The US federal government spent $759 billion on contracts in fiscal year 2023. Almost none of it went directly to foreign companies. That is not a wall — it is a routing problem. The money flows through US prime contractors, and several of the largest primes have significant operations in Singapore and subcontract to Singapore-based technology companies regularly.
This guide covers the realistic entry path for Singapore cybersecurity, AI, and data analytics companies targeting US defence and intelligence work.
Which US primes have Singapore presence
Start with the companies already operating in your market:
Leidos maintains a Singapore office focused on defence, intelligence, and health IT. The company holds major US federal contracts in cybersecurity and data analytics. Leidos has an established vendor registration process and a small business subcontracting programme required by its federal prime contracts.
SAIC (Science Applications International Corporation) operates in Singapore and holds billions in annual US federal IT and defence contracts. SAIC's contracts with the US Department of Defense typically include subcontracting plans that require a percentage of work be awarded to small businesses.
CACI International has Singapore-region operations and specialises in intelligence, surveillance, and IT services for US federal clients. CACI is a frequent prime on classified and unclassified US government contracts.
DXC Technology and IBM both run substantial Singapore operations with US federal practices. Both regularly subcontract technology work, particularly in cloud migration, data management, and cybersecurity.
None of these relationships happen by submitting a cold contact form. They happen through direct business development — finding the programme manager or supply chain lead at the Singapore office, demonstrating specific technical capability, and registering as a potential subcontractor before a bid is won, not after.
The standard structure: US LLC first
US prime contractors cannot easily subcontract to purely foreign entities on US government work. The standard structure is:
- Form a US LLC (Delaware is common; Texas and Virginia are practical for defence work given the contractor concentration near Washington and the military bases in San Antonio).
- Register the LLC in SAM.gov — the System for Award Management, which is the federal vendor database. This takes 7–10 business days and is free.
- Select NAICS codes that match your work. For cybersecurity: 541512 (Computer Systems Design Services), 541519 (Other Computer Related Services). For AI and analytics: 541511 (Custom Computer Programming Services), 541714 (Research and Development in Biotechnology is wrong — use 541715 for other R&D in physical/engineering/life sciences, or 518210 for data processing).
- Obtain a DUNS/UEI number (now the Unique Entity Identifier in SAM.gov).
The LLC does not need to be staffed with US citizens for unclassified subcontract work. A Singapore founder can own the LLC. The work can be performed in Singapore under a subcontract from the US prime. The contract flows: US government → US prime → your US LLC → actual delivery in Singapore.
This structure works cleanly for unclassified work in cybersecurity software, AI model development, data analytics, and software integration. It does not work for work requiring US security clearances (see below).
How subcontracting plans create your opening
Every US federal contract over $750,000 in services requires the prime contractor to submit a small business subcontracting plan to the contracting officer. The plan commits the prime to specific dollar percentages for:
- Small businesses (the base category; a US LLC with under $27.5 million in average annual receipts for IT services qualifies)
- Woman-owned small businesses
- Veteran-owned small businesses
- HUBZone businesses
- Small disadvantaged businesses (includes 8(a) certified companies)
A Singapore founder's US LLC almost certainly qualifies as a small business by revenue. If the founder is a woman, veteran, or member of a disadvantaged group who holds US permanent residency or citizenship, additional set-aside categories may apply.
Primes are measured against their subcontracting plan commitments. Missing the targets damages their relationship with contracting officers on renewal. This creates genuine demand for qualified small business subcontractors — especially ones with technical capabilities the prime's existing roster does not cover.
AUKUS and what it actually means for Singapore
AUKUS is the 2021 trilateral security agreement between Australia, the United Kingdom, and the United States. Pillar II of AUKUS covers advanced capability sharing: AI, quantum, cyber, undersea autonomy, and electronic warfare. The technology-sharing provisions allow defence-industrial cooperation across the three AUKUS nations.
Singapore is not an AUKUS member. It is, however, a close US security partner with a long-standing bilateral defence relationship — the 1990 Memorandum of Understanding on US military access to Singapore facilities was renewed in 2019 for 15 years. Singapore companies can participate in AUKUS-adjacent supply chains through AUKUS-member primes operating in Singapore (particularly Australian primes such as ASC, CEA Technologies, and EOS Defence Systems, which are actively building supply chains).
