NAICS Codes for Government Contracting: How to Pick the Right Ones
Your NAICS codes control which set-asides you compete in, which size standards apply, and which opportunities show up in your pipeline. Here is how to research and pick them correctly.
GovPillar Editorial
Your NAICS codes are the first filter every federal procurement officer and search algorithm applies to your company. Pick codes that are too broad and you compete in the wrong pool. Pick the wrong primary NAICS and your size standard may not match the set-aside you want. Spending 30 focused minutes on this saves months of missed opportunities.
Why NAICS codes matter more than most contractors think
Each NAICS code carries its own SBA size standard — either annual revenue or employee count. A company can be a small business under NAICS 541512 (Custom Computer Programming Services, $34M revenue limit) but not under NAICS 541330 (Engineering Services, $25.5M). Getting your primary NAICS wrong means your size certifications in SAM.gov are miscalibrated, which creates compliance risk on every set-aside bid you submit.
Step 1: Start with what you actually deliver
Write a plain-English description of your core service or product. Not your marketing tagline — the literal work you perform. "We build and maintain custom software applications for federal agencies" is more useful than "We deliver innovative digital transformation solutions." From that description, search naics.com or the Census Bureau's NAICS search at census.gov/naics. Read the official index entries, not just the code titles.
Step 2: Verify the SBA size standard for each candidate code
Go to sba.gov/document/support-table-size-standards. Look up each code you are considering. Size standards change periodically — always verify against the current table, not a screenshot from a blog post. Note whether the standard is revenue-based or employee-count-based. Your firm must fall below the applicable threshold to claim small business status under that code.
Step 3: Choose one primary, up to five secondary
Your primary NAICS code is the one that best represents what you bid under most often — it affects your size determination on most solicitations. Secondary codes expand the universe of solicitations where your profile matches. Most platforms and solicitations reference the primary NAICS in their set-aside determinations, so be deliberate. Don't add codes just because you theoretically could perform that work.
- Primary NAICS: the code you want to be known for, your core revenue driver in federal work
- Secondary codes: adjacent capabilities you actively pursue, not aspirational work you might take on
- Avoid adding codes where you cannot demonstrate past performance — contracting officers notice
- Re-evaluate every 12 months as your business evolves
Common pitfalls to avoid
Two mistakes show up constantly in SAM.gov registrations. First, using an overly broad code like 541990 (All Other Professional, Scientific, and Technical Services) when a more specific code exists. Specific codes rank better in searches and look more credible to contracting officers. Second, choosing a code based solely on where you see the most opportunities, rather than where you legitimately qualify — size standard fraud is a federal crime with severe penalties.
Frequently Asked Questions
How many NAICS codes can I have in SAM.gov?
SAM.gov allows up to 15 NAICS codes per entity registration — one designated as primary and up to 14 secondary. Most small businesses register 3–6 that genuinely match their work.
Can I change my NAICS codes after registering?
Yes. You can update your NAICS codes at any time through your SAM.gov entity registration. Changes take effect immediately on your profile, though they won't retroactively affect opportunities you've already identified. Update your profile in GovPillar after making changes to SAM.gov to keep your match scores current.
What NAICS code should I use for cybersecurity services?
Most cybersecurity work falls under NAICS 541519 (Other Computer Related Services) or 541512 (Custom Computer Programming Services), depending on whether the work is primarily operational security support or application development. For cleared cybersecurity work supporting DoD, 541330 (Engineering Services) sometimes applies. Use the SBA size table to verify which standard applies to each.
Put this into practice
GovPillar helps you apply everything in this guide — AI-scored opportunities, RFP shredding, capture pipeline, and more. Free to start.