--- title: "How to Become a Defense Software Subcontractor" description: "How to become a government subcontractor for defense software work: registration, finding primes, CMMC, ITAR and what primes check before they hire you." url: https://axiointelligence.com/blog/defense_software_subcontracting --- [← Blog](https://axiointelligence.com/blog) defense, subcontracting, CMMC, San Antonio # How to become a software subcontractor for defense primes, from a San Antonio dev shop Brice Ayres / October 9, 2026 Short answer Most small software firms enter defense work as subcontractors, not prime contractors. The path is to register in SAM.gov, pick a narrow lane, get in front of primes and funded startups that need delivery help, and be ready for their security questions: CMMC Level 1 or Level 2 self-assessments are still required even though Phase 2 is paused, and export-controlled programs will limit who can work on them. Primes hire subcontractors who reduce their risk, not add to it. We get this question from other small software firms about once a month: how do you actually get defense software work? The honest answer is that almost nobody starts as a prime contractor. You start as a subcontractor, doing a well-defined piece of work for a prime or a funded defense startup that already has the contract. Here’s how that works, from our seat in San Antonio. ## Prime or subcontractor? A **prime contractor** holds the contract with the government. A **subcontractor** works for the prime. For a small software team, subcontracting is usually the right first move: - The prime handles the government relationship, the contract vehicle and most of the paperwork. - You get to prove you can deliver on real programs without carrying all the risk. - Past performance as a sub helps you win more work later, including as a prime. The trade-off is that you depend on the prime for work and your margins are thinner. For most firms starting out, that’s worth it. ## Step 1: get registered Even as a sub, primes will usually ask for your basic federal identifiers. Register your business in [SAM.gov](https://sam.gov/), the government’s System for Award Management. Registration gives you a Unique Entity ID, and you’ll also get a CAGE code. Keep your registration current, since primes check it. ## Step 2: pick a lane “We do software” isn’t a pitch. Primes and program managers are looking for a specific capability that fills a gap on a specific program. Good lanes for small software firms include: - Data pipelines and integrations with legacy or government systems - Operator dashboards and web applications - Cloud infrastructure and DevSecOps - Modernizing legacy systems - Test automation and tooling Pick one or two, and be ready to show work in them. ## Step 3: find the primes and startups that need help Defense work isn’t just Lockheed and Raytheon anymore. Some of the best subcontracting opportunities are at fast-growing defense startups that just won something big and need to deliver faster than they can hire. Along the I-35 corridor, for example: - **Allen Control Systems** in Austin was selected for an Army counter-drone contract with a [ceiling of up to $500 million](https://www.austinfoundersfeed.com/stories/allen-control-systems-500m-army-counter-drone-contract). - **Darkhive** in San Antonio won a [$49.7 million APFIT production award](https://hoodline.com/2026/05/south-side-drone-upstart-snags-nearly-50-million-pentagon-production-deal/). - **Telos** just won a [$13.5 million contract](https://www.globenewswire.com/news-release/2026/10/05/3374949/0/en/telos-secures-13-5-million-contract-to-continue-support-of-air-force-intelligence-community-cyber-operations.html) supporting Air Force intelligence community cyber operations. We wrote more about this cluster in [the I-35 defense corridor](https://axiointelligence.com/blog/i35_defense_corridor). Local programs help too: Capital Factory’s [Defense Academy](https://portsanantonio.us/defense-academy) at Port San Antonio connects startups with people on the government contracting side. SBIR is another way in. The programs are [reauthorized through 2031](https://www.congress.gov/crs-product/IN12705), and startups that win Phase I and Phase II awards often need engineering help to deliver. We covered that in [our SBIR post](https://axiointelligence.com/blog/sbir_sttr_through_2031). ## Step 4: answer the security questions Before a prime gives you access to anything sensitive, they’ll ask how you protect it. Have clear answers ready. ### CMMC: paused, not gone The Cybersecurity Maturity Model Certification was supposed to make third-party Level 2 assessments a condition of award starting November 10, 2026. On July 13, the Department of War [suspended that Phase 2 transition](https://dowcio.war.gov/Portals/0/Documents/Library/ImplementingSuspensionCMMC-PhaseII.pdf). During the suspension, program offices can only require CMMC Level 1 (Self) or Level 2 (Self) assessments. That isn’t a free pass. As [Automata noted on October 7](https://www.automata.org/insights/cmmc-phase-2-suspended), the department says, “All Phase I self-assessment requirements remain firmly in place,” and the CMMC rule itself still contains the original phase schedule. [Clark Hill](https://www.clarkhill.com/news-events/news/dow-pauses-cmmc-phase-2-defense-contractors/) adds that contractors handling covered defense information are still responsible for DFARS 252.204-7012 and NIST SP 800-171 Revision 2. For a subcontractor, that means: know whether you’ll handle Federal Contract Information or Controlled Unclassified Information, do the matching self-assessment honestly, and keep your System Security Plan current. ### Export control and ITAR Some programs involve export-controlled technical data. On those, the prime will limit who can access the work, and you’ll need to show your team and systems can comply. Ask about this early, before you staff a project. ### Your development environment Expect questions like: Where does the code live? Who has access? Is multi-factor authentication on everything? Where does CUI live, and how is it kept separate? Having good answers is often what separates the firms that get hired from the ones that don’t. ## What primes check before they hire a subcontractor From the conversations we’ve had, primes look for: - **Delivery.** Have you shipped similar work, and can they call a reference? - **Seniority.** Will experienced engineers do the work, or will they be training juniors on the program’s budget? - **Security posture.** Do your answers to the questions above hold up? - **Fit with their process.** Will you work in their repos, tools and ticketing, or insist on your own? - **Low drama.** Clear scope, honest estimates, early warnings when something slips. ## Step 5: start small and deliver Your first subcontract will probably be small. Treat it as the audition it is. Deliver on time, communicate early and leave the codebase better than you found it. Defense is a small world, and program managers talk. ## Where we fit We’re a San Antonio software firm that subcontracts for defense and dual-use companies: building software around the core product, modernizing legacy systems and setting up secure delivery pipelines. For startups without a senior technical leader, we also work as a [fractional CTO](https://axiointelligence.com/services/fractional-cto). See our [defense and dual-use page](https://axiointelligence.com/industries/defense-dual-use), or [book a call](https://axiointelligence.com/book) if you’re a prime or startup that needs software delivered. ## We do this work for a living. A 30-minute scoping call with the engineers who would do the work. [Book a scoping call](https://axiointelligence.com/book) Or email [contact@axiointelligence.com](mailto:contact@axiointelligence.com?subject=Project%20inquiry) and we’ll reply. ## Related posts Oct 5, 2026 ### [The I-35 defense corridor: where software subcontractors fit in Austin and San Antonio](https://axiointelligence.com/blog/i35_defense_corridor) Counter-drone contracts in Austin, drones and secure software in San Antonio: the I-35 defense tech corridor and where software subcontractors fit. defense, San Antonio, Austin Oct 12, 2026 ### [Army NGC2 is buying commercial apps: how a small software shop plugs in](https://axiointelligence.com/blog/army_ngc2_commercial_apps) The Army's NGC2 contract awards went to nine commercial app vendors. How the Commercial Solutions Opening works and where small software firms fit. defense, NGC2, Army Oct 13, 2026 ### [Staff augmentation vs. consulting: when to bring in an outside engineering team](https://axiointelligence.com/blog/outside_engineering_team_iot_edge_ai_cloud) When an IoT, edge AI or cloud cost project stalls, should you hire, augment staff or bring in a project team? A buyer's framework for program leads. staff augmentation, IoT integration services, edge AI