The SBA's benchmark for commercializing an SBIR Phase II award is $100,000 in sales or investment per award.
That is the bar. It is low enough that one follow-on services contract clears it, which is exactly why so much Phase III revenue is services revenue with a product label attached.
Not because the technology fails. Not because the agency stops caring. Because the firms who win Phase II are good at the thing Phase II rewards: building something specific for one agency, on that agency's money, to that agency's requirements. Phase III rewards something different. It rewards turning that prototype into a repeatable product that a second agency can buy without you in the room.
SBIR is a services contract pretending to be an R&D grant. The agency pays you to build something specific for them. The "commercialization plan" you wrote in your proposal was a requirement, not a real plan. When Phase II ends and the agency says "great work, now go sell this commercially" — you're a services firm with a bespoke prototype and no product infrastructure.
Productizing an SBIR isn't impossible. It's just mechanically different from productizing ordinary delivery IP, and most founders don't know the difference until they've already made the expensive mistakes.
Here's the realistic framework. It's drawn from HARBOR's Harvest + Architect phases, stress-tested against the handful of SBIR firms we've worked with, and specifically adapted to the constraints you're actually working under: a custom-built prototype, a single agency customer, limited or no commercial pricing data, and a data-rights clock.
The three questions that determine Phase III viability
The first thing to understand is that not every SBIR is productizable. Some Phase II deliverables are genuinely bespoke — the agency wanted a thing exactly for them, there's no market for it outside that use case, and your "commercialization plan" was fiction from the start.
Before you spend another dollar trying to productize, answer three questions honestly:
Question 1: Is the core problem you solved specific to one agency, or common across many?
If your Phase II built a threat detection platform for a very specific Army sensor configuration, and no other agency uses that sensor, you don't have a product — you have a custom project. Move on.
If your Phase II built a data pipeline that processes sensor telemetry into threat candidates, and the underlying pattern (sensor → ML → threat queue) applies to DHS, intel community, maritime, healthcare imaging, and industrial IoT, you have a product. Keep going.
The test: can you name three non-DoD (or non-original-agency) use cases where your core technology would solve a real problem?
If no: productizing is probably not the path. Pursue a follow-on Phase II or Phase III with your existing agency.
Question 2: Do you have unencumbered data rights to commercialize?
Phase II data rights are the reason SBIR is different from ordinary work. You retain title to SBIR data, and the government's rights are narrower than unlimited for a fixed period: twenty years from award under the current DFARS clause, unless the agency and the contractor negotiate another period after award. You do not get the rights back at the end, because you never gave them up. One caveat: the FAR clause that civilian agencies use still states four years, so check which clause your contract carries. The traps are elsewhere. If you accepted optional terms, particularly SBIR Commercialization Readiness funding, you may have granted the government broader rights. And if your prototype incorporates government-furnished information or derivatives of classified data, you may not be able to commercialize it externally at all.
Before you spend a dollar on Phase III commercialization, have counsel review your Phase II contract. We've seen firms waste 12 months building commercial versions of products they couldn't legally sell outside the originating agency. The fix is always easier if you find out now.
Question 3: Can your existing Phase II work become the 70% "core" of a product, or does most of it need to be rewritten?
One of the foundational ideas in HARBOR is the 70/30 Rule — a product's core is 70% of functionality and is never customized; the other 30% is customer-specific configuration and integration. Violating this boundary collapses product economics.
Now apply that to your Phase II prototype. Look at the codebase honestly:
- Is 70% of the code generalizable (e.g., the ML pipeline, the data ingestion, the visualization layer)?
- Or is 70% of the code agency-specific (hardcoded sensor configs, agency-specific data schemas, customer-specific UI flows)?
If it's the first, you have a productizable core. You'll rewrite maybe 10-20% to generalize.
If it's the second, you have a custom project. Commercializing it means rewriting the bulk of it — and at that point, starting over with a clean-sheet product is often faster.
The four production paths
If you clear all three gates above, you have four realistic commercialization paths. Each suits a different firm profile.
Path 1: Sell Phase III directly to your Phase II customer
The simplest and most common Phase III path. Your agency customer is happy with the Phase II deliverable and extends you a Phase III sole-source contract to productize and deploy at scale. They keep buying, you keep building, everyone's happy.
When it works: your agency customer has internal budget authority and an expansion pathway. They like what they bought and want to grow it.
When it doesn't: budget cycles shift, the PM moves, or the program of record changes. You become a single-customer services firm in disguise. This is the pattern that makes a Phase III look successful on paper and behave like services in practice: technically Phase III, economically a staff-augmentation contract.
Path 2: Sell the same product to additional federal agencies
Take your Phase II tech, productize it (with a proper product CLIN structure, not a services CLIN), and sell it to 3-10 agencies. Classic federal SaaS play.
When it works: cross-agency demand exists, your vehicle access supports multi-agency sales (GSA MAS with software SINs, an IDIQ that opens federal-wide), and you have a sponsor at agency #2 ready to commit before you build.
