Reference

GovCon Glossary

Plain-English definitions for every federal contracting acronym — because the language of GovCon shouldn't be a barrier to entry. 60+ terms, practitioner-defined.

PUBLISHED BY ZEROTH INDUSTRIES LLC · ZEROTH AI · JUNE 2026

AFWERX: The Air Force's innovation hub, based in Austin, TX. Connects commercial companies to Air Force requirements via SBIR/STTR awards and OTA (Other Transaction Authority) contracts — bypassing traditional FAR rules for faster technology adoption.
APEX Accelerator: Formerly PTAC — Procurement Technical Assistance CenterFree federal contracting advisory service, funded by DoD and state governments. Provides proposal reviews, SAM.gov registration help, and one-on-one coaching at no cost. One of the most underutilized resources available to small businesses.
ATO — Authority to Operate: A formal authorization from a federal agency's authorizing official approving an information system to process, store, or transmit government data at an acceptable risk level. Required before any federal agency can use a software product. FedRAMP is the standardized process for cloud-based ATOs.
BAA — Broad Agency Announcement: A federal solicitation method used for basic and applied research. Agencies post a BAA to find companies interested in a general topic area — less specific than an RFP. Common in DoD and NIH. Relevant to SBIR research-phase work.
BAA — Buy American Act: 41 U.S.C. 8301 — Context determines which BAA is meantFederal law requiring that products purchased by the federal government be manufactured in the United States. Combined with the Trade Agreements Act (TAA), it governs supply chain country-of-origin compliance on most federal product contracts.
BIC — Best-in-Class: A designation by OMB/GSA for contract vehicles considered the most efficient ways to buy a category of product or service. Agencies are encouraged (sometimes required) to use BIC vehicles over other options. VETS 2 GWAC is a Best-in-Class vehicle for IT services.
CAGE Code — Commercial and Government Entity Code: A 5-character alphanumeric identifier assigned by the Defense Logistics Agency (DLA) to every company doing business with the federal government. Required for SAM.gov registration. Zeroth Industries LLC CAGE: 21BA2.
CAS — Cost Accounting Standards: 48 CFR 9900A set of 19 accounting standards governing how a contractor measures, assigns, and allocates costs on federal contracts. Modified CAS coverage triggers when a single cost-reimbursable contract exceeds $2 million. Full CAS applies at $50M+ in covered awards per year. Fixed-price work generally does not trigger CAS.
CLIN — Contract Line Item Number: Individual line items within a federal contract, each corresponding to a specific deliverable, period of performance, or product/service. Your accounting system must be able to track costs by CLIN — this is what DCAA looks for in an audit.
CMMC — Cybersecurity Maturity Model Certification: DoD's cybersecurity framework for defense contractors. Three levels: Level 1 (15 basic controls, self-assessment), Level 2 (110 controls / NIST SP 800-171, third-party C3PAO assessment for sensitive programs), Level 3 (130+ controls, DIBCAC assessment). Mandatory on DoD contracts involving CUI. C3PAO assessment cost: $75K–$200K+.
CO — Contracting Officer: The government official with legal authority to award, modify, and administer federal contracts. Only a CO can commit the government to spending money. Never start work based on direction from anyone other than a CO or authorized COR — unauthorized commitments don't have to be paid.
COR — Contracting Officer's Representative: The government official who manages day-to-day technical aspects of your contract. They review deliverables, answer technical questions, and write your CPARS performance rating. Your working relationship with the COR determines whether you get an "Exceptional" or a "Satisfactory."
CPARS — Contractor Performance Assessment Reporting System: The federal government's official database of contractor performance ratings. After each significant contract, the CO/COR rates performance across five dimensions: Quality, Schedule, Cost Control, Business Relations, and Small Business Subcontracting. Ratings range from Exceptional to Unsatisfactory. Future contracting officers check CPARS before awarding. Past performance is one of the most heavily weighted evaluation factors in competitive proposals.
C3PAO — CMMC Third-Party Assessment Organization: A company officially authorized by the Cyber AB to conduct CMMC Level 2 and Level 3 assessments. Independent from CMMC Registered Practitioners (advisors). A C3PAO must be accredited to issue an official CMMC Level 2 certification.
