What Is a CAGE Code? A Plain-English Definition

A CAGE code is a five-character identifier, made of letters and numbers, that the Defense Logistics Agency assigns to a specific physical location doing business with the U.S. federal government. It does not identify a company as a whole — it identifies one address. A national supplier with plants in three states typically holds three separate CAGE codes, one per site, all connected to the same company.

What a CAGE code is, in one sentence

A CAGE code is a five-character code, such as the kind returned by a CAGE code lookup, that identifies a facility for federal contracting and logistics purposes — not a company, a person, or a product. If two questions get asked about the same term, "what is a CAGE code" and "what does CAGE stand for," this is the single answer to both: it is a location identifier, not a decoded label, and everything else about it follows from that one fact.

What CAGE stands for and who issues it

CAGE stands for Commercial and Government Entity, and the code is issued exclusively by the Defense Logistics Agency's CAGE Program Office. The name describes what the system covers: both commercial businesses and government entities get a CAGE code when they need one, since a government office can be the "supplier" of record on some transactions just as a private company can. Nothing about the acronym describes the code's format or content — it names the program, not the identifier's structure.

For a facility located outside the United States and its territories, the equivalent identifier is called an NCAGE code (NATO Commercial and Government Entity code). NCAGE codes are assigned through a country's own national codification bureau, or through NATO's support agency for countries without one, rather than through DLA directly. A foreign supplier and a U.S. supplier are both in the same underlying system, just issued through different front doors.

What the five characters mean — and do not mean

A domestic CAGE code follows one published formatting rule: the first and fifth characters are numeric, and the second, third, and fourth characters can be any mix of letters and numbers, excluding the letters I and O so they are never mistaken for the digits 1 and 0. That rule exists to keep the format consistent and machine-readable, not to encode information about the company it belongs to. An NCAGE code follows a different convention and typically begins with a letter, which is how the two are told apart at a glance.

What the characters do not do is spell out anything about the entity — not its state, its industry, its size, or its founding date. CAGE codes are assigned sequentially from the available pool as requests come in. Two facilities across the country from each other, in completely unrelated industries, can have CAGE codes that differ by a single character purely because they happened to be assigned close together in time. Reading meaning into the specific characters of a CAGE code is treating a sequential identifier like a decoder ring, and it will produce a wrong answer every time it is tried.

What a CAGE code is used for

A CAGE code's core job is identifying who — meaning which physical location — is involved in a specific piece of federal contracting or defense logistics activity. It appears on contract and purchase order documents to record which facility is the supplier of record, on parts and technical data packages to tie a component back to the facility that manufactured or supplied it, and inside the National Stock Number system, where it is one of the pieces of information logistics systems use to identify exactly where a cataloged item comes from.

It also functions as a lookup key for other systems to hang information off of: an active CAGE code is part of what confirms a facility has a current SAM.gov registration, and checking one against current data can surface whether that facility carries a federal exclusion flag — something a bid package or a purchase order number alone cannot tell you. That is a different identifier doing a different job than the Unique Entity Identifier, which identifies the legal entity as a whole rather than one of its locations.

Who actually needs a CAGE code

Anyone bidding on or performing a prime defense contract needs a CAGE code, and it is typically assigned automatically the moment a U.S.-based entity completes SAM.gov registration — there is no separate application or fee involved. Beyond prime contractors, the need for one is less absolute than it looks at first glance.

A subcontractor does not automatically need its own CAGE code just for being part of a supply chain; the requirement usually turns on whether the subcontractor is paid directly by a federal agency, needs its own SAM.gov registration for another reason, or is handling classified information, where a CAGE code is required alongside the facility's name and address. Many prime contractors ask subcontractors for one anyway, for teaming records and past-performance tracking, even when nothing legally requires it. A grants-only registrant can likewise have an active SAM.gov registration and a Unique Entity Identifier without ever being assigned a CAGE code at all, because nothing in a grants relationship touches DLA's logistics systems — a registration with no CAGE code is common, not an error.

How a CAGE code is assigned

For most U.S. entities, a CAGE code is assigned as a byproduct of registering in SAM.gov — there is nothing separate to fill out, and no cost either way. SAM.gov collects the information DLA needs to verify the entity and its location, and the CAGE code comes back as part of that same registration record.

An entity that needs a CAGE code without a full SAM.gov registration — for example, to satisfy a classified-contract requirement without bidding on open-market work — can request one directly from DLA's CAGE Program Office. Either path runs through the same verification process on DLA's side: confirming the entity is real, confirming the physical location, and catching name or address mismatches before a code is issued. That verification step is also why a CAGE code cannot be reserved or guessed in advance of registering — it does not exist until DLA has actually assigned it.

Common misunderstandings about CAGE codes

The most persistent misunderstanding is trying to decode a CAGE code the way a VIN or a UPC prefix can sometimes be decoded — assuming a particular character reveals a state, an industry, or something else about the entity. It does not. Beyond the single published rule that the first and fifth positions of a domestic code are numeric, the characters carry no embedded meaning, and treating an assigned sequence as a puzzle to solve is a documented source of bad advice on sites discussing CAGE codes.

A second common mistake is confusing a CAGE code with the identifiers it gets used alongside — a UEI, a DUNS number, or a NAICS code — all of which answer a different question. A CAGE code says which location; it does not say who the legal entity is or what industry it operates in. Anyone unclear on how those identifiers relate can see the full breakdown in CAGE code vs. UEI vs. DUNS. A third mistake is assuming a single CAGE code covers a company's entire footprint — a facility opening at a new address generally needs its own code, because the identifier tracks the location, not the parent company standing behind it.