the PDF someone forwarded you; the official posting.
  • [ ] Read the solicitation front to back once, without a highlighter, before you start extracting requirements.
  • [ ] Build a compliance matrix mapping every "shall," "must," and "will" to a proposal location, an owner, and a page limit.
  • [ ] Note the contract type (firm-fixed-price, cost-reimbursement, T&M, IDIQ with task orders) and what it does to your risk.
  • [ ] Confirm whether the buy is under FAR Part 12 (commercial products and services), FAR Part 15 (negotiated), FAR Part 13 (simplified acquisition), or FAR Part 8 (schedules) — the rules differ.
  • [ ] Acknowledge every amendment in the form the solicitation specifies.

Why it matters, and the traps. A negotiated solicitation follows the Uniform Contract Format (FAR 15.204-1): Sections A–H are the contract, Section I holds the clauses, Section J the attachments, and Sections K, L, and M govern your offer. Commercial buys under FAR Part 12 use FAR 52.212-1 (instructions) and FAR 52.212-2 (evaluation) instead, and they are shorter — but not simpler.

The classic trap is treating the RFP like marketing collateral: skimming the statement of work, ignoring Section L, and never opening Section J. Requirements hide in attachments. Failing to acknowledge an amendment can render your offer unacceptable. And the single most expensive omission is not building the compliance matrix — because an evaluator who cannot find your response to a requirement will score it as absent.

Phase 3 — Sections L and M are the exam: instructions and evaluation factors

  • [ ] Extract Section L (Instructions, Conditions, and Notices to Offerors) into a submission-mechanics sheet: volumes, file formats, fonts, margins, page limits, file-naming, portal, and the exact due date/time and time zone.
  • [ ] Extract Section M (Evaluation Factors for Award) into a scoring sheet: every factor, subfactor, and their relative importance.
  • [ ] Confirm the relative weight of price against non-price factors — is technical "significantly more important than," "approximately equal to," or "less important than" cost?
  • [ ] Identify each factor's adjectival ratings or confidence ratings and what a top rating actually requires.
  • [ ] Note anything Section L says is excluded from page counts (résumés, past-performance forms, cross-reference matrices).
  • [ ] Note any "do not include price in the technical volume" instruction and enforce it ruthlessly.
  • [ ] Reconcile L and M against each other — if L asks for something M does not evaluate, or M evaluates something L never asked for, that is a question for Phase 6.

Why it matters, and the traps. Section M is the answer key. Section L is the format the answer must be written in. Everything else in the solicitation is context. Source selection officials must evaluate proposals in accordance with the stated criteria — that is the core discipline of FAR 15.303 and 15.305, and it is the most common ground on which protests are sustained. The corollary is unforgiving: an evaluator may not give you credit for a strength you buried outside the volume where the factor lives.

Page limits are enforced as written. Agencies routinely discard everything past the limit, unread. Cobalt Ridge's first draft technical volume ran 41 pages against a 30-page limit; the eleven best pages of its solution would have been thrown away.

Phase 4 — Decode the evaluation approach: best value tradeoff vs. LPTA

  • [ ] Determine where on the best-value continuum (FAR 15.101) this procurement sits.
  • [ ] If it is a tradeoff (FAR 15.101-1): identify what non-price superiority is worth paying for, and say so explicitly in your proposal.
  • [ ] If it is lowest price technically acceptable (FAR 15.101-2): stop selling. Meet every acceptability threshold exactly, and price to win.
  • [ ] For LPTA, list the acceptability criteria and confirm you satisfy each one — nothing above "acceptable" earns a dollar.
  • [ ] For tradeoff, map each proposed strength to a benefit to the government, not a feature of your company.
  • [ ] Check for price-realism language even on fixed-price buys (see Phase 9).
  • [ ] Note any "technical acceptability gate" before price is opened.

Why it matters, and the traps. The single most costly strategic error in federal proposals is writing a Cadillac proposal into an LPTA procurement, or a Yugo proposal into a tradeoff. Under LPTA, gold-plating is pure waste: you spend money and price yourself out while earning zero evaluation credit. Under tradeoff, bare compliance is a losing hand: you have handed the source selection authority no basis to pay you more than the cheapest acceptable bidder. Congress has, in recent years, statutorily constrained the Department of Defense's use of LPTA and directed a preference for tradeoff on complex or knowledge-based work; the FAR was amended to reflect similar limits. Read the solicitation, and read the current rule — this area has moved.

