Defense Information Systems Agency (DISA) runs the communications and IT infrastructure backbone of the U.S. Department of Defense. That means secure networks, cloud services, cybersecurity operations, and command-and-control systems for every branch of the military. The agency spends roughly $14 billion annually, nearly all of it on technology. For a small business with IT credentials, this is one of the largest single concentrations of federal tech spending you can access.
This guide walks you through what DISA buys, how to get into its vendor pool, and what actually moves a small business from "registered" to "awarded."
What DISA buys
DISA is not a generalist agency. Its mission is narrowly focused on information technology and communications for the DoD, which shapes every contract it awards. The dominant spend categories are:
IT and cybersecurity services. The agency runs the Defense Information Network (DoDIN), which means ongoing contracts for network operations, endpoint security, vulnerability assessments, and zero-trust architecture implementation. NAICS 541519 (Other Computer Related Services) and 541512 (Computer Systems Design Services) cover most of this work.
Cloud and infrastructure. DISA manages milCloud 2.0, the DoD's cloud environment. Contracts here touch cloud migration, DevSecOps, platform engineering, and infrastructure-as-code. Expect task orders ranging from $500K to $50M for sustained infrastructure work.
Telecommunications. The agency operates and acquires satellite communications, long-haul fiber, and tactical radio systems. NAICS 517210 (Wireless Telecommunications Carriers) applies to a subset of this work, though many contracts blend IT and telecom into a single requirement.
Program support and systems integration. Large programs like the Joint Regional Security Stacks (JRSS) and Thunderdome (DISA's zero-trust pilot) pull in systems integrators and specialist subcontractors. This is where small businesses often enter as second-tier performers.
Typical contract sizes vary widely. Smaller task orders under the agency's IDIQ vehicles can run $250K to $2M. Prime contracts for major programs can reach nine figures. If you are a small business entering the ecosystem, expect your first opportunities to be task orders under existing vehicles, not standalone procurements.
Registrations you need before anything else
Before DISA or any federal agency can pay you, your business needs three things current: a Unique Entity Identifier (UEI) in SAM.gov, an active SAM.gov registration, and a CAGE code (automatically assigned through SAM). None of these cost money. SAM registration must be renewed annually.
Your SAM.gov profile is also your public-facing credential. Include your NAICS codes, socioeconomic certifications (8(a), WOSB, HUBZone, SDVOSB, or any others you hold), and a complete capabilities narrative. Contracting officers review SAM profiles during market research. A thin profile is a missed opportunity.
If your business holds or intends to pursue a security clearance at the facility level, start that process early. Much of DISA's sensitive work requires cleared personnel and a cleared facility. The clearance process runs through the Defense Counterintelligence and Security Agency (DCSA) and can take 12 to 18 months for a facility clearance at the Secret level.
DISA's small business office
DISA has a dedicated Office of Small Business Programs (OSBP) that sits inside the agency's acquisition structure. The office is responsible for setting small business goals, monitoring prime contractor subcontracting plans, and connecting small businesses with DISA program offices during market research phases.
You can reach the DISA small business office through the agency's official website at disa.mil. The office posts its contact information, current small business liaison staff, and event schedules there. Do not cold-call the contracting officer on a solicitation; go through the small business office first.
The office also participates in DoD-wide small business events including the annual DISA Small Business Industry Day, which typically draws hundreds of vendors and includes one-on-one matchmaking sessions. Attending at least one of these events before you submit a proposal gives you insight into acquisition priorities that you cannot get from reading solicitations alone.
Set-aside and diversity opportunities
DISA meets statutory small business goals across all the SBA-defined categories: small business, 8(a), women-owned small business (WOSB), economically disadvantaged WOSB (EDWOSB), HUBZone, and service-disabled veteran-owned small business (SDVOSB). The agency reports its utilization annually to the SBA.
Several DISA IDIQ contracts carry small business set-aside provisions or have small business components built into their structure. Seaport NxG, a Navy vehicle that DISA also uses for certain IT requirements, has small business on-ramps. DISA's own Encore III vehicle, an IT services IDIQ with a $17.5 billion ceiling, includes a small business pool. Getting onto Encore III as a prime requires bidding on an open on-ramp; subcontracting under a current Encore III prime is a faster path for a newer entrant.
If you hold an 8(a) certification, DISA can sole-source contracts below $4.5 million (services) directly to your firm through the SBA's 8(a) program. This bypasses full competition and is one of the fastest routes to a first federal IT contract. Your SBA Business Development Officer brokers these deals; contact your local SBA district office to initiate one.
HUBZone firms have a pricing preference (a 10% price evaluation adjustment) in full-and-open competitions. If your business is in a qualified underutilized area, HUBZone certification directly improves your competitiveness on DISA bids you would otherwise lose on price.
One practical tip for a first contract
Get onto an existing DISA IDIQ as a subcontractor before you pursue a prime award.
The agency issues most of its work as task orders against established vehicles. Primes who already hold a spot on Encore III, Seaport NxG, or GSA Schedules are looking for specialist subcontractors with security clearances, niche technical skills, or set-aside status that improves their teaming profile. A company with SDVOSB or 8(a) certification that also holds cleared personnel becomes attractive to a prime bidding a competitive task order.
Find the current prime contractors by searching DISA-awarded contracts on USASpending.gov. Look for primes with active Encore III or similar IDIQ task orders in your technical domain. Reach out to their small business or capture teams with a one-page capabilities statement that names your NAICS codes, certifications, clearance levels, and two or three specific past performance examples. Keep it to one page. Primes reviewing teaming requests spend about 90 seconds on them.
Once you have one subcontract with a DISA prime and solid performance documentation, you have the past performance narrative you need to bid as a prime on the next on-ramp or open solicitation.
How to find open opportunities
DISA posts all solicitations on SAM.gov under the DOD subtier agency filter. Set up a saved search with your NAICS codes and an alert for new solicitations. Check the DISA acquisition forecast, which the agency publishes on its website, for planned procurements in the current and next fiscal year. The forecast gives you 6 to 12 months of advance notice on requirements, enough time to build a teaming arrangement before a solicitation drops.
DISA also engages industry through Requests for Information (RFIs) before formal solicitations. Responding to RFIs shapes requirements and, more importantly, signals your existence to the program office at a point when you can still influence the acquisition structure.
The pipeline is large enough that there is always something in market. The businesses that win consistently are the ones that showed up before the solicitation opened.
