The CAGE code lookup, in detail.

A CAGE code is the five-character identifier the Defense Logistics Agency assigns to a specific physical location of a U.S. entity that does business with the federal government. The authoritative definition lives at FAR 52.204-16(a): an identifier "assigned to entities located in the United States or its outlying areas by the Defense Logistics Agency (DLA)."

The single most useful clarification this page can make is what a CAGE code is not:

Not the legal entity ID

The UEI is. A company with five offices has one UEI and up to five CAGE codes. See UEI vs CAGE explained for the broader identifier landscape.

Not a DUNS replacement

DUNS retired from the federal stack on April 4, 2022, replaced by the UEI. CAGE was never a DUNS replacement and predates UEI by decades.

Not just for primes

Subcontractors get CAGE codes too. Government buyers (federal agencies and military units) also receive CAGE codes, a CAGE record may identify a Government buyer rather than a vendor.

The format is consistent across DLA documentation and reproduced in widely-used reference materials. Per DLA CAGE Program convention:

Length

5 characters total. No more, no less.

Position 1

Digit (0-9) for domestic CAGE.

Positions 2, 3, 4

Alphanumeric. Letters I and O are excluded.

Position 5

Digit (0-9) for domestic CAGE.

Excluded letters

I and O are excluded across all positions to avoid visual confusion with digits 1 and 0. All ten digits (0-9) are valid; some third-party explainers incorrectly state digit 0 is excluded, that is wrong.

NCAGE differences

NCAGE codes for foreign entities have an alphabetic character in the first and/or fifth position, distinguishing them from domestic CAGE structurally.

Domestic CAGE:  ^[0-9][A-HJ-NP-Z0-9]{3}[0-9]$
NCAGE:          ^([A-HJ-NP-Z][A-HJ-NP-Z0-9]{3}[0-9]
                |[0-9][A-HJ-NP-Z0-9]{3}[A-HJ-NP-Z]
                |[A-HJ-NP-Z][A-HJ-NP-Z0-9]{3}[A-HJ-NP-Z])$

• Anyone receiving a federal prime award. Any dollar amount. Issued automatically as part of SAM.gov entity registration.
• Subcontractors at any tier when FAR 52.204-2 applies. Per FAR 52.204-16(d), every subcontractor performance location requiring access to classified information under DD Form 254 must have a unique CAGE.
• Foreign vendors. Need an NCAGE first, then SAM. The procedural ordering matters: NCAGE is a SAM precondition for non-U.S. and non-Canadian entities.
• Government activities. Federal agencies and military units also receive CAGE codes. This is a real edge case, a CAGE may identify a Government buyer, not a vendor.

Assignment

Through SAM.gov entity registration. DLA validation queue typically returns a CAGE in a few business days; longer turnarounds happen, escalate via the DLA CAGE Program contact channels if waiting beyond 10 business days.

Renewal cycle

CAGE codes assigned or updated after late August 2016 carry a 5-year expiration tied to date of last update. Each annual SAM renewal effectively resets the clock since the CAGE record is touched as part of the renewal.

Pre-2016 codes

Legacy non-expiring; deactivate only when SAM lapses or DLA revokes.

Revocation triggers

SAM registration lapse beyond grace period; DLA discovery of fraudulent registration; voluntary entity dissolution or name change without a CAGE merge request; failure to respond to DLA correspondence at the address of record.

Status semantics

Inactive vs Expired vs Cancelled, three distinct statuses that contracting officers see in SAM, with different remediation paths. A cancelled CAGE cannot be reused; an expired CAGE may be renewed if the entity acts within DLA's grace window.

FAR 4.1803 prescribes the verification methodology for contracting officers. Two authoritative paths:

Method A, SAM.gov entity search

The FAR 4.1803-preferred path for SAM-registered entities. Visit sam.gov/entity-information and search by UEI, CAGE, or legal name. Returns name, address, status, expiration, and SAM registration progress.

Method B, DLA CAGE search

The FAR 4.1803-prescribed path for non-SAM entities (Government buyers, foreign NCAGEs, historical records). Visit cage.dla.mil. Note: DLA endpoints can be intermittently unreachable; FAR 4.1803 explicitly authorizes the SAM fallback when DLA is not available for SAM-registered entities.

Method C, FPDS / USAspending lookup

Contract-history-driven, useful when verifying a CAGE that appeared on a historical award. See our USAspending recipient lookup guide.

Operational tip for procurement officers: always confirm the CAGE matches the offeror's legal name and location address on the offer. FAR 52.204-16(c) requires the offer to use the CAGE for that exact name-address pair.

The single biggest source of vendor-master confusion. CAGE codes identify physical performance locations, not legal entities. The DD Form 254 rule at FAR 52.204-16(d) is explicit: every subcontractor performance location requiring classified access must have a unique CAGE.

Multi-state contractor

Multiple manufacturing plants → multiple CAGEs, one UEI.

Acquired entity

Retains its legacy CAGE post-merger until DLA processes a consolidation request. The acquirer's UEI may temporarily map to several CAGEs that historically belonged to different companies.

HQ vs warehouse

Headquarters and warehouse may have separate CAGEs for invoicing and shipping splits, even when both belong to the same UEI.

Why this matters for diligence: a CAGE-only match is a location match, never an entity match. Anchor diligence to UEI. The risk of conflating CAGE with entity is screening one of a contractor's ten facilities and concluding the entire company is clean.

• Treating a CAGE match as an entity match. CAGE = location. UEI = entity. Anchor on UEI.
• Validators that accept I or O, or reject NCAGE. See the regex in section 2.
• Assuming pre-2016 codes expire automatically. They don't. Pre-Aug 2016 codes are non-expiring unless DLA revokes or SAM lapses.
• Skipping NCAGE-before-SAM ordering for foreign vendors. Foreign entities must obtain NCAGE first; SAM registration will fail without it.
• Relying solely on cage.dla.mil when SAM is the FAR-preferred path. For SAM-registered offerors, FAR 4.1803 prescribes SAM as the verification source. The DLA endpoint is for non-SAM lookups.

Where DiligenceDesk fits: the orchestrator resolves any input (legal name, UEI, or CAGE) against the SAM API, then anchors every downstream lookup to the resolved UEI. A CAGE input never silently becomes a single-location audit. See the methodology page and Step 1 of the diligence checklist for the legal-entity-confirmation step.