Cobalt Ridge's Section M made technical approach and past performance, combined, "significantly more important than price." That single sentence meant its proposal needed to justify a premium — and that it should not have been racing a bottom-feeder to the price floor.

Phase 5 — The honest bid/no-bid decision

  • [ ] Score the opportunity against real gates: Do we meet the mandatory qualifications? Do we have relevant past performance? Do we know the customer? Is there an incumbent, and is the incumbent vulnerable?
  • [ ] Ask whether the requirement appears wired — a NAICS code, key-personnel requirement, or experience threshold that only one firm plausibly meets.
  • [ ] Estimate bid and proposal (B&P) cost honestly, including opportunity cost of your best people.
  • [ ] Confirm you have the capacity to perform if you win — bonding, staffing, security clearances, facility clearance.
  • [ ] Check for organizational conflicts of interest under FAR subpart 9.5 (unequal access to information, impaired objectivity, biased ground rules).
  • [ ] Confirm no Procurement Integrity Act problem — no one on your team is holding contractor bid or proposal information or source selection information they should not have (41 U.S.C. §§ 2101–2107).
  • [ ] Decide, in writing, with a named decision-maker. Then honor the decision.

Why it matters, and the traps. Federal capture is a portfolio game with a low hit rate; firms lose money by bidding everything. The discipline is to say no early and loudly.

Conflicts deserve special attention. An OCI is not a moral failing — it is a structural fact — but an unmitigated OCI can disqualify you and can be raised by a competitor. The Federal Circuit requires "hard facts," not mere suspicion, before an agency finds a disqualifying OCI (see Axiom Resource Management, Inc. v. United States (Fed. Cir. 2009)); but the contracting officer has broad discretion, and the safe move is to identify the issue and propose a mitigation plan yourself. Similarly, if a former agency official joined your firm, run the post-employment and Procurement Integrity Act analysis before you bid, not after a competitor raises it. That analysis lives in the same neighborhood as the anti-corruption and internal-controls work described in The Corporate Compliance Toolkit and, for the criminal edges, White-Collar Crime and Corporate Criminal Liability: A Comprehensive Guide.

Phase 6 — Ask questions before the deadline (and understand they become public)

  • [ ] Calendar the question cutoff separately from the proposal deadline. It is usually much earlier.
  • [ ] Submit questions in the exact format and channel required.
  • [ ] Frame questions so the answer helps you without teaching competitors your solution.
  • [ ] Ask about ambiguities, conflicts between L and M, unrealistic page limits, and impossible requirements — these are your only chance.
  • [ ] If the solicitation contains a patent defect (an apparent, on-its-face error or an unduly restrictive requirement), decide now whether to protest the terms.
  • [ ] Read every published Q&A amendment; treat the answers as binding solicitation text.

Why it matters, and the traps. This phase carries a hard legal deadline, not merely a practical one. Under the Blue & Gold rule, an offeror that fails to object to a patent solicitation defect before the deadline for receipt of proposals waives the objection and cannot raise it later in a bid protest. Blue & Gold Fleet, L.P. v. United States, 492 F.3d 1308 (Fed. Cir. 2007). GAO's timeliness regulation is to the same effect: protests of solicitation improprieties apparent before the closing time must be filed before that closing time. 4 C.F.R. § 21.2(a)(1).

That is the trap. Contractors routinely notice a defective evaluation scheme, say nothing because they hope to win anyway, lose, and then discover the objection is gone forever. If the solicitation is broken in a way that will cost you the award, raise it now — through questions first, and, if necessary, through a pre-award protest. The mechanics are in Filing a Bid Protest: A Practical Checklist.

Phase 7 — Build the technical volume TO the evaluation factors, not to your marketing

  • [ ] Outline the technical volume directly from Section M. Same order, same headings, same vocabulary.
  • [ ] Insert a cross-reference matrix (requirement → page number) if permitted.
  • [ ] For each requirement, state what you will do, how, who does it, and what the government gets — not what your company "is committed to."
  • [ ] Convert every claim into a discriminator: a benefit, quantified, tied to a stated evaluation factor.
  • [ ] Address risk explicitly. Evaluators are trained to find risk; name yours and retire them.
  • [ ] Include the key personnel the solicitation demands, with commitment letters if required, and be prepared for a key-personnel bait-and-switch challenge if they leave.
  • [ ] Have a red team (people who did not write it) score the draft against Section M, cold.
  • [ ] Purge marketing adjectives. "World-class," "best-in-breed," and "leverage" are not evaluation factors.

