Small Business Start Point — SBA, SBIR/STTR, DSIP & Army xTech

Before you begin

Why this matters

SAM.gov was the first door — not the last one. An active registration makes your company identifiable and awardable. It does not, by itself, confirm you are small for every opportunity, register you for SBIR/STTR, create your DSIP firm profile, certify you as 8(a)/HUBZone/WOSB/SDVOSB, submit you to Army xTech, or make your accounting and cybersecurity ready.

For Defense SBIR/STTR work, a company normally moves through three additional systems: SBIR.gov Company Registry (mandatory), DSIP (mandatory for full Defense proposals), and — for certain Army competitions — Army xTech and Valid Eval for the first round.

The complete starting path

1. 1
   Active SAM.gov registration

   UEI + CAGE code in place — the foundation from the prerequisite module.

2. 2
   Verify small-business and SBIR/STTR eligibility

   Size under applicable rules, plus the SBIR 500-employee / ownership / U.S. work tests.

3. 3
   Register on SBIR.gov

   Receive the SBC Control ID and downloadable registration proof; refresh at least every six months.

4. 4
   Optional certifications + Small Business Search

   Evaluate MySBA programs only when they fit strategy; build a discoverable SBS profile.

5. 5
   Set up DSIP

   Login.gov accounts, firm record matching SAM, Firm PIN, roles, and firm-level forms.

6. 6
   Find and read a Defense topic

   Program BAA/CSO, component instructions, topic, amendments, and Q&A — in that hierarchy.

7. 7
   Build and submit all DSIP volumes

   Corporate Official certifies. Then selection, foreign-risk review, negotiation, and possible award.

What “small” means — and the SBIR test

For ordinary federal contracts, whether you are small depends on the solicitation’s NAICS code and the matching SBA size standard (average receipts, employees, and affiliates). You can be small under one NAICS and not another. Control can create affiliation even below 50% ownership.

SBIR/STTR uses a special eligibility test. A typical eligible firm is organized for profit, has a U.S. place of business, has no more than 500 employees including affiliates, meets U.S. ownership and control rules, performs the required R&D in the United States, and meets principal investigator and workshare rules. Venture-backed and institutionally funded companies need extra care — never assume a cap table is automatically eligible.

• Exact legal name, DBA, physical address, UEI, CAGE, EIN
• State and date of formation; ownership percentages; current capitalization table
• Board members, control rights, parents, and affiliates
• Employee count including affiliates; primary and secondary NAICS
• Principal investigator and government / company points of contact

Four SBA-related functions — do not conflate them

Register in the SBIR.gov Company Registry

All SBIR and STTR applicants must register the company through SBIR.gov before submitting. A completed registration produces a unique SBC Control ID, a downloadable proof-of-registration document, and a company record used across participating agencies. This is separate from SAM.gov and from MySBA Certifications. Keep the proof current — update at least every six months.

1. 1
   Create or sign in to your SBIR.gov account

   Use an individual company-controlled email. Do not leave a former employee or consultant as the only administrator.

2. 2
   Register or claim the company

   Search before creating a duplicate. Match the legal identity shown in SAM.gov.

3. 3
   Complete the company profile

   Ownership, affiliates, institutional ownership, administrator, and contacts — accuracy matters.

4. 4
   Obtain the SBC Control ID

   Save it in the permanent registration record; you will associate it with proposals.

5. 5
   Download proof and set a renewal reminder

   Refresh whenever ownership, address, administrator, or affiliation changes — and at least every six months.

Optional MySBA certifications & Small Business Search

Socioeconomic certifications (8(a), HUBZone, WOSB/EDWOSB, VetCert VOSB/SDVOSB) can open set-aside and sole-source paths. They do not replace SBIR/STTR eligibility and are not generally required to submit a DSIP proposal. MySBA Certifications is the current central portal.

Small Business Search (formerly Dynamic Small Business Search) helps agencies and primes find you. Complete capability narrative, keywords, NAICS, geography, past performance, certifications, and contacts. Not required for DSIP — useful for market research and teaming.

SBIR vs STTR

Phases I, II, D2P2, and III

BAA vs CSO

SBIR/STTR is the program; BAA or CSO is the announcement method. Every opportunity can carry separate labels: program, phase, announcement type, component, and submission route (direct DSIP or xTech then DSIP).

Instruction hierarchy & the TPOC rule

A DSIP topic page is not the complete solicitation. Read layers in order: program-wide BAA/CSO → component instructions → topic and attachments → amendments → Topic Q&A → DSIP fields. Component instructions often supplement the program document and take precedence where they expressly conflict. Army instructions also require the DSIP firm profile to match SAM.gov.

DSIP setup — Login.gov, Firm Admin, PIN, roles

Defense requires SBIR/STTR proposals to be submitted electronically through DSIP. Users authenticate through Login.gov. Final submission requires firm forms, proposal volumes, and corporate certification.

1. 1
   Create an individual Login.gov account

   Account sharing is prohibited. Avoid group mailboxes for individual identities.

2. 2
   Enter DSIP through its Login.gov flow

   Start from DSIP — do not expect Login.gov alone to find your firm workspace.

