What Is CAGE Code?
Also known as: Commercial and Government Entity code, NCAGE, CAGE number
Definition
A CAGE code is a five-character identifier assigned to entities that do business with the US federal government and defense primes. It is issued by the Defense Logistics Agency, usually through SAM.gov registration, and identifies a specific facility.
CAGE Code Explained
CAGE stands for Commercial and Government Entity. The code is five characters and identifies a particular location of a supplier, manufacturer or other entity, not only a company. It appears on contracts, drawings, labels, procurement records and many military specifications, which is why defense ERPs hold it on both customer and vendor records.
In the United States a CAGE code is normally assigned as part of registration in SAM.gov, the System for Award Management, and maintained by the Defense Logistics Agency. Foreign entities receive an NCAGE code through their national codification bureau. Registration details need to be kept current, and the code ties the entity to other lookups used by contracting officers.
A CAGE code is an identifier only. It does not attest that a company is ITAR registered, CMMC certified or AS9100 certified. Compliance status is tracked separately and verified through the relevant systems or certificates. Confusing the code with a quality or security approval is a common misunderstanding.
In ERPs the CAGE code lives in custom or standard fields on the customer and vendor master, and it is printed on certificates of conformance, packing slips, unique item identification labels and shipping documents. For defense work, data quality here matters because a wrong code on a label or a record can delay payment or acceptance.
Why It Matters
- Defense contracts and prime purchase orders commonly require the supplier's CAGE code on documents, so missing data stalls orders.
- Flow-down verification of sub-tier suppliers starts with confirming the code matches the legal entity and location.
- Counterfeit and diversion risk programs use the code to confirm the origin of parts and the party that handled them.
- Accurate codes on labels and packing paperwork reduce rejection at government receiving.
In Practice
Example: a defense electronics shop ships a lot to a prime. The packing slip and certificate of conformance both need the shop's CAGE code and the prime's ship-to CAGE. If the vendor master holds the code on the site record, the document template pulls it automatically. If the shop operates two buildings with separate codes, the ERP should select the code by plant, not use one global value. The gotcha is a code copied from the parent company onto a branch facility.
Frequently Asked Questions
How do I get a CAGE code?
In the US, registering the entity in SAM.gov results in a CAGE code assigned by the Defense Logistics Agency. Foreign entities obtain an NCAGE code from their national codification authority.
Does a CAGE code prove ITAR registration or CMMC?
No. It only identifies the entity and location. ITAR registration, CMMC status and AS9100 certification are separate and must be verified separately.
Is a CAGE code per company or per site?
It identifies a specific entity at a specific location, so separate facilities can have separate codes. Use the one that matches the facility doing the work or shipping the product.
Related Terms
ITAR
ITAR (International Traffic in Arms Regulations) is the US State Department regulation, at 22 CFR Parts 120-130, that controls the export of defense articles, defense services, and related technical data listed on the United States Munitions List.
CMMC (Cybersecurity Maturity Model Certification)
CMMC (Cybersecurity Maturity Model Certification) is the US Department of Defense program that verifies defense contractors implement required cybersecurity controls before contract award, using three levels of assessment tied to the sensitivity of the information they handle.
DFARS 252.204-7012
DFARS 252.204-7012 is the Defense Department contract clause requiring contractors to protect covered defense information by implementing NIST SP 800-171, to report cyber incidents to DoD within 72 hours, and to flow the same obligations down to subcontractors.
AS9100
AS9100 is the quality management system standard for the aviation, space, and defense industry, published by SAE and the International Aerospace Quality Group, which incorporates all of ISO 9001 and adds sector-specific requirements for safety, configuration, and risk.
Certificate of Conformance (CoC)
A certificate of conformance (CoC) is a document from the manufacturer or supplier, signed by an authorised person, stating that delivered goods or services meet the purchase order, drawing and specification requirements, with traceable lot or serial references.
Go Deeper
ITAR Compliance Checklist for Manufacturers
A 32-point checklist covering DDTC registration, technical data controls, foreign person access, IT security, and recordkeeping for ITAR-regulated manufacturers.
Free ToolDFARS 252.204-7012 Compliance Self-Assessment
A 10-question self-assessment covering the full DFARS 7012 clause: NIST 800-171 implementation, SPRS, incident reporting, cloud requirements, and flowdown.
Free ToolCounterfeit Parts Risk Assessment (AS5553)
A 10-question assessment of your counterfeit electronic parts exposure, aligned to AS5553 and DFARS counterfeit prevention requirements, with a risk band and mitigation plan.
Working with CAGE Code in a live environment? Our engineers do this every day - and our AI agents automate most of it.