CUI — Controlled Unclassified Information: Government information that isn't classified but has specific handling, safeguarding, and dissemination requirements. Includes PII, law enforcement data, export-controlled technical data, and sensitive defense information. Handling CUI on a DoD contract triggers DFARS 252.204-7012 and eventually CMMC Level 2 requirements.
DAU — Defense Acquisition University: The DoD's acquisition training institution. Provides coursework in contracting, program management, logistics, and systems engineering for acquisition professionals. Relevant: the DAWIA Level I/II/III framework was overhauled by DoD in 2022. Legacy certifications are not retrievable through current DAU systems; reference as "completed DAU acquisition coursework" rather than specific DAWIA level certifications.
DCAA — Defense Contract Audit Agency: The DoD agency responsible for auditing contractor accounting systems, billing rates, indirect cost pools, and labor charges. DCAA does not approve accounting systems — they issue a formal "adequacy" finding. DCAA adequacy is typically required for cost-reimbursable work. For fixed-price supply-chain work, DCAA audits are less common but can still occur.
DFARS — Defense Federal Acquisition Regulation Supplement: The supplement to the FAR that applies specifically to DoD contracts. The DoD's rulebook layered on top of the government-wide FAR. Key DFARS clauses: 252.204-7012 (cyber incident reporting), 252.232-7003 (WAWF invoicing), 252.225-7048 (export-controlled items).
DIB — Defense Industrial Base: The network of commercial companies, contractors, subcontractors, and suppliers that support DoD's national defense missions. You're in the DIB the moment you have a DoD contract.
DIU — Defense Innovation Unit: A DoD unit based in Silicon Valley that accelerates adoption of commercial technology using Other Transaction Authority (OTA) contracts. Moves significantly faster than traditional DoD procurement. A primary gateway for commercial tech companies entering the defense market.
DSBS — Dynamic Small Business Search: The public SBA database where federal agencies search for small business vendors. COs and prime contractors use it to find potential subs and identify SDVOSBs in specific NAICS categories. Complete every field in your DSBS profile — it is a free visibility tool that COs actually use.
DSCSA — Drug Supply Chain Security Act: The 2013 law requiring electronic traceability of prescription drugs through the supply chain, implemented through 2023. Requires serialization (unique product identifiers), track-and-trace, and verification throughout the pharmaceutical distribution chain. A core competency for NAICS 424210 federal pharmaceutical supply.
EIN — Employer Identification Number: The IRS tax identification number for a business entity. Required for federal contracting registration. Zeroth Industries LLC EIN: 42-2782705.
FAR — Federal Acquisition Regulation: 48 CFR Chapters 1–53 · acquisition.gov/farThe primary set of rules governing the federal government's acquisition process. Every federal agency must follow the FAR. It covers solicitation, award, contract administration, and closeout. Understanding the FAR is not optional for federal contractors — it governs every obligation you have and every right you hold.
FCI — Federal Contract Information: Information provided by or generated for the government under a contract that isn't intended for public release. A step below CUI in sensitivity. Handling FCI triggers CMMC Level 1 requirements (15 basic cybersecurity controls, annual self-assessment).
FedRAMP — Federal Risk and Authorization Management Program: The government-wide authorization program for cloud service providers (SaaS, PaaS, IaaS) selling to federal agencies. If you're selling cloud software that federal agencies will use, you need FedRAMP authorization. Three impact levels: Low, Moderate, High. Cost of FedRAMP Moderate: $1–3M+, 12–18 months.
GFE / GFI — Government-Furnished Equipment / Information: Property or information that the government provides to you for use in performing your contract. You are accountable for GFE from receipt until return. Lost or damaged GFE can make your company financially liable. Treat GFE as a liability, not an asset.
GWAC — Government-Wide Acquisition Contract: A multi-agency IDIQ contract that any federal agency can use to buy specific categories of products or services. Require a competitive on-ramp process. Once on a GWAC, you compete only against other on-vehicle contractors for task orders. Key SDVOSB-relevant GWAC: VETS 2 (IT services, SDVOSB-exclusive, $6.1B ceiling).
HUBZone — Historically Underutilized Business Zone: SBA certification for businesses located in economically distressed areas. Similar set-aside benefits to SDVOSB, plus a 10% price evaluation preference on full-and-open competitions. Not relevant to Zeroth's current structure but valuable for teaming partners.
