Most advice on productizing federal work starts with a brainstorm. It should start with a records request, because the first question is not what to sell. It is whether you own it.
A services firm can spend a year and six figures turning a tool it built for one agency into a product, and discover at the end that it handed the government unlimited rights to that tool when it delivered it. The build was real. The market research was real. The ownership was never checked.
So the order matters. First you establish what you own. Then you find the candidates. Then you decide which one deserves money. This page walks that sequence, with the clause numbers so you can check every claim yourself.
What productizing actually means
Productization is turning work you deliver as a service into something you can sell more than once, to more than one buyer, without rebuilding it each time.
That definition is doing a lot of work, so here are the three tests it implies. A candidate has to pass all three.
Repeatability. You can deliver it to a second customer without redesigning it. A one-off program for a single sponsor fails this. A method you have run at four program offices passes.
Transferability. Someone other than the founder can deliver it. If every engagement routes through one person, you have a practice, not a product. That is not a failure. It is a valuation ceiling, and it caps out around what most services firms already trade at.
Separability. It has a boundary you can price. If the only unit you can sell is hours, you are still selling labor. A fixed deliverable, a license, a subscription, or an outcome has a boundary. "Support" does not.
A product that passes all three is a business. A product that passes two is a project with a name. A product that passes one is a slide.
Do you own it?
This section is the one most productization advice skips, and it decides whether the rest is worth doing.
Federal data rights are governed by Part 27 of the Federal Acquisition Regulation, and the clause that matters most on civilian contracts is FAR 52.227-14, Rights in Data—General. What it says is less intuitive than most contractors assume.
The default is not yours
Under 52.227-14(b)(1)(i), the government gets unlimited rights in data first produced in the performance of the contract. "Data" here includes computer software, because the clause defines it that way. Unlimited rights means the government can use it, disclose it, reproduce it, prepare derivative works, distribute copies to the public, and permit others to do the same.
Read that list again, because it includes the part that ends companies: permit others to do so. A follow-on contractor can be handed your source code.
You can assert copyright in data you first produced under the contract, but on most contracts that requires the contracting officer's prior written permission. Journal articles are the exception. And even when copyright is asserted, 52.227-14(c)(1)(iii) gives the government a paid-up, nonexclusive, irrevocable, worldwide license to reproduce the software, prepare derivative works from it, and perform and display it publicly. It cannot distribute copies to the public under that license. It can do everything short of that.
So the practical question is not "did I write this?" It is "who paid for it?"
The protected lane: developed at private expense
The clause protects two categories, and both have the same precondition.
Limited rights data is data other than computer software that embodies trade secrets or confidential commercial information, to the extent it pertains to items or processes developed at private expense.
Restricted computer software is software developed at private expense that is a trade secret, confidential, or copyrighted.
"Developed at private expense" is the gate. If you built the tool on your own time, with your own money, before the contract or outside its scope, it can be restricted computer software. Under 52.227-14, you can withhold it and deliver form, fit, and function data instead: the data that describes what it does without giving away how.
If you built it under the contract, on the contract's money, it is not developed at private expense. It is data first produced in performance, and the default in 52.227-14(b)(1)(i) applies.
There is an important variable here. Alternate II to 52.227-14 lets an agency require delivery of limited rights data rather than letting you withhold it, and Alternate I changes the definition of limited rights data for some procurements. Which alternates apply is written in your contract. Most contractors have never looked.
The worst case: special works
FAR 52.227-17, Rights in Data—Special Works, applies to data that is itself the deliverable: training materials, instructional works, documentation, studies, and similar products. Under it, the government gets unlimited rights in all data delivered and all data first produced, and the contractor may not assert copyright without the contracting officer's prior written permission. If the government wants the copyright, the clause directs the contracting officer to obtain an assignment.
If you have ever delivered a training curriculum or an operating manual under a special works clause, you may have delivered something you cannot sell. That is exactly the category most services firms think of as productizable.
