Sources Sought and RFIs for Software Companies: Why Answering Early Shapes the Contract

2026-10-05#small-business #saas #federal-market

By Philip Luca — Founder of GovExpress; prior domain experience at Bloomberg Government and GovWin IQ.

Most software companies meet federal procurement at the solicitation stage. A request for proposals appears on SAM.gov, and the company has a few weeks to decide whether to bid. By then the hardest decisions have already been made: how the requirement is described, which NAICS code applies, whether it is set aside for small businesses, and which contract type the agency will use.

Those decisions are usually made during market research, before any solicitation exists. Sources sought notices and requests for information (RFIs) are how agencies do much of that research in public. Answering them is one of the few ways a company with no federal record can influence a requirement before it is written.

This guide covers what these notices are, why agencies post them, and how to answer one well.

What the notices are

Both are pre-solicitation notices. Neither is a request for an offer, and a response to either one can’t be accepted to form a contract.

Sources sought. The agency describes a need and asks which companies could meet it. The usual purpose is to find out whether enough capable companies exist, and often whether enough of them are small businesses, before deciding how to buy.
Request for information (RFI). The agency asks industry for information to help plan an acquisition. An RFI can ask about available products, pricing models, technical approaches, standard commercial terms or how a market usually works.

In practice the two overlap, and agencies use the labels loosely. Read what the notice asks for rather than relying on its title. Both appear on SAM.gov under Contract Opportunities, with their own notice types, alongside presolicitation notices, draft solicitations and industry day announcements.

Why agencies post them

The Federal Acquisition Regulation (FAR Part 10) requires agencies to do market research before they buy, scaled to the size and complexity of the purchase. Responses to a sources sought notice or RFI become part of that research and inform several decisions:

Whether to set the work aside. The FAR’s “rule of two” directs a contracting officer to set aside an acquisition for small businesses when there is a reasonable expectation of offers from at least two responsible small businesses at fair market prices. Sources sought responses are a common way to establish that expectation. If capable small businesses don’t respond, the requirement may go full and open.
Which NAICS code and size standard to use. The NAICS code on the solicitation decides who counts as small. Responses that show how the market describes this kind of work can inform that choice.
Whether a commercial product will do. Federal policy prefers commercial products and services where they meet the need. An RFI response that shows an existing software product already does the job supports buying it as a commercial item, often on commercial terms.
Which vehicle or contract type to use. Responses can show whether the work is already available through an existing contract vehicle, such as a GSA Schedule, or whether a new contract makes sense.

How a software company should answer

A good response is short, specific and easy for a contracting officer to use. The same habits apply to most notices:

Follow the instructions exactly. Notices often set a page limit, a format, a deadline and a list of questions. Answer each question in order and stay within the limit. A response that ignores the instructions may not be read.
Lead with your identifiers. Give your company name, UEI, CAGE code, SAM.gov registration status, business size under the NAICS code in the notice, and any socioeconomic status you hold. If a set-aside is being considered, this is what the contracting officer needs first.
Map your product to the stated need. Say which parts of the described requirement your software already meets, and which it doesn’t. Being clear about gaps is more useful to the agency than claiming you cover everything.
Describe how it is sold. If your product is a commercial subscription, say so, and explain the pricing model in general terms. If it is available through a contract vehicle, name the vehicle.
Point to relevant work. Name a few comparable deployments, commercial or federal. You aren’t being evaluated yet, but relevant experience makes it more credible that you can do the work. (Our guide to past performance covers how buyers weigh commercial references.)
Mark proprietary information. If you include pricing or technical details you don’t want released, mark them according to the notice’s instructions.

Where an RFI asks for feedback on a draft requirement, take it seriously. A specification that names one vendor’s features, sets an unrealistic security baseline or excludes commercial delivery models can often be corrected at this stage. After the solicitation is issued, the same change usually needs a formal question or a protest.

What responding doesn’t do

Responding doesn’t put you on a shortlist, and not responding doesn’t stop you from bidding later. The solicitation, if one follows, is open to every eligible company.

Responding also doesn’t establish eligibility. Whether you can compete is still decided by your registration, the NAICS code and size standard on the solicitation, any set-aside restriction, and any required security authorization, such as FedRAMP for cloud services or CMMC for Department of War contracts involving controlled information. A response that describes your compliance posture is self-attested, and buyers know that self-attested isn’t the same as independently verified.

What responding does is make you known to the people writing the requirement, while the requirement can still change.

Finding the notices worth answering

Agencies post many sources sought notices and RFIs, and most won’t fit your product. Saved searches on SAM.gov, filtered by notice type, NAICS code and keywords that describe your software, are the simplest way to see the relevant ones early. Watching which agencies already buy software like yours helps you decide which notices are worth the time.

To see how ready your company looks to the federal buyers posting these notices, score your company’s federal readiness.

The CMMC brief

What the Phase 2 suspension changed and what it did not — the obligations that still bind, the assessment path a contract puts you on, the scoping decision that drives the cost, and the sequence that fits inside a pipeline. Sourced from the primary record.