IDIQ — Indefinite Delivery / Indefinite Quantity: A contract type with a ceiling value and individual task orders issued against it over the period of performance. You compete once to get on the vehicle; then compete (often with a reduced set) for task orders. Almost all large federal contract vehicles (GWACs, agency IDIQs) are structured as IDIQs.
ITAR — International Traffic in Arms Regulations: U.S. export control law governing export of defense articles, services, and related technical data on the United States Munitions List (USML). Foreign nationals generally cannot access ITAR-controlled technical data without a State Department export license. A DSP-5 license authorizes a specific foreign national's access to specific ITAR-controlled data — employer-specific, 4-year validity.
NAICS — North American Industry Classification System: A system of codes classifying businesses by their primary activity. Federal contracts are coded by NAICS, and SDVOSB set-aside awards are targeted at companies in specific NAICS categories. Your SAM.gov registration should list all NAICS codes that accurately describe your capabilities. Zeroth primary NAICS: 424210 (pharmaceutical/drugs merchant wholesalers).
NIST SP 800-171: National Institute of Standards and Technology Special Publication 800-171The 110-control cybersecurity standard that forms the backbone of CMMC Level 2. Any contractor handling CUI on a DoD contract must implement these 110 controls and upload a self-assessment score to SPRS. Achieving 110/110 typically costs $50K–$500K depending on organization size and starting posture.
OCI — Organizational Conflict of Interest: A situation where a contractor's performance of one contract creates an unfair competitive advantage or impaired objectivity on another contract. Common scenario: you helped the government write the statement of work, then bid on the resulting contract. Know your OCI exposure before engaging in pre-solicitation market research.
ODC — Other Direct Cost: Any direct cost on a contract that is not labor — travel, materials, subcontractor costs, equipment. Tracked separately from labor and typically require advance CO authorization above specified thresholds.
OSDBU — Office of Small and Disadvantaged Business Utilization: Every federal agency has one. Their job is to facilitate small business participation in agency contracting. They host industry days, facilitate capability briefings, and connect small businesses with program offices. Scheduling a meeting with the OSDBU at your top 3 target agencies is one of the highest-ROI BD activities available to a new SDVOSB.
OTA — Other Transaction Authority: A procurement mechanism allowing DoD and certain other agencies to award prototype and production contracts without following standard FAR rules. Used by DIU, AFWERX, NavalX, SOFWERX, and DARPA. OTAs cannot be protested under standard GAO bid protest procedures — a significant advantage for winning companies.
PSC — Product Service Code: A 4-character code further classifying what a contract is buying, more specific than NAICS. Used in federal spending data and SAM.gov. For pharmaceutical products: PSC 6505 (drugs and biologicals), 6510 (medical instruments and laboratory equipment).
RFI — Request for Information: A government notice seeking market information before a formal solicitation. Not a contract award — a market research tool. Responding to an RFI positions your company in the CO's file before the solicitation is written.
RFP — Request for Proposals: The formal solicitation document used when the government wants competitive proposals evaluated on technical merit, past performance, and price. The most common solicitation for services and complex acquisitions.
SAM.gov — System for Award Management: The federal government's central contractor registration database. Every entity doing business with the federal government must be registered in SAM.gov and renew annually. If your registration lapses, you cannot be paid on existing contracts and cannot receive new awards. Treat annual renewal as a hard deadline. Zeroth UEI: DUEYRRJF56N6 (active through June 2027).
SBA — Small Business Administration: The federal agency responsible for small business development, loan programs, and certification of small business socioeconomic status (SDVOSB, 8(a), HUBZone, WOSB). Administers VetCert (SDVOSB certification) and the Mentor-Protégé program.
SBIR — Small Business Innovation Research: Federal program where 11 agencies (DoD, NIH, NASA, and others) set aside a percentage of their R&D budgets for small businesses. Three phases: Phase I (~$275K, proof of concept), Phase II (~$1.83M, full R&D), Phase III (commercialization via sole-source). Non-dilutive — no equity given up. DoD SBIR is the largest, at ~$2.6B/year. See our full SBIR and STTR guide →
SCA — Service Contract Act: 41 U.S.C. 6701Federal law requiring contractors on federal service contracts over $2,500 to pay workers the prevailing wages and fringe benefits established in Department of Labor Wage Determinations for the locality where work is performed. SCA applies to service employees (guards, janitors, food service, IT support) — not to managers or professionals.