Why it matters, and the traps. Evaluators are reading dozens of proposals against a form. Make it effortless to give you points. When your headings mirror Section M, the evaluator's worksheet fills itself in. When they do not, the evaluator must hunt — and hunting produces weaknesses.

Cobalt Ridge's first draft opened with three pages about its founding story. Its rewrite opened with a table mapping each Section M subfactor to a page and a stated benefit ("reduces cutover downtime from 14 hours to under 2, eliminating a weekend outage the agency has absorbed in each of the last three migrations"). That is a discriminator. The founding story is not.

If your solution embeds licensed software or open-source components, resolve the license terms before you propose them — a right you do not have is a promise you cannot keep. See Reviewing a Software License Agreement: A Practical Checklist and, for negotiation posture, Software License Agreements: Key Terms and How to Negotiate Them. Data rights in what you deliver — technical data and computer software — are their own battleground; note whether the solicitation asserts unlimited rights and whether you are asserting restrictions.

Phase 8 — Past performance, CPARS, and how to handle a thin record

  • [ ] Pull your CPARS (Contractor Performance Assessment Reporting System) record and read every evaluation.
  • [ ] Rebut or comment on any negative CPARS evaluation within the response window — a comment you never filed is a rating you have effectively conceded.
  • [ ] Select references that are recent and relevant as the solicitation defines those words (scope, magnitude, complexity), not merely your favorite clients.
  • [ ] Send past-performance questionnaires early and chase them; a reference who does not respond is a blank score.
  • [ ] Where you lack a record, propose subcontractor or affiliate past performance — but only if the solicitation permits it and the entity will actually perform meaningful work.
  • [ ] Draw the express link between each reference and the work you are proposing here.
  • [ ] Understand your neutral rating rights: an offeror without relevant past performance may not be evaluated favorably or unfavorably on that factor. FAR 15.305(a)(2)(iv).

Why it matters, and the traps. Past performance is where new entrants panic. The rule is more forgiving than they think: a firm with no relevant history gets a neutral/unknown-confidence rating and cannot be penalized for it. But "neutral" is not "good," and in a tradeoff it is a real disadvantage against an incumbent with a wall of Exceptional ratings.

The deeper trap is CPARS neglect. A single Marginal rating, uncontested, follows you for three years across every agency. Contractors treat CPARS as an administrative annoyance; it is a sales asset. Read it, respond to it, and escalate factual errors through the contract's own dispute mechanisms.

Cobalt Ridge had no federal past performance. It proposed two commercial references of similar scope and magnitude, plus its teaming partner's federal record — and it said so plainly rather than hoping the evaluator would not notice.

Phase 9 — Pricing: realism, reasonableness, and the unbalanced-pricing trap

  • [ ] Build the price from a basis of estimate you can defend line by line — labor categories, hours, rates, escalation, indirect rates, fee.
  • [ ] Confirm your indirect rate structure and whether the agency will want a rate agreement or an audit.
  • [ ] Test for price reasonableness (is it too high?) — FAR 15.404-1(b).
  • [ ] Test for cost realism (is it too low to do the work?) — FAR 15.404-1(d). Realism analysis can apply to fixed-price buys where the solicitation says so, and a "realism" downgrade can also become a risk downgrade on the technical factor.
  • [ ] Screen for unbalanced pricing — materially over- or understated line items — which can make an offer ineligible for award. FAR 15.404-1(g).
  • [ ] Price every CLIN, including option years and any priced options the agency will evaluate.
  • [ ] Determine whether certified cost or pricing data is required (Truthful Cost or Pricing Data statute, 41 U.S.C. § 3502 / 10 U.S.C. § 3702; FAR 15.403-4) and whether an exception applies (commercial products, adequate price competition).
  • [ ] If certified data is required, understand defective pricing exposure — the government can recover the overstatement, with interest.
  • [ ] Confirm wage determinations: Service Contract Labor Standards (41 U.S.C. §§ 6701–6707) for services; Davis-Bacon (40 U.S.C. §§ 3141–3148) for construction. Your labor rates must clear the applicable floor.
  • [ ] Sanity-check the price against your cost of capital and payment cycle — federal payment is reliable but not fast.

