Capability Statements for Software Companies: What to Include and How Buyers Use Them

2026-10-05#capability-statement #small-business #saas #federal-market

By Philip Luca — Founder of GovExpress; prior domain experience at Bloomberg Government and GovWin IQ.

Almost every federal sales conversation eventually ends with the same request: “Can you send me your capability statement?” A contracting officer asks for it after an industry day. A small business specialist asks for it before a matchmaking session. A prime asks for it when it is looking for a teaming partner. For a software company new to the federal market, it is often the first document a government reader sees.

A capability statement isn’t a regulatory form. No part of the Federal Acquisition Regulation defines it, and no system checks it. That freedom is why so many are weak. This guide covers what the document is for, what a federal reader expects to find on it, and how a software company writes one that holds up.

What a capability statement is for

A capability statement is a short summary of what your company does, who it has done it for, and how the government can buy from you. It is usually one page, sometimes two, and usually a PDF.

It is used in three situations:

Market research. Before an agency decides how to buy something, it researches who can provide it. When it posts a sources sought notice or a request for information, many responses include a capability statement, and the agency uses them to decide whether enough capable small businesses exist to set the work aside.
Outreach. Small business specialists, contracting officers and program staff collect capability statements at industry days and in meetings. A clear one gets filed where it can be found again.
Teaming. Primes use them to decide which subcontractors to bring onto a bid. For a prime, the question is whether you fill a specific gap in its offering.

In each case the reader is scanning, not studying. They want to decide in under a minute whether your company is relevant to something they are working on.

What to put on it

Federal readers expect a familiar set of sections. Using that structure makes your statement faster to read, because the reader knows where to look.

1. Core competencies. Three to six short statements of what your software does, in the terms a federal buyer would use. “Case management for benefits adjudication” says more to a federal reader than “an AI-native workflow platform.”

2. Differentiators. What you do that comparable vendors don’t. Keep each one specific and checkable: a deployment model, an integration, a security authorization you actually hold.

3. Past performance. Two to four relevant engagements: the customer (if you have permission to name it), what you delivered, and at what scale. Commercial customers count. A federal reader cares about relevance first, as covered in past performance for software companies.

4. Company data. This is the block a contracting officer actually copies into a spreadsheet:

Legal business name, exactly as it appears in your SAM.gov registration
Unique Entity ID (UEI) and CAGE code
Primary and relevant secondary NAICS codes, and PSC codes if you know the ones agencies use for your product
Socioeconomic status, such as small business, 8(a), HUBZone, WOSB or SDVOSB, only where you are certified or registered as such
Contract vehicles you hold, such as a GSA Schedule, and how to order through them
A named point of contact with a direct email and phone number

5. Security and compliance posture. For software this matters more than for most other categories. State what you have and how it was established: a FedRAMP authorization, a third-party audit report, or a self-assessment.

Make it match your registration

The most common mistake isn’t missing information. It is information that doesn’t match what the government already has on record.

A contracting officer can look up your SAM.gov registration in seconds. If the legal name, UEI, NAICS codes or small-business status on your capability statement differ from the registration, the reader notices, and the mismatch costs you credibility before they read your competencies. Before you send the statement anywhere, check each field in the company data block against your active registration. If your registration has lapsed, renew it first; see SAM.gov registration for software companies.

The same goes for socioeconomic claims. List a status only if it appears in your registration or you hold the certification. A claim a reader can’t confirm is worse than no claim.

Say how each claim is established

Software companies often list compliance frameworks as a row of logos. Federal buyers read those claims more carefully than that.

A FedRAMP authorization is listed in the FedRAMP Marketplace, and a reader can confirm it. A SOC 2 report was issued by an independent auditor. A statement that you “align with NIST SP 800-171” or are “CMMC-ready” is usually self-attested: it describes your own assessment, not an independent one. All three can be worth stating. They aren’t the same claim, and a buyer who later finds that a claim was self-attested when it read as verified will discount the rest of the page. Write each one in words that say how it was established. For more on why the distinction matters, see verified vs. self-attested.

For Department of War (DoW) work involving controlled unclassified information, be especially precise about CMMC status, since the level required is written into the contract.

Tailor it, and keep it short

One generic capability statement is better than none. A tailored one is better still. When you respond to a specific notice or meet a specific agency:

Reorder your competencies so the ones closest to that agency’s work come first.
Choose past performance that matches the agency’s mission or the scale of the requirement.
Use the agency’s language. If the notice describes the need in its own terms, describe your product in those terms.
Keep it to one page unless the request allows more. A reader who has to hunt for your UEI is less likely to come back.

Save it as a PDF with a file name that includes your company name, and use the same version everywhere at one time so different readers aren’t comparing different documents.

What a capability statement doesn’t do

A capability statement opens conversations. It doesn’t make you eligible to compete, and it doesn’t substitute for a proposal. Eligibility depends on your registration, the NAICS code and size standard on the solicitation, any set-aside restriction, and any security authorization the work requires. If you’re still working out which of those apply to your company, start with how to sell software to the federal government.

To see how your registration and compliance record look from the outside, across the categories federal buyers review, score your company’s federal readiness.

The CMMC brief

What the Phase 2 suspension changed and what it did not — the obligations that still bind, the assessment path a contract puts you on, the scoping decision that drives the cost, and the sequence that fits inside a pipeline. Sourced from the primary record.