SAM.gov: System for Award Management for Contractors

Somewhere in the basement of the federal procurement apparatus, eight separate websites used to keep track of who was allowed to receive a government check. They had names like CCR and ORCA and FBO, and each one demanded its own login, its own forms, and its own slightly different version of the truth about a given company. In 2012 the General Services Administration began folding them, one at a time, into a single registry called SAM.gov, which now stands as the mandatory front door for any organization that wants to be paid by the United States government.

What SAM.gov actually is

The System for Award Management, hosted at sam.gov, is the official federal database of entities — businesses, nonprofits, state and local governments, foreign vendors, and individuals — that are eligible to do business with the federal government. Eligibility, in this context, is largely a matter of having registered, kept the registration current, and not appearing on any of several lists of people the government has decided it will not pay.

The system is operated by GSA's Integrated Award Environment, and registration is free. This last point bears repeating, gently but firmly, because a small economy of third-party services has grown up around the registration process, charging money to do something the government does not charge for. The registration itself is handled directly through sam.gov, with identity verification routed through Login.gov.

The eight systems that became one

Before SAM, a contractor seeking to do business with the federal government had to maintain a presence in a constellation of separate systems, each with its own purpose and its own quirks. The consolidation, carried out in stages, absorbed eight of them:

CCR (Central Contractor Registration) — the core vendor registry, where a business declared its existence, address, banking details, and size.
FBO (FedBizOpps) — the public listing of contract opportunities above the simplified acquisition threshold.
EPLS (Excluded Parties List System) — the roster of individuals and entities suspended or debarred from federal contracts.
FFATA (the sub-award reporting system mandated by the Federal Funding Accountability and Transparency Act) — which made prime recipients report what they paid to subcontractors.
ORCA (Online Representations and Certifications Application) — the place where a contractor annually swore to all the things the Federal Acquisition Regulation required them to swear to.
FedReg — federal agency registration for inter-agency transactions.
FAPIIS (Federal Awardee Performance and Integrity Information System) — the record of past performance, terminations, and integrity incidents.
The wage determination archives associated with the Service Contract Act and Davis-Bacon Act listings.

The migration was not instantaneous and not always smooth. FedBizOpps, for example, did not move into beta.sam.gov until late 2019, and the full retirement of the old domain followed shortly after. The consequence, today, is that a contractor logging into sam.gov is operating across the combined functional surface of those eight legacy systems — registration, opportunity search, exclusions checking, sub-award reporting, representations and certifications, performance history, and wage determinations — without, in most cases, realizing that this is what is happening.

Who has to register

The rule, in its plainest form, is that any entity wishing to receive a payment from the federal government — a contract award, a grant, a cooperative agreement, certain loans — must have an active registration in SAM.gov. This applies to:

Prime contractors at any dollar value, with limited micro-purchase exceptions.
Grant recipients, including universities, nonprofits, and research institutions.
State and local governments receiving federal pass-through funds.
Foreign vendors selling to U.S. agencies or military commands abroad.
Subcontractors only in certain reporting contexts, not as a general matter.

Entities seeking only to search public information — opportunity notices, exclusion records, wage determinations — do not need to register. The public-facing data is available without an account.

The Unique Entity ID

For about two decades, the federal government identified vendors using the Data Universal Numbering System number — the DUNS — assigned by Dun & Bradstreet, a private company. This was a curious arrangement. The official identifier of a federal contractor was a proprietary code owned by a corporation in New Jersey, which the government licensed under contract.

In April 2022, this changed. GSA transitioned to the Unique Entity ID, or UEI, a 12-character alphanumeric identifier issued directly by sam.gov at no cost. Existing registrants had their DUNS automatically translated to a UEI; new registrants are assigned one at registration. The DUNS, after April 4, 2022, no longer appears on federal contracts, grants, or sub-award reports.

The change is small in its mechanics and considerable in its implications. The federal government now controls its own contractor identifier, which is the kind of thing that, on reflection, one might have expected it to do all along.

Identity proofing through Login.gov

Access to sam.gov for any registration or maintenance task runs through Login.gov, GSA's shared identity service. The proofing process is the standard one: an account holder verifies an email, sets a password, configures multi-factor authentication, and then — for sensitive actions — completes identity verification by submitting a state-issued ID and confirming a phone number registered in their name.

Two practical observations follow. First, the entity administrator role at sam.gov is tied to a specific human being's verified Login.gov account, not to a generic role inbox. When that person leaves the organization, transferring administrator rights requires deliberate action, not merely changing a password. Second, the verification step occasionally fails for entirely mundane reasons — a recently moved address, a prepaid mobile phone, a name on a driver's license that does not exactly match the name in a credit file — and the resolution path involves uploading documents and waiting, rather than calling someone.