Why it matters, and the traps. New contractors underprice, win, and then discover they have bought a five-year obligation to lose money. Sophisticated agencies see this coming: cost realism exists precisely to prevent buying-in, and a proposal the agency thinks cannot be performed at the offered price gets marked down for risk, not rewarded for thrift.

Watch the certification. Certified cost or pricing data must be accurate, complete, and current as of the agreement date. If it is not, you face defective-pricing recovery — and, in aggravated cases, the False Claims Act. The threshold for certified data is periodically adjusted for inflation; do not rely on a number you memorized.

Wage determinations are where service contractors bleed. If the solicitation attaches an SCA wage determination, your incumbent-capture labor rates are a legal floor, not a negotiating position. And if you are staffing with 1099 contractors to keep rates low, run the classification analysis first — see Classifying Workers: Employee or Independent Contractor — A Practical Checklist. Misclassification on a federal service contract is a wage-law problem and a certification problem.

Phase 10 — Representations and certifications: read them; they carry FCA exposure

  • [ ] Open Section K (or FAR 52.212-3 on commercial buys) and read every representation out loud, with the person who actually knows the facts.
  • [ ] Confirm the annual reps and certs in SAM are current and consistent with what you are certifying here (FAR 52.204-8).
  • [ ] Verify the size and socioeconomic representations against the affiliation analysis from Phase 1.
  • [ ] Verify the Section 889 representation (covered telecommunications and video surveillance equipment/services — FAR 52.204-24, -25, -26). This requires you to actually look at your equipment and your supply chain.
  • [ ] Verify domestic-preference representations (Phase 12).
  • [ ] Verify the responsibility representations: taxes, convictions, debarment, integrity, and business-ethics records.
  • [ ] Have an officer with actual knowledge sign — not the proposal manager.
  • [ ] Keep the file: the facts, the analysis, and who verified what. If you are ever asked, the file is the defense.

Why it matters, and the traps. This is the phase that turns a lost proposal into a lawsuit. A false certification on a federal proposal is not a paperwork error; it is potential liability under the False Claims Act, 31 U.S.C. § 3729, with treble damages, per-claim penalties, and a qui tam bounty that motivates your own former employees to bring the case (31 U.S.C. § 3730).

The Supreme Court has made both edges of the doctrine sharp. In Universal Health Services, Inc. v. United States ex rel. Escobar, 579 U.S. 176 (2016), the Court endorsed the implied false certification theory — submitting a claim while failing to disclose noncompliance with a material requirement can be actionable — while insisting that materiality is a "demanding" standard, not satisfied by any technical violation. And in United States ex rel. Schutte v. SuperValu Inc., 598 U.S. 739 (2023), the Court held that FCA scienter turns on the defendant's subjective knowledge and belief — an after-the-fact lawyerly reinterpretation of an ambiguous rule does not immunize a defendant who actually believed it was overbilling.

The practical lesson: certifications are only safe when someone checked. Section 889 in particular has caught out hundreds of contractors who certified compliance without ever inventorying their cameras and routers. If your supply chain crosses borders, the same discipline applies to export and sanctions certifications — see Export Control and Sanctions Compliance: A Practical Checklist.

Phase 11 — Teaming agreements, joint ventures, and subcontracting plans

  • [ ] Decide the structure: prime/subcontractor team (FAR 9.601(2)), joint venture (FAR 9.601(1)), or SBA mentor-protégé JV (13 C.F.R. §§ 125.8–125.9).
  • [ ] Paper the teaming agreement before the proposal, with exclusivity, a defined workshare, proposal-cost allocation, and confidentiality.
  • [ ] Make the teaming agreement as definite as you can: scope, price or pricing formula, and the subcontract's material terms.
  • [ ] Confirm the limitations on subcontracting if this is a set-aside: the prime must perform the required share of the work (13 C.F.R. § 125.6; FAR 52.219-14).
  • [ ] Run the ostensible subcontractor analysis — if the sub is doing the primary and vital work or the prime is unusually reliant on it, SBA may treat them as affiliates and the "small" prime is no longer small (13 C.F.R. § 121.103(h)).
  • [ ] If you are a large business bidding an unrestricted contract above the threshold, prepare a small business subcontracting plan (FAR 19.702; FAR 52.219-9) with real, defensible goals.
  • [ ] Execute an NDA with every teammate before exchanging proposal content.
  • [ ] Address key personnel commitments from teammates in writing.