SDVOSB — Service-Disabled Veteran-Owned Small Business: A small business owned and controlled by a service-disabled veteran (a veteran with a service-connected disability rating from the VA). SDVOSBs are eligible for set-aside contracts, sole-source awards up to $5M (services) / $8.5M (manufacturing), and priority treatment at the VA. Certification is through SBA VetCert (13 CFR Part 128).
SOFWERX: SOCOM's (Special Operations Command) innovation hub, based in Tampa, FL. Connects commercial companies to SOCOM requirements via OTAs, SBIR, and direct market engagements.
Sources Sought: A notice posted by a federal agency to conduct market research before writing a solicitation. Agencies ask: "Does anyone out there make/do this? Are you a small business? Are you an SDVOSB?" Responding puts your name in front of the CO 90–180 days before the formal solicitation drops. One of the highest-ROI free actions available to a new GovCon firm.
SPRS — Supplier Performance Risk System: DoD's portal where contractors must upload their NIST SP 800-171 self-assessment score before being eligible for DoD contracts involving CUI. The maximum score is 110 points. Required to receive a DoD contract with DFARS 252.204-7012.
SSP — System Security Plan: A document required by NIST SP 800-171 and CMMC that describes your information system, how it processes CUI, and how each of the 110 NIST controls is implemented. Also defines your Assessment Boundary — which systems are in scope for CMMC. Systems that don't store, process, or transmit CUI are outside the boundary.
STTR — Small Business Technology Transfer: Structured like SBIR but requires a formal research partnership with a university, FFRDC, or national laboratory (minimum 30% of work to the research institution). Five agencies participate: DoD, NIH, NSF, DOE, NASA. Non-dilutive. Ideal when you have a university research relationship to leverage.
T&M — Time and Materials: A contract type where the government pays for actual hours of labor at specified rates plus actual material costs. Neither party knows exactly how much work will be required. T&M requires DCAA-adequate timekeeping and cost accounting. Considered the riskiest contract type by the government — requires a determination that no other contract type is suitable.
TAA — Trade Agreements Act: 19 U.S.C. 2501The law requiring that products purchased under certain federal contracts originate from the U.S. or a TAA-designated country. NOT TAA-compliant: China, India, Russia, most of Southeast and South Asia. Supply chain country-of-origin vetting is a hard requirement on most product contracts.
UEI — Unique Entity Identifier: The 12-character alphanumeric identifier assigned by SAM.gov to every entity registered to do business with the federal government. Replaced the legacy DUNS number in 2022. Required on every federal proposal, contract, invoice, and SAM.gov record. Zeroth Industries LLC UEI: DUEYRRJF56N6.
VetCert: SBA's official SDVOSB and VOSB certification program (vetcert.sba.gov). Replaced VA self-certification. Apply through SBA; processing time approximately 12 days (as of 2025). Certification valid 3 years. Required for SDVOSB set-aside eligibility. Self-certification no longer qualifies firms for set-asides as of December 2024.
VETS 2 GWAC: Government-Wide Acquisition Contract set aside exclusively for SDVOSBs. $6.1B ceiling. Best-in-Class designation. Primary NAICS 541512 (IT systems design). Allows fixed-price, cost-reimbursable, T&M, and labor-hour orders. Five-year base + five-year option. Track the next VETS 3 on-ramp (expected 2028–2029).
WAWF — Wide Area Workflow: DoD's electronic invoicing and acceptance portal. You submit invoices through WAWF; the COR accepts deliverables through WAWF; the government's payment office pays through WAWF. Required for DoD contracts. Set up your vendor account before you win your first DoD contract — setup takes time.
WOSB / EDWOSB — Women-Owned Small Business / Economically Disadvantaged WOSB: SBA certifications for businesses owned and controlled by women, eligible for set-aside contracts in industries where women are underrepresented. Valuable teaming partner category for SDVOSB firms building diverse teaming arrangements.

← Operating Notes Zeroth AI →