NAICS Codes for IT and Software Services in Federal Contracting

A NAICS code is the six-digit label a US contracting officer attaches to every solicitation to say which industry the work belongs to. For a general overview of the system, see our NAICS codes guide. For IT firms the stakes are specific. The code on a solicitation sets the SBA size standard that decides whether you can bid as a small business, and the codes in your SAM.gov registration control which opportunities agencies find you under. Get them wrong and you either miss relevant work or show up in the wrong searches.

Computer systems design under 541512 is one of the largest single channels of federal IT spending, so most software and systems integrators anchor there. But the boundary between custom development, systems design, and hosting is blurry, and picking the closest code for each contract is what keeps your federal bid alerts accurate.

There are two distinct places NAICS codes act on you, and confusing them is the most common early mistake. The codes you register in SAM.gov describe your business and populate the Dynamic Small Business Search that agencies mine for market research and sources-sought responses. The single code on a given solicitation is the one that governs that specific award, including which size standard applies and whether a set-aside is open to you. You self-certify small under your primary registered code, but on any one bid it is the officer's chosen code that counts. When a contracting officer runs an entity search on SAM.gov, they filter by NAICS first, so a missing secondary code can quietly keep you out of the shortlist for work you could easily deliver.

Five codes cover the large majority of federal IT and software work. 541511, Custom Computer Programming Services, is for bespoke development where the deliverable is code written to a client's requirements. 541512, Computer Systems Design Services, is the broadest and highest-spend IT code, covering systems integration, IT architecture, and the design of end-to-end solutions. 541513, Computer Facilities Management Services, covers running a client's data center or IT operations on their behalf, on an ongoing basis. 541519, Other Computer Related Services, is the catch-all for computer work that fits nowhere else, including IT staffing, disaster recovery, and hardware-agnostic support. 518210 is where cloud hosting, data centers, and data processing sit.

The boundaries are narrower than they sound, and agencies read them literally. A firm that writes a custom application and also hosts it is doing 541511 work and 518210 work, not one blended thing. A managed services provider that runs a client's systems day to day is closer to 541513 than 541512, even though it also designs. When you cannot tell two codes apart, the test agencies apply is the primary purpose of the specific contract, not the broad shape of your company.

A few adjacent codes are worth knowing when your scope drifts: 611420 for computer training, 811212 for hardware repair, and 541690 for specialised technical and security advisory. Read the official Census NAICS descriptions before you commit, because the wording, not your marketing language, is what a contracting officer matches against.

Every NAICS code has an SBA size standard that defines the largest a firm can be and still count as small. For most IT codes the standard is measured in average annual receipts, and since the Small Business Runway Extension Act took effect the calculation uses a five-year average rather than three years. 541511, 541512, and 541519 sit at 34 million dollars. Computer facilities management under 541513 is higher at 37 million dollars. Cloud and hosting under 518210 is higher still at 40 million dollars. You can confirm any figure against the SBA size standards table, which is the authority when a size protest lands.

Two details trip people up. First, receipts are counted across your whole corporate family, so an affiliate or a parent's revenue can push you over the line even if your own IT unit is small. Second, the five-year average smooths a single big year, which helps a firm that just landed one large award stay small a while longer. The practical effect is that your small business status is not fixed. You may qualify as small under 541512 but exceed the standard on a lower-threshold code, so the same firm can be small on one solicitation and large on the next. That is why the code the contracting officer chose for a specific opportunity, not your general self-image, governs eligibility for a small business set-aside. If you are new to this, our SAM.gov glossary explains how the self-certification fields fit together.

One IT-specific rule catches people out. Resellers registered under 541519 can use a special Information Technology Value Added Reseller exception, which replaces the 34 million dollar receipts standard with a 150-employee headcount standard. It exists because a reseller assembling a large multi-vendor hardware and software solution would blow past a receipts cap on pass-through product value alone.

The exception only applies when the procurement is set up under it and the value-added services, meaning configuration, integration, installation, training, and support, make up at least 15 percent and no more than 50 percent of the total contract price. If a solicitation cites the ITVAR exception, check the headcount standard rather than assuming the receipts figure. The rule sits in 13 CFR 121.201.

Modern IT work does not map cleanly onto codes written for an earlier era, so use these rules of thumb. Cloud hosting, managed data centers, and SaaS delivery belong under 518210. Designing or integrating a cloud architecture as a service is usually 541512. Writing the application itself is 541511.

Cybersecurity has no dedicated code, so it lands under 541512 for security architecture and monitoring, 541519 for incident response and tooling, or 541690 when the work is advisory. AI and data services split the same way: model development reads as 541511 or 541512, while running the inference infrastructure reads as 518210. When in doubt, look at how agencies coded past awards for similar work on SAM.gov, then match theirs. Contracting officers rarely stray from precedent.

One cross-cutting requirement matters more than the code itself for defense work. Contracts touching controlled unclassified information now expect Cybersecurity Maturity Model Certification, and that obligation follows the data, not the NAICS code. A 541511 development contract and a 518210 hosting contract for the Department of Defense can carry the same certification bar. Treat the code as the classifier of the work and the certification requirements as a separate gate you clear regardless of which IT code you bid under.

You are not limited to one code. Register a primary code, the industry you self-certify your size under, plus a set of secondary codes so you appear in more agency searches. Here is a practical sequence:

1. Pick your primary from where the bulk of your revenue sits. For most systems integrators that is 541512, for pure development shops 541511.

2. Add secondaries for adjacent work you genuinely deliver, for example 518210 if you also host, or 541519 for staffing augmentation.

3. Check the size standard on each code and confirm you qualify as small where it matters, using the SBA table.

4. Mirror the codes agencies actually use for your kind of work, which you can see in award histories and in a federal market intelligence tool.

5. Review yearly, because a growing firm can cross a size standard and a new code can open a set-aside lane. Keeping your codes current also protects the accuracy of your e-procurement searches and any PSC code pairings you use to refine results.

A handful of errors show up again and again, and each one costs opportunities. The first is registering too few codes. A development shop that lists only 541511 will never surface in a contracting officer's search for 541512 systems integrators, even when it could do the work. The second is registering too many, unrelated codes to look bigger, which dilutes your relevance in searches and invites size challenges if you win outside your real capability.

The third is treating the primary code as permanent. As your revenue mix shifts, so should the code you self-certify under. The fourth is ignoring the code an officer put on a solicitation and bidding as small when that particular code's standard says you are not, which is grounds for a protest. The fifth is copying a competitor's codes without reading the official descriptions, since two firms that look similar can legitimately classify under different codes.

Fix all five by reviewing your registration against your last year of contracts, reading the Census NAICS definitions rather than guessing, and pairing your codes with PSC codes so buyers who search by product and service classification also find you. A federal market intelligence view of award histories shows which codes actually carried the work you want.

Once your codes are set, the daily problem is coverage. SAM.gov shows solicitations under your codes, but IT work is routinely mis-coded, and a systems design contract can be posted under 541519 or even a non-IT code by a busy contracting officer. Filtering by NAICS alone quietly misses those.

Jorpex tracks SAM.gov alongside more than 50 other public sources and matches opportunities with embedding-based semantic AI, so a relevant notice surfaces even when its NAICS code is off. You combine NAICS filters with keywords, contract value bands, and disqualifiers to cut noise, then receive matches in Slack, Microsoft Teams, or email as realtime, daily, or weekly digests. It supports 17 languages, which helps if you also chase work under the EU CPV codes for IT services or other contract vehicles. Plans start at 49 dollars a month with a 14-day free trial. For the wider picture on winning US work, see our government contractors guide.