Why it matters, and the traps. The teaming agreement is where good intentions go to die. Courts applying ordinary state contract law have repeatedly held that a teaming agreement that leaves the subcontract's scope, price, or material terms "to be negotiated in good faith after award" is an unenforceable agreement to agree — Virginia courts, whose law governs a great many of these agreements, have been especially unforgiving. The result is a partner who helped you win and then walks, or who holds you up on price. The cure is definiteness: attach the statement of work, fix the price or a formula, and attach the form subcontract. General drafting technique for that kind of instrument is in The Commercial Contracts Toolkit: Drafting, Reviewing, and Enforcing Business Agreements, and the confidentiality layer in Building an Enforceable NDA Clause by Clause: A Practical Checklist.

The set-aside trap is worse. A small prime that subcontracts the heart of the work to a large "partner" has not built a team; it has built a size protest. Cobalt Ridge teamed with a mid-size integrator for the migration tooling — and deliberately kept the analytics build, the key personnel, and the project management in-house, precisely so the ostensible-subcontractor rule would not swallow its small-business status.

Phase 12 — Small business, domestic preference (Buy American/TAA), and labor compliance

  • [ ] Confirm the set-aside type and that you qualify on the date of your offer.
  • [ ] Identify every domestic-preference clause in Section I. The Buy American Act (41 U.S.C. §§ 8301–8305; FAR subpart 25.1) applies to supplies for use in the United States; the Trade Agreements Act (19 U.S.C. § 2501 et seq.; FAR subpart 25.4) may displace it above the TAA threshold and permit designated-country end products.
  • [ ] For BAA, test each end product: is it manufactured in the United States, and does it meet the domestic content percentage in effect for your contract? (The domestic content threshold has been stepping upward on a published schedule — verify the number applicable to your award.)
  • [ ] For TAA, test substantial transformation — where did the article become a new article of commerce with a distinct name, character, or use?
  • [ ] Screen out non-designated country end products where TAA applies. (China is not a designated country under the TAA.)
  • [ ] If DoD: check the Berry Amendment (domestic sourcing for textiles, food, and certain materials) and specialty-metals restrictions.
  • [ ] Confirm applicable labor standards: SCA wage determinations, Davis-Bacon for construction, and the affirmative-action and veteran/disability obligations under 38 U.S.C. § 4212 (VEVRAA) and Section 503 of the Rehabilitation Act, 29 U.S.C. § 793.
  • [ ] Confirm Section 508 accessibility conformance for ICT deliverables (29 U.S.C. § 794d).

Why it matters, and the traps. Domestic-preference compliance is a supply chain obligation dressed up as a certification. The failure mode is a reseller who certifies TAA compliance based on a distributor's word, ships a Chinese-manufactured component, and finds itself on the wrong end of a qui tam complaint. Country-of-origin is a factual question you must be able to prove with documents.

Accuracy note: Buy American domestic-content percentages, TAA dollar thresholds, and the executive-order layer of federal contractor labor and equal-opportunity requirements have all changed materially in recent years — and the EO-based requirements have been subject to revocation and reinstatement across administrations. Do not rely on a remembered figure or a clause list from an old contract; pull the clauses from your solicitation and confirm the current rule.

Phase 13 — Cybersecurity requirements (DFARS/CMMC) and the flow-downs

  • [ ] Search Section I for DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting).
  • [ ] If 7012 applies, implement the NIST SP 800-171 controls, maintain a System Security Plan and Plan of Action & Milestones, and be ready to report a cyber incident to DoD within 72 hours.
  • [ ] Check for DFARS 252.204-7019 / -7020: a current NIST SP 800-171 self-assessment score posted in the Supplier Performance Risk System (SPRS) may be a condition of eligibility.
  • [ ] Check for CMMC requirements (DFARS 252.204-7021 and the CMMC program rule) and determine the level and whether a third-party assessment is required for your scope.
  • [ ] Flow down the applicable cyber clauses to subcontractors who will handle covered information — and verify they can actually comply.
  • [ ] Confirm cloud services meet FedRAMP requirements where the solicitation demands it.
  • [ ] Map where covered/controlled information will actually live in your environment, and shrink that footprint.
  • [ ] Do not certify a security score you have not actually assessed.