The practical path: an Australian prime holding AUKUS work subcontracts to a Singapore company, and separately that Singapore company builds a US presence through one of the US primes above. AUKUS does not grant Singapore companies direct access to US defence procurement — but it expands the set of Australia-based primes who can work with Singapore suppliers and who may already have US federal contracts.
Security clearances: what is actually possible
US security clearances (Secret, Top Secret, TS/SCI) are granted to individuals, not companies. They require US citizenship for most cleared positions, though permanent residents can obtain clearances in some circumstances with a waiver.
For Singapore-founded companies targeting US federal work, the clearance picture breaks down as follows:
Unclassified work: No clearance required. This is the bulk of US federal IT spending — software development, data analytics, cloud migration, cybersecurity tool deployment, systems integration. Singapore companies can perform this work through their US LLC without any cleared personnel.
Facilities Clearance (FCL): Required for a company to access classified information or perform on classified contracts. An FCL requires the company to have a Key Management Personnel (KMP) structure with US citizen employees in certain roles. A Singapore-founded company can obtain an FCL if it hires US citizen executives and complies with the National Industrial Security Program (NISP) requirements. This is not quick — FCL processing typically takes 6–18 months.
Practical near-term path: Focus on unclassified subcontracts first. Build a revenue track record. Hire a US-based programme manager or business development person with existing relationships at the primes. Pursue FCL only once you have unclassified past performance and a specific classified opportunity that justifies the investment.
SBIR and STTR: the research funding angle
The Small Business Innovation Research (SBIR) and Small Business Technology Transfer (STTR) programmes together allocate roughly $4 billion annually to US small businesses for federal R&D. Agencies including DARPA, the Air Force Research Laboratory, the Navy, and DHS are active SBIR funders in cybersecurity and AI.
The requirement: the applicant must be a US-based small business. The principal investigator must be primarily employed by the applicant company at time of award.
A Singapore founder who holds US permanent residency or citizenship, and who is willing to spend meaningful time in the US, can structure a US LLC to qualify for SBIR. The work can be performed partly in Singapore under a subcontract from the US LLC to a Singapore affiliate, subject to the "performance of work" requirement (typically at least 40% of the work must be performed by the US LLC itself for Phase I).
SBIR Phase I awards are typically $150,000–$250,000. Phase II awards run $750,000–$2 million. For early-stage Singapore cybersecurity and AI companies, SBIR is a credible path to both US federal past performance and non-dilutive capital — but it requires genuine US operational presence, not just a registered LLC.
Building past performance from zero
Past performance is the central problem for any company new to US federal contracting. Agencies and primes weight it heavily. Three ways to build it:
Subcontract under a prime. A completed subcontract deliverable, documented in a subcontractor performance report, counts as past performance for future bids. Even a $50,000 subcontract in a relevant domain is worth doing.
Partner with a US small business with existing past performance. Teaming agreements allow two companies to bid together, with one providing technical capability and the other contributing past performance credentials. Several US defence-focused small businesses actively seek technical partners.
GSA Schedule. The General Services Administration Multiple Award Schedule is a long-term contract vehicle that qualifies companies to sell to federal agencies without a separate competitive bid for each order. Getting onto a GSA Schedule (particularly IT Schedule 70 / Schedule 8(a) for IT) takes 6–12 months and requires demonstrating commercial sales history, but it provides a credible federal contracting vehicle that primes recognise.
The realistic timeline
Months 1–3: Form US LLC, register in SAM.gov, select NAICS codes, identify the three to five US primes with Singapore operations most relevant to your technology area, make direct contact with their Singapore-based supply chain or business development leads.
Months 4–9: Register in at least two prime contractor supplier portals (Leidos, SAIC, CACI, and others all have formal supplier registration systems). Pursue one concrete subcontract teaming arrangement or SBIR Phase I submission if the team has US residency/citizenship.
Year 2: Deliver on the first subcontract. Document deliverables precisely for past performance files. Begin the FCL assessment if a classified opportunity is visible.
The companies that get stuck treat this as a paperwork exercise. The ones that progress treat it as business development: building direct relationships at the prime contractor level in Singapore, demonstrating technical differentiation in a specific domain (not "AI" broadly — narrower is better, such as "multi-source geospatial fusion" or "zero-trust network segmentation for OT environments"), and being ready to perform when a prime needs to fill its subcontracting plan.
The market is large. The entry path is defined. The constraint is execution.