The annual renewal

A SAM registration is valid for 365 days from the date of activation, after which it expires. There is no grace period in the technical sense — an expired registration renders an entity ineligible to receive new awards, and contracting officers checking the registry will see the lapse — although existing payments on active contracts are not generally interrupted by an expiration.

Renewal is functionally a re-registration. An entity administrator logs in, reviews and updates each section, re-certifies the representations and certifications, and resubmits. Validation of the legal business name and physical address against IRS and other records can take several business days and occasionally several weeks, particularly if the entity has changed its name, moved, or restructured. The practical advice that experienced contracting officers offer — and which the SAM.gov interface itself echoes — is to begin renewal sixty days before expiration, on the assumption that something will need to be reconciled.

What the registration actually contains

A complete SAM.gov registration is a surprisingly detailed portrait of a business. The core sections include:

Core data — legal business name, doing-business-as names, physical and mailing addresses, congressional district, year of incorporation.
Assertions — NAICS codes describing what the entity does, PSC codes describing what it sells, size metrics including average annual receipts and employee counts, and information about facilities and capabilities.
Representations and certifications — the answers to dozens of questions drawn from the Federal Acquisition Regulation and agency supplements, ranging from small business status to whether the entity has had a federal contract terminated for default in the past three years.
Points of contact — separate records for the electronic business POC, the government business POC, and past performance POC.
Financial information — banking details for electronic funds transfer, taxpayer identification number, and CAGE code (assigned by the Defense Logistics Agency).

The representations and certifications section is, at length, the most consequential. Many of its answers carry legal weight; a small business that miscertifies its size to win a set-aside contract is exposed to civil and, in some cases, criminal liability under the False Claims Act.

Exclusions, the quiet half of the system

Alongside the active-registrant data, SAM.gov maintains the consolidated exclusions list — the successor to EPLS — which records every individual and entity that has been suspended, debarred, proposed for debarment, or otherwise excluded from federal procurement and non-procurement programs. Entries arrive from across the federal government: agency suspending and debarring officials, the Treasury's OFAC sanctions program, HHS-OIG, and others.

Federal contracting officers are required to check exclusions before making an award, and prime contractors are required to check them before issuing certain subcontracts. The exclusions search at sam.gov is publicly available, and a single lookup will return matches across all contributing sources.

How SAM connects to the rest of the procurement apparatus

A SAM registration is the prerequisite, not the destination. The UEI generated at registration is the identifier that flows into:

The Federal Procurement Data System (FPDS), where contract awards are recorded.
USAspending.gov, where awards and sub-awards are published for public transparency.
Agency-specific systems such as GSA's eOffer/eMod for Multiple Award Schedule contractors, the Defense Department's Wide Area Workflow for invoicing, and the various grant management platforms operated by HHS, NSF, and others.
The opportunity-notice system within sam.gov itself, where vendors can be matched against solicitations by NAICS code.

For contractors pursuing GSA's Multiple Award Schedule program, the sequence is generally: register in SAM, obtain the UEI, complete the Pathway to Success training, and then submit an offer through eOffer. The MAS Vendor Roadmap published by GSA describes the full path; the SAM registration is step one of many.

Common points of friction

Three things tend to go wrong, repeatedly, for organizations encountering SAM.gov for the first time.

The first is the entity validation step, which compares the legal business name and address submitted to the registry against authoritative records. A mismatch — a comma, an LLC versus L.L.C., a street suffix abbreviation — will halt the registration until documentation is provided. GSA shifted entity validation away from Dun & Bradstreet in 2022, and the new process has its own learning curve.

The second is the notarized letter requirement, which used to apply to all new registrations and was scaled back in 2018 but still appears in certain administrator-change scenarios. Reports from registrants suggest the requirement surfaces inconsistently.

The third is simply the volume of fields and the scarcity of people in most small organizations who know what answers to give. The FAR-derived representations alone run to several screens, and a thoughtful answer to "Does the offeror own or operate one or more facilities to manufacture, refine, or otherwise process the product?" requires more familiarity with FAR Part 52 than most first-time registrants possess.

A note on third-party registration services

Several private companies advertise SAM registration services, sometimes presenting themselves with names and visual styles that suggest a connection to the federal government. There is no such connection. SAM.gov registration is performed at sam.gov, by the entity itself or by an authorized representative, at no charge. Third-party services may provide legitimate consulting value, but the underlying registration is free, and any fee charged is for the labor of filling out the form, not for access to the system.