Why it matters, and the traps. Cyber certifications are FCA-bait. The Department of Justice's Civil Cyber-Fraud Initiative exists to prosecute contractors who certified cybersecurity compliance they did not have, and it has produced settlements. A self-assessment score entered in SPRS is a representation to the government. Treat it that way.

The commercial trap is the flow-down: a prime that owes 7012 obligations to the government owes them downhill, and a small subcontractor that cannot meet NIST 800-171 is a compliance liability, not a bargain. Cobalt Ridge's civilian buy did not carry DFARS clauses — but it did carry FedRAMP and privacy requirements for the data it would touch, which sent it to the same underlying disciplines described in Standing Up a Privacy Compliance Program: A Practical Checklist and Responding to a Data Breach: A Notification and Incident Response Checklist. If your proposed solution rests on proprietary methods, protect them on the way in — Standing Up a Trade Secret Protection Program: A Practical Checklist — and mark your proposal's restricted data legibly.

Accuracy note: CMMC's phase-in schedule and the contract clauses that implement it have been rolling out in stages, and a governmentwide FAR rule on controlled unclassified information has been in process. Verify the requirements that apply to your specific solicitation and its date.

Phase 14 — Assemble, proofread, and SUBMIT EARLY (late is late — the rule is unforgiving)

  • [ ] Run the compliance matrix one final time. Every "shall" has an owner and a page.
  • [ ] Verify page counts, fonts, margins, and file formats against Section L, literally.
  • [ ] Verify file names match the required convention. Portals reject on file names.
  • [ ] Verify file sizes against the portal's limit, and that no file is password-protected or encrypted in a way the agency cannot open.
  • [ ] Sign the SF 33 / SF 1449 / offer sheet and acknowledge every amendment.
  • [ ] Confirm the deadline's time zone and convert it to yours in writing.
  • [ ] Submit at least 24 hours early. Then submit the final version if anything changes.
  • [ ] Capture proof of receipt: portal confirmation, timestamps, screenshots, email receipts.
  • [ ] Have a fallback plan if the portal fails, and document the failure in real time.

Why it matters, and the traps. The late-proposal rule is the harshest rule in federal procurement, and it is not a bluff. Under FAR 15.208 (and FAR 52.212-1(f) for commercial acquisitions, and FAR 14.304 for sealed bidding), a proposal received after the exact time specified is late and generally will not be considered. The exceptions are narrow — principally where the proposal was under the government's control before the deadline, or where there is acceptable evidence of timely receipt at the government installation. "The portal was slow," "our internet went out," and "we hit send at 1:59" are not exceptions. GAO and the Court of Federal Claims have turned away compelling, sympathetic, minutes-late offerors with great regularity, and they place the risk of transmission squarely on the offeror.

Cobalt Ridge nearly learned this the expensive way. Its deadline was 2:00 p.m. Eastern; its proposal manager, in Ohio, had it in his head as 2:00 p.m. local — which it was, by luck. But the 380 MB technical volume with embedded video exceeded the portal's file limit, and the upload failed twice. The team split and re-uploaded the files at 1:47 p.m. The confirmation email landed at 1:56. Four minutes. A firm-fixed-price, five-year, $4.2 million recompete-caliber opportunity, and nine people's month of work, resting on four minutes and a file-size limit that was printed in Section L.

Submit early. There is no other advice.