SBIR is the exception, and it is a good one
Work performed under the SBIR program is treated differently. On civilian contracts, FAR 52.227-20 governs rights in SBIR data. On DoD contracts, DFARS 252.227-7018 does.
The structure is that the contractor retains title, and the government receives SBIR data rights, a license narrower than unlimited rights, for a defined period. Under the current DFARS clause the period is twenty years from award, unless the agency and the contractor negotiate a different one after award. The FAR clause that civilian agencies use still states four years after acceptance, extendable under FAR 27.409(h). Which clause your contract carries decides. Your ownership does not change when either period ends.
This is why an SBIR heritage is an asset rather than a side note. The data rights are the most favorable default available to a small contractor, and they last long enough to build a business on. Our SBIR Phase III guide covers what to do with them.
On DoD contracts, assertion is deadline-driven
DoD uses a different clause set: DFARS 252.227-7013 for technical data, 252.227-7014 for noncommercial computer software, and 252.227-7018 for SBIR data.
The mechanism that matters is DFARS 252.227-7017, Identification and Assertion of Use, Release, or Disclosure Restrictions. You assert your restrictions with your proposal. Failure to submit or sign the assertion attachment can make the offer ineligible, and data delivered without a marking is treated as unlimited. The window to correct a missing marking is narrow.
There is no polite reminder later. The assertion happens at proposal time, in an attachment, before award. Contractors who discover this after award are in a bad position: they hold something on paper and cannot restrict its use.
On DoD contracts, government purpose rights are the middle category. They typically run for five years from the contract, modification or option that required the development, then convert to unlimited rights, unless a different period is negotiated. Five years is shorter than most product roadmaps, and the clock does not restart when you begin selling.
Patents have their own clock
If the product includes a patentable invention, Bayh-Dole applies to small businesses and nonprofits. Under 35 U.S.C. 202 and its implementing regulation at 37 CFR 401.14, you must disclose each subject invention to the agency within two months after your inventor discloses it to you in writing, and elect in writing whether to retain title within two years of your disclosure to the agency. The agency can shorten the election window to 60 days before a statutory bar. The government receives a nonexclusive license, and retains march-in rights under 35 U.S.C. 203.
Miss the election and title can pass to the government. This is a two-year decision that most founders do not know they are making.
Two cases worth knowing
A 2025 Federal Circuit decision is the cautionary tale on markings. Restrictive markings on privately developed commercial drawings were held improper because the drawings were operation, maintenance, installation and training data, which the DFARS treats as unrestricted. The contractor had marked them correctly by its own lights and still lost the point. FlightSafety International, Inc. v. Secretary of the Air Force (Fed. Cir. 2025).
Title is not automatic either. The contractor must require employees to assign their inventions, because Bayh-Dole does not vest title by itself. Stanford v. Roche, 563 U.S. 776.
The one rule that prevents most of this
Sell the output, not the tool.
If the deliverable is a report, deliver the report. If the deliverable is a dashboard, you have just delivered the dashboard, and the government's rights in it are the contract's rights. The tool that generates the report is a different asset, and if it was developed at private expense it is protectable.
This is not a loophole. It is the distinction the clauses already draw. Contractors get into trouble by delivering the machinery because the customer asked nicely.
| What you built | Who paid | Default position | Can you sell it? |
|---|---|---|---|
| Tool developed before the contract, at your expense | You | Restricted computer software | Yes, generally, if you withhold it and deliver form, fit, and function data |
| Tool built under the contract and delivered | The contract | Unlimited rights under 52.227-14 | Only with the agency's agreement, and usually not |
| Training curriculum under a special works clause | The contract | Unlimited rights, copyright assignment available to the government under 52.227-17 | Not without permission |
| SBIR Phase II prototype | The award | Contractor retains title, SBIR data rights for twenty years under the DoD clause | Yes, that is the point of the program |
| Invention made in performance | The contract | Contractor may elect title under Bayh-Dole | Yes, if you disclose and elect in time |
None of this is legal advice, and none of it substitutes for reading your own contract. Two things are worth doing before any product decision: pull every data rights clause and alternate from the actual award, and have counsel read the assertions you filed. The FAR itself is mid-rewrite under the Revolutionary FAR Overhaul, with Part 27 rewritten and agencies adopting it by class deviation, so the clause list in your solicitation is the only reliable answer for what applies to you.