When it doesn't: no vehicle, no sponsor, or the product is too niche for cross-agency expansion.
Path 3: Sell the dual-use version commercially + keep federal
Many SBIRs have a commercial analog. Sensor analytics? Every industrial IoT company wants this. Data pipelines? Every commercial SaaS company wants this. You build the federal version (authorized, FedRAMP-compliant) and a commercial version (cheaper, faster-moving, higher margin).
When it works: the commercial market is real and willing to pay, and your team can maintain two parallel product lines.
When it doesn't: commercial market is soft, or the cost of maintaining two lines exceeds what either line can support.
Path 4: License or exit to a strategic acquirer
Some SBIRs are better monetized through strategic sale than through building a product business. If Anduril, Palantir, Shield AI, or a commercial SaaS player would pay $5M–$20M for your IP + team, that's often a better outcome than the 3-4 year slog of building a product company.
When it works: your IP is genuinely unique, your team is core to the tech, and there's an active acquirer market in your domain.
When it doesn't: commodity tech, generic team, or no active acquirer interest.
The FedRAMP decision for Phase III
If your Phase III path is Path 2 (cross-agency federal SaaS), you're going to face a FedRAMP decision early. FedRAMP replaced the old impact levels with certification classes in August 2026, so the decision now reads like this:
- If your product handles only low-impact data and has minimal system interconnections: start with FedRAMP Class A, the entry class that replaced Ready. It accepts an existing SOC 2 Type II or a readiness assessment, and an independent assessor is not required. Budget the SOC 2 plus package work rather than a six-figure assessment.
- If the agency needs more assurance, or you handle CUI or PII at scale: Class C, the Moderate-equivalent class, is the next step. Budget a six-figure program and most of a year; what FedRAMP actually costs has the breakdown by class. Plan both stages, because Class A is a first step rather than a destination.
- If your customers demand DoD IL4+ or the High-equivalent class: Class D is announced but not available until 2027, and no ruleset is published. Assume a multi-million-dollar program and make sure the customer commitment justifies it.
The mistake we see Phase III firms make most often: they buy the expensive class before a customer requires it. The entry class exists to be used.
The vehicle problem nobody talks about
Here's the biggest hidden constraint: Phase III doesn't solve your vehicle access problem. A Phase III award lets you sell more of what you built to the agency that funded you. It doesn't give you cross-agency selling rights.
If Path 2 is your plan (multi-agency federal SaaS), you need:
- GSA MAS with software/SaaS SINs — months, not weeks, and up to a year for a first offer. Start now.
- Or a GWAC/IDIQ with product CLINs — if you can find one with on-ramp windows
- Or a channel partner arrangement — Second Front Systems, Palantir, Shield AI, or similar that lets you ride on their vehicle
Without one of these, you have a product but no way to sell it at scale. This is the most common Phase III failure mode we see — the firm builds a great product, authorizes it, and can't sell it because the vehicle path isn't real.
The routes that can carry software in 2026, including which are open and which are closed, are compared in selling software to the federal government.
The 18-month Phase III commercialization plan
For a firm clearing all three gates above and committed to Path 2, here's the realistic 18-month plan:
Months 1-3: Architect the product. Use the HARBOR Architect tools (Hill Selection, Product Commitment, Resource Allocation). Pick one market hill. Write a 20-page product spec. Commit the team.
Months 3-6: Start FedRAMP Class A + pursue vehicle access. Both in parallel. Budget the SOC 2 and package work, not a full assessment.
Months 6-9: Build + pre-sell. Ship MVP internally. Get written LOIs from 3-5 potential customers beyond the original Phase II agency.
Months 9-12: Class A in place; MVP to first customer. First commercial customer at 60-70% feature parity. Budget for iteration.
Months 12-15: Authorization complete; expand to 3-5 customers. Federal SaaS revenue starts flowing.
Months 15-18: Scale + HARBOR Replicate. Standardize pricing, CLIN structure, sales motion. Ready for Phase III extension or follow-on funding.
Total capital required: six figures to low seven figures depending on class and team size. Most of this should come from Phase III revenue + potentially $200K-$500K of outside seed capital if needed.
How HARBOR Signal helps Phase III firms
For SBIR-holding firms considering Phase III, we recommend starting with the free HARBOR Signal diagnostic. It scores your firm's readiness across leadership, operations and market position, which tells you whether you can carry a commercialization program at all. The three gates above are the questions to answer yourself.
If you're a Phase II winner thinking about Phase III: you're not alone. Most firms in your position struggle with the same structural problems. The methodology is in our books, and the Signal diagnostic is free.
The services-revenue pattern isn't inevitable. It is what happens when firms try to productize without a playbook.
We wrote the playbook.
About HARBOR: HARBOR is a book-codified methodology for federal services firms transforming into product companies. Run the free HARBOR Signal diagnostic for a 0-100 readiness score and a live read on your federal contract footprint, in about 8 minutes: harborgovcon.com/signal.