How to Get a UEI and CAGE Code: A Guide for Software Companies
#sam-gov#registration#saas#federal-market
By Philip Luca — Founder of GovExpress; prior domain experience at Bloomberg Government and GovWin IQ.
Two identifiers follow a company through every federal sale: the Unique Entity ID (UEI) and the CAGE Code. A prime asking you to join a team will want both. A contracting officer will check both before an award. And a buyer looking you up in public federal data will find you through both.
Neither costs anything, and neither has a separate application form for most US software companies. Both come out of SAM.gov registration. What trips companies up is not getting them. It’s not knowing which one a request is asking for, or which one breaks when the company moves, renames or gets acquired.
The short version
| Unique Entity ID (UEI) | CAGE Code | |
|---|---|---|
| Format | 12 characters, letters and numbers | 5 characters, letters and numbers |
| Issued by | SAM.gov, the System for Award Management | The Defense Logistics Agency’s CAGE program |
| Identifies | Your legal entity | Your entity at a specific physical location |
| How a US company gets it | Request it in SAM.gov; issued after entity validation | Assigned during full SAM.gov registration |
| Cost | Free | Free |
| Replaced | The DUNS number, in April 2022 | Nothing; it has existed for decades |
What the UEI is
The UEI is the government-wide identifier for your company. Award records, payment systems, subcontract reports and public spending data all key on it. It replaced the nine-digit DUNS number in April 2022, so if your company’s paperwork still lists a DUNS, that number no longer identifies you anywhere that matters.
A UEI belongs to the legal entity, not to a product, brand or office. A company with one legal entity has one UEI. A company with subsidiaries that registered separately has one UEI per registered entity, and public federal data treats each as a separate company.
How to get a UEI
- Create a Login.gov account for the person who will manage the registration, with multi-factor authentication turned on. SAM.gov uses it for every sign-in.
- Choose “Get a Unique Entity ID” in SAM.gov and enter your exact legal business name and physical address.
- Pass entity validation. The government checks your name and address against authoritative records. If they match cleanly, the UEI is issued quickly. If they don’t, you upload documents, such as incorporation papers, and wait for a manual review.
You can stop there. A UEI on its own is enough to be named on a subcontract, to appear in subaward reporting, or to apply for a grant. It is not enough to receive a prime contract award. For that you need the full registration, and the full registration is where the CAGE Code comes from.
What the CAGE Code is
The Commercial and Government Entity (CAGE) Code is a five-character identifier the Defense Logistics Agency assigns to an entity at a physical location. The Department of War leans on it heavily, and it shows up across civilian agencies too: in contract documents, in security and facility paperwork, and in the supplier records primes keep.
The location part matters. A company with offices at two addresses can hold two CAGE Codes under the same legal entity. Move your headquarters and the CAGE record has to follow.
How to get a CAGE Code
US companies: you don’t apply for one separately. When you complete the full entity registration in SAM.gov, choosing all awards as your purpose rather than assistance only, a CAGE Code is requested and assigned as part of processing. The CAGE program validates your record as one of the checks a registration goes through before it becomes active.
Companies outside the US: you need an NCAGE Code before you can register. It is issued through your country’s national codification bureau, or through the NATO Support and Procurement Agency where a country has none. Get it first. SAM.gov will not complete a foreign registration without it.
When the registration reads Active, your UEI and CAGE Code both appear on your entity record. Write them down alongside the registration’s expiry date. A prime’s onboarding form will ask for all three, usually with a deadline.
How long it takes
Plan in weeks, not days, and start before you need them. The form is an afternoon’s work for someone with the documents in hand. What varies is validation: a company whose legal name, physical address and IRS records agree in every source moves through quickly. A company with a mismatch waits while a person reviews documents, first at entity validation and again at CAGE validation.
If a specific opportunity has a response date, finish the registration well before it. A proposal from an entity without an active registration can be found ineligible for award.
The mistakes that cost the most time
Giving a prime your UEI when they asked for your CAGE Code, or the reverse. It sounds trivial. It also bounces onboarding forms back and forth for days. Twelve characters is the UEI; five is the CAGE Code.
A legal name that doesn’t match. The name on your state filing, your IRS records and your registration must agree. A brand name on one and the full legal name on another is the most common cause of a manual review.
Moving without updating. Your CAGE Code is tied to an address. Relocate and don’t update the registration, and the mismatch surfaces at the worst moment: during a security review, or when a contracting officer checks your record before an award.
Assuming an acquisition carries the identifiers over. When one company buys another, the acquired entity’s UEI and CAGE Code don’t merge into the buyer’s on their own. Contracts held by the acquired entity may need a formal transfer, and the public record will show two companies until the registrations are dealt with deliberately.
Paying a third party for something free. Neither the UEI nor the CAGE Code costs anything. Firms that charge to file for them are legal, but the government never charges for either.
Letting the registration lapse. The UEI stays with your entity. The registration behind it expires annually. An expired registration makes you ineligible for award, even though the identifiers on your website look the same as ever. Calendar the renewal sixty days ahead.
How buyers use these identifiers
A contracting officer doing market research, a small-business specialist checking a set-aside, or a prime vetting a teaming partner usually starts from one of these two codes. The UEI pulls up your SAM.gov record, your representations and your award history in public spending data. The CAGE Code ties you to a location and to the supplier systems the Department of War and its primes use.
That makes them more than form fields. They’re the keys that join your company to everything public about it. If the record behind them is out of date, every lookup returns the out-of-date version.
To see what that record looks like from a buyer’s side, score your company’s federal readiness. It reports where your registration and identity record stand alongside the other categories buyers check.
Related reading
- SAM.gov Registration for Software Companies: A Step-by-Step Guide
- How to Sell Software to the Federal Government: The Complete 2026 Guide for ISVs
- NAICS Codes for Software Companies: How to Choose, and What They Decide
- How to Find Federal Contract Opportunities: A Guide for Software Startups
- Glossary: UEI · CAGE Code · SAM.gov
The CMMC brief
What the Phase 2 suspension changed and what it did not — the obligations that still bind, the assessment path a contract puts you on, the scoping decision that drives the cost, and the sequence that fits inside a pipeline. Sourced from the primary record.