What to ask for in the next award
The ownership problem is easier to prevent than to fix. These are positions contractors commonly ask for, in rough order of how often they matter. A solicitor or attorney should draft and review any of them; this list is what to raise, not language to paste.
- Assert your data in the proposal. On DoD work, DFARS 252.227-7017 is where the restriction is created. The marking on the delivered data is where it is declared. Both have to be right.
- Name the deliverable precisely. If the contract says "tool" and you meant "report", you have promised the tool.
- Keep pre-existing IP out of the deliverable. Identify it, mark it, and deliver it separately or not at all.
- Ask for a license rather than a transfer. When the government needs rights in something you want to sell, a limited license is the position to test. Ownership is the harder ask.
- Ask which alternates are in the clause. Alternate I and Alternate II to 52.227-14 change what you can withhold. Most offers never check.
- Raise the special works clause. If the deliverable is training material or documentation, ask whether 52.227-17 is intended to apply.
- Put the patent clock in the calendar. Disclosure within two months and election within two years are dates, and they pass whether or not anyone is watching.
- Get the SBIR clause right. If the work is SBIR-funded, the SBIR data rights clause is the most valuable term in the contract. Confirm it is there.
You will not win all eight. The first, third and eighth are the ones that decide whether there is a product at the end.
The six stages
Once ownership is settled, productization is a sequence. HARBOR runs it in six stages, and each one ends in a decision rather than a document.
| Stage | What it produces | How long | The decision it forces |
|---|---|---|---|
| Harvest | An inventory of productizable assets from the delivery record, scored | 14 to 21 days | Which candidate, if any, is worth money |
| Architect | A product specification with an MVP boundary, a price model, and sample CLINs | A full day plus 10 business days | What exactly you are selling, and at what price |
| Risk-Proof | An authorization decision and the economics behind it | As long as the decision takes; no fixed duration | Whether the compliance cost is justified by the market |
| Build | A working MVP, a product requirements document, and outreach toward signed letters of intent | 90 days | Whether real buyers will commit |
| Operate | An operating playbook with scope controls and standardized delivery | Milestone-defined | Whether it runs without the founder |
| Replicate | Pricing, vehicles, CLIN structure, and a replication model | Milestone-defined | Whether it scales beyond the first market |
The order is not arbitrary. Harvest is cheap and decides where the money goes. Architect is where most firms discover the product is three products. Risk-Proof is where the compliance bill arrives, and where a surprising number of good ideas correctly die. Build is the expensive one, and it comes after the two decisions that protect it.
HARBOR sells five fixed-scope engagements, and they map onto the stages unevenly. The Harvest Sprint from $15,000 runs Harvest. The Architect Workshop from $25,000 runs Architect. The Build Pilot from $50,000 is tagged Risk-Proof + Build, because the compliance question and the MVP run in the same 90 days, though its published deliverables stop at the MVP, the PRD and the letters of intent. Operate + Replicate from $50,000 covers two stages at once. The Federal Activation Audit from $12,500 sits across the whole sequence and is about the vehicles and certifications you already hold.
Risk-Proof is the stage with no offer of its own, and that is deliberate. The honest output is sometimes "do not proceed", which is hard to sell as a standalone package. The Build Pilot runs the compliance question in parallel, but it does not produce an authorization decision, and no HARBOR engagement sells one.
Find candidates, then score them
Finding candidates is the easy half. The hard half is choosing between them, because founders reliably choose the wrong one.