Phase 15 — Award, debriefing, and preserving protest rights

  • [ ] Watch for the unsuccessful-offeror notice and note its date.
  • [ ] Request a debriefing in writing within 3 days of receiving notice of exclusion or award (FAR 15.505; FAR 15.506).
  • [ ] Prepare questions in advance; in DoD procurements, use the enhanced debriefing process to submit written questions and get written answers.
  • [ ] Take detailed notes; identify each weakness, significant weakness, and deficiency assigned to your proposal.
  • [ ] Ask for the evaluated price of the awardee and the rationale for the tradeoff — what the agency paid a premium for.
  • [ ] Assess protest grounds immediately: unstated evaluation criteria, unequal treatment, unreasonable evaluation, flawed tradeoff, disparate discussions.
  • [ ] Calendar the CICA automatic-stay deadline: a GAO protest filed within 10 days after contract award — or, where a debriefing is required and timely requested, within 5 days after the date offered for that debriefing, whichever is later — triggers a stay of performance (31 U.S.C. § 3553(d)). The stay window and the protest window are not the same window; compute both.
  • [ ] Calendar the GAO timeliness deadline: within 10 days after the basis of protest is known or should have been known (4 C.F.R. § 21.2(a)(2)).
  • [ ] Even if you do not protest, write the lessons down. The next solicitation is coming.

Why it matters, and the traps. The debriefing is the most undervalued asset in federal business development. It tells you exactly how the evaluators read you — which is worth more than the award you lost. It is also the clock that starts your protest rights.

Those clocks are short and they are jurisdictional in effect. GAO's timeliness rules are applied strictly, and the automatic-stay window is even tighter than the protest window: a protest filed on day 9 that misses the stay deadline may be timely but will not stop performance, which usually means it will not get you the contract even if you win. If a debriefing reveals a real problem, move immediately. See Filing a Bid Protest: A Practical Checklist.

And if you win: performance is its own body of law — inspection, changes, terminations, claims under the Contract Disputes Act (41 U.S.C. §§ 7101–7109). Turn to Government Contracts: A Comprehensive Guide to Federal Procurement before the first modification lands.

Common Mistakes to Avoid

  1. Letting the SAM registration lapse. It is annual, it is boring, and it will cost you an award.
  2. Certifying small-business status without running affiliation. Size is measured with affiliates, as of the date of the initial offer including price.
  3. Reading the statement of work and skipping Sections L and M. Section M is the answer key. Everything else is scenery.
  4. Writing to your marketing deck instead of the evaluation factors. Evaluators score a form. Fill in the form.
  5. Gold-plating an LPTA bid, or bare-complying a tradeoff bid. Both waste money; one wastes it invisibly.
  6. Sitting on a known solicitation defect. Blue & Gold waives it. Say something before the deadline or never.
  7. Ignoring CPARS. An uncontested Marginal rating is a self-inflicted wound that follows you for years.
  8. Buying in. Cost realism exists to catch you, and the penalty is a risk downgrade — or a contract you lose money on for five years.
  9. Signing Section K without checking the facts. Certifications are False Claims Act exposure. Escobar and SuperValu mean subjective belief and materiality are litigated, and a plausible after-the-fact reading will not save you.
  10. Certifying a Section 889 or NIST 800-171 status nobody actually verified. DOJ has a task force for exactly this.
  11. A handshake teaming agreement. An agreement to agree is an agreement to nothing.
  12. Letting the subcontractor do the primary and vital work on a set-aside. That is not a team; that is a size protest.
  13. Uploading at the deadline. Late is late. FAR 15.208. There is no equity exception for a slow portal.
  14. Skipping the debriefing. You paid for the loss; collect the information.

The Consolidated Bid Checklist

Eligibility

  • [ ] SAM registration active; UEI issued; annual renewal calendared
  • [ ] NAICS code and size standard identified; size computed with affiliates
  • [ ] Socioeconomic certifications current; no exclusions

Solicitation intake

  • [ ] Full solicitation + all attachments and amendments downloaded
  • [ ] Contract type and FAR part identified
  • [ ] Compliance matrix built; every "shall" owned
  • [ ] Sections L and M extracted; page limits, formats, portal, deadline (with time zone) recorded

Strategy

  • [ ] Best-value tradeoff vs. LPTA determined; strategy set accordingly
  • [ ] Bid/no-bid decided in writing; OCI and Procurement Integrity Act cleared
  • [ ] Questions submitted before cutoff; patent defects raised, not banked

Content

  • [ ] Technical volume outlined to Section M; discriminators quantified
  • [ ] Key personnel confirmed and committed
  • [ ] Past performance selected for recency/relevance; questionnaires chased; CPARS reviewed and rebutted
  • [ ] Red team scored the draft cold against Section M