3. 3
   Find, create, or claim the firm record

   Match SAM.gov legal name, DBA, UEI, CAGE, and physical address. Avoid duplicates.

4. 4
   Identify Firm Admin and protect the Firm PIN

   The company — not an outside consultant — should retain permanent control of Firm Admin and the PIN.

5. 5
   Assign roles and complete firm forms early

   Proposal Owner creates proposals; Corporate Official certifies and submits. Complete SBIR.gov info, CCR, certifications, foreign affiliation, and FWA training before crunch time.

Topic lifecycle

1. 1
   Prerelease

   Topics become visible; dates and instructions publish; start compliance work; TPOC contact generally permitted for clarification.

2. 2
   Open

   DSIP accepts proposals; direct TPOC contact ends; technical questions go to DSIP Topic Q&A; monitor amendments.

3. 3
   Q&A cutoff

   Technical-question deadline may be before proposal close — often about two weeks prior, but the active BAA/CSO controls.

4. 4
   Close

   No late proposals for account problems. “In Progress” or “Ready to Certify” is not submitted. Reopened proposals must be certified and submitted again.

The seven DSIP proposal volumes

• Volume 1 — Proposal Cover Sheet (topic, title, firm, PI, abstract, cost, representations)
• Volume 2 — Technical Volume (approach, work plan, risks, team, transition — page limits vary)
• Volume 3 — Cost Volume (labor, indirects, materials, travel, subs, TABA, base/options)
• Volume 4 — Company Commercialization Report (historical CCR from SBIR.gov when required)
• Volume 5 — Supporting Documents (only what instructions require or permit)
• Volume 6 — Fraud, Waste, and Abuse Training (generally annual)
• Volume 7 — Foreign Affiliations and Relationships (current DSIP webform — not an obsolete PDF)

Foreign Risk Evaluation (FRE)

Following the 2026 reauthorization, Defense redesignated its SBIR/STTR due-diligence work as the Foreign Risk Evaluation (FRE) Program. It addresses foreign ownership, control, influence, affiliations, personnel, and technology transfer risks. Older training may still say “due diligence.”

Conditional requirements

These are not universal prerequisites for every SBIR proposal. Read the topic: STTR IP allocation agreements; export control / DD Form 2345 / JCP when controlled military technical data apply; cybersecurity (FCI/CUI, NIST SP 800-171, SPRS, CMMC) when clauses require them; human/animal subjects review; TABA vendor rules; organizational conflicts and duplicate funding; IP and data-rights assertions for background and developed technology.

Army xTech → Valid Eval → gated DSIP

Proposal-ready library & accounting readiness

Build a reusable secure folder for registrations, corporate docs, ownership/affiliates, SBIR.gov, DSIP firm forms, key personnel, past performance, commercialization, cost/accounting, partners, IP, foreign risk, cyber, export, and templates — before a topic opens.

You do not need a universal “DCAA certification” to create a DSIP account. You should still explain and support direct/indirect labor, fringe, overhead, G&A, materials, travel, subcontracts, unallowables, timekeeping, and project-level cost collection. Selected firms may face SF 1408 accounting-system information and detailed cost justification.

• Written timekeeping; employees record time by project
• Direct vs indirect separation and job-cost tracking
• Documented indirect allocation and unallowable segregation
• Receipt retention, ledger reconciliation, approval controls
• A named person responsible for government-contract accounting

Submit checklist & after selection

• SAM active; UEI/CAGE correct; DSIP firm matches SAM; SBIR.gov proof and SBC Control ID current
• Eligibility: ≤500 employees with affiliates; PI and workshare compliant; U.S. performance
• All instruction layers read; correct templates; page/cost/duration rules checked
• All seven volumes complete; costs agree; foreign disclosures and FWA done
• Status is Submitted (not merely Ready to Certify); confirmation archived; no post-submit firm edits that reopen proposals

Selection is not yet an award. Expect eligibility verification, FRE, responsibility and cost analysis, possible accounting review, negotiation, IP/security/export review, and funding confirmation. Do not begin reimbursable work until an authorized contracting official issues the award. Performance is controlled by the contract — not the original topic page.

Common mistakes

• Believing SAM.gov automatically registered you for SBIR
• Treating 8(a)/WOSB/HUBZone/SDVOSB as an SBIR requirement
• Ignoring affiliate employees under the 500-employee limit
• Duplicate SBIR.gov or DSIP firm records; DSIP profile that does not match SAM
• Skipping component instructions; assuming DSIP validation equals compliance
• Contacting the TPOC after the open period; confusing CCR with commercialization strategy
• Leaving proposals Ready to Certify; forgetting to resubmit after a reopen
• Assuming xTech white papers go through DSIP or that a prize guarantees an SBIR award
• Claiming CMMC/export/accounting readiness you cannot document; proposing IP you do not control

You are proposal-ready

You are ready to pursue a first Defense SBIR/STTR topic when SAM, eligibility, SBIR.gov (SBC Control ID + current proof), DSIP firm setup and roles, basic accounting, IP awareness, foreign-risk records, commercialization strategy, templates, and a documented submission process are all in place.