The instrument matters more than the inventory. HARBOR uses the Service-to-Product Fit scorecard: six weighted dimensions, a weighted total, five binary checks, and two fatal-flaw vetoes.
| Dimension | Weight |
|---|---|
| Repeatability | 20 |
| Cross-Agency Demand | 15 |
| Compliance Leverage | 15 |
| Vehicle Access | 20 |
| ATO Feasibility | 15 |
| Economic Viability | 15 |
The weights encode an argument. Repeatability and Vehicle Access carry the most, because a product you cannot repeat is a project and a product you cannot sell is a hobby. Cross-Agency Demand carries only 15 because a single-agency product can still work; it just cannot scale past that agency. ATO Feasibility carries 15 because authorization is expensive but not usually fatal if a sponsor exists.
The threshold is a weighted total of 3.0 to continue. A total of 4.0 or higher with every check passing is a proceed. Anything else is investigate. The two veto dimensions are Vehicle Access and Economic Viability: score below 2 on either and the candidate fails regardless of the total.
The check that catches the most candidates is not the total. It is at most one dimension scored 2. A candidate can clear 4.0 with two weak dimensions and still be a bad bet, because the weakness shows up later as a stalled sale or an unfunded authorization.
That is exactly what our worked example shows: a composite firm at 58 people and $14M, scoring 5, 2, 5, 5, 2, 5 for a total of 4.10, and still landing on investigate because two dimensions scored 2. The arithmetic is on that page and you can recompute it.
What the sequence looks like at a real firm
The composite firm worked through there is a useful shape because it is unglamorous.
It delivers authorization package support to two agencies, both through one prime. It holds one GSA MAS schedule and one agency IDIQ. Its delivery record contains a reusable assessment package that has run at multiple program offices with roughly 90% of the same evidence set.
That is a strong candidate on three dimensions and a weak one on two. Repeatability is high. Compliance Leverage is high, because the package exists because an authorizing official needs evidence. Vehicle Access is high, because both vehicles accept a product CLIN at this scope.
Cross-Agency Demand is weak, because both buyers came through the same prime and there is no third agency with a budget line. ATO Feasibility is weak, because the hosted version needs an authority to operate and no sponsor has committed.
The decision is not "build it". It is "go find the third agency and the sponsor before you build it". That is a cheaper instruction than an MVP, and it is the kind of thing the scorecard exists to surface.
Six ways this fails
You do not own it. Covered above. The failure is silent until someone else is given your work, and by then the product is a cost center.
There is no vehicle path. A product with no way to sell it is a demo. Most schedules require a modification before they accept a product CLIN, and modifications take months. Our vehicle guide covers how to check.
You have one sponsor, not a market. A program manager's enthusiasm is not a budget line, and a single-agency product caps your revenue at that agency's appetite. The scorecard scores this at 15 rather than 20 for exactly this reason.
The founder is the product. If every delivery needs the founder in the room, the revenue does not survive a transition, and the valuation reflects it. The valuation gap post has the multiples.
You priced hours. A productized offering priced per hour is a services line with better marketing. Separability is the test. The Architect Workshop exists partly because pricing is where productization is usually lost.
There is a sixth, and it is the most expensive: authorizing before validating. A firm spends on FedRAMP before a single buyer has committed, and then discovers the market was never there. Our FedRAMP cost breakdown is blunt about the arithmetic, and the full cost model prices the three paths side by side.
The honest readiness test
Before any of this, answer four questions.
Have you delivered the same thing, for real, to more than one customer? Do you have rights to it? Is there a vehicle that can carry it? Can someone other than you deliver it?
Four yeses: start at Architect, and skip the inventory. Three: start at Harvest. Two or fewer: the constraint is the business, not the product idea, and productization will not fix it.
If you want a first read before committing to anything, the free HARBOR Signal diagnostic takes about eight minutes and returns a readiness score plus a live read on your federal contract footprint. It is designed to tell some firms not to buy, which is a feature. If the read says you are not ready, the useful next step is contract archaeology, not a build.