Price

  • [ ] Basis of estimate defensible; every CLIN and option priced
  • [ ] Reasonableness, realism, and unbalanced-pricing screens run
  • [ ] Certified cost or pricing data requirement assessed
  • [ ] SCA/Davis-Bacon wage determinations applied

Compliance

  • [ ] Section K / 52.212-3 reps verified by someone with actual knowledge
  • [ ] Section 889 supply-chain check performed
  • [ ] Buy American / TAA origin analysis documented
  • [ ] Cyber clauses identified; SPRS score real; flow-downs executed
  • [ ] Teaming agreement definite; limitations on subcontracting satisfied; NDAs signed

Submission

  • [ ] Format, page count, file names, and file sizes verified against Section L
  • [ ] Offer sheet signed; every amendment acknowledged
  • [ ] Submitted 24+ hours early; proof of receipt captured

After

  • [ ] Debriefing requested within 3 days of notice
  • [ ] Protest grounds assessed; CICA stay and GAO timeliness deadlines calendared
  • [ ] Lessons learned recorded

Primary Authority

Regulations

  • Federal Acquisition Regulation, 48 C.F.R. Chapter 1 — in particular Part 12 (commercial products and services), Part 13 (simplified acquisition), Part 15 (contracting by negotiation), Part 19 (small business programs), Part 25 (foreign acquisition), and Part 52 (clauses)
  • FAR 15.204-1 (uniform contract format); FAR 15.204-5 (Sections L and M)
  • FAR 15.101, 15.101-1, 15.101-2 (best-value continuum; tradeoff; LPTA)
  • FAR 15.303, 15.305 (source selection; proposal evaluation; past performance and the neutral rating, FAR 15.305(a)(2)(iv))
  • FAR 15.208 (late proposals and modifications); FAR 52.212-1(f) (commercial); FAR 14.304 (sealed bidding)
  • FAR 15.404-1 (price reasonableness, cost realism, unbalanced pricing); FAR 15.403-4 (certified cost or pricing data)
  • FAR 15.505, 15.506 (pre-award and post-award debriefings)
  • FAR subpart 9.5 (organizational and consultant conflicts of interest); FAR 9.601 (contractor team arrangements)
  • FAR 4.1102 and FAR 52.204-7 (SAM registration); FAR 52.204-8 (annual representations and certifications); FAR 52.212-3 (commercial offeror reps and certs)
  • FAR 52.204-24, -25, -26 (covered telecommunications — Section 889)
  • FAR 19.702 and FAR 52.219-9 (small business subcontracting plans); FAR 52.219-14 (limitations on subcontracting)
  • SBA regulations: 13 C.F.R. § 121.103 (affiliation); § 121.201 (size standards table); § 125.6 (limitations on subcontracting); §§ 125.8–125.9 (mentor-protégé and joint ventures)
  • DFARS 252.204-7012 (safeguarding covered defense information and cyber incident reporting); DFARS 252.204-7019 / -7020 (NIST SP 800-171 assessment, SPRS); DFARS 252.204-7021 (CMMC)
  • GAO Bid Protest Regulations, 4 C.F.R. Part 21 (timeliness: § 21.2)

Statutes

Cases

Secondary sources

  • Cibinic, Nash & Yukins, Formation of Government Contracts (a standard treatise on the award process)
  • Nash & Cibinic, Administration of Government Contracts (post-award)
  • Corbin on Contracts and Williston on Contracts (teaming agreements and the agreement-to-agree problem, which is decided under state contract law)

A standing caution. SAM's requirements, SBA size standards, FAR dollar thresholds (micro-purchase, simplified acquisition, certified cost or pricing data, subcontracting-plan triggers), Buy American domestic-content percentages, the CMMC phase-in, and the executive-order layer of contractor labor requirements all change — some of them annually. Every dollar figure and every clause list in this document is illustrative. Pull the clauses from your solicitation and confirm the current rule at sam.gov, sba.gov, and acquisition.gov.

Related UpLaw Resources

Related Guides & Articles

Related Checklists

Related Toolkits

This checklist is general legal information from UpLaw (uplaw.us), not legal advice, and does not create an attorney-client relationship. Federal procurement rules, dollar thresholds, and clause requirements change frequently; verify current requirements and consult qualified counsel before submitting a proposal or making a certification.