Quick answer: A capability statement is a one page PDF that tells a buyer what your firm does, where you have done it before, why you are different and how to contract with you. Write it in five blocks: core competencies, past performance, differentiators, company data (UEI, CAGE code, NAICS codes, certifications) and one named contact. Tailor it to each buyer.
A procurement officer at a school district has your name from a conference. Before she returns your call, she asks for “your capability statement.” If you don’t have one, you’re sending a brochure or a ten page proposal, and neither gets read. If you do have one, she spends about a minute with it and decides whether you go on the list.
This guide shows you how to write a capability statement that survives that minute. It’s written for consultants and small firms bidding on government, school district and corporate work: security assessments, training, threat assessment, HR advisory and similar services. We’ll cover the standard sections, the federal codes you need (and when you don’t), design and length, and how to publish the whole thing on your website as a procurement page.
Key takeaways
- One page, saved as a PDF, titled “Capability Statement.” A second side is the exception, not the rule.
- Five blocks: core competencies, past performance, differentiators, company data and a named contact.
- Federal buyers expect your UEI, CAGE code and NAICS codes. School and corporate buyers rarely care about the codes but still want the structure.
- Keep a master version and cut a tailored copy for each agency or district you pursue.
- Put the same content on a procurement page on your website so buyers can find it without emailing you.
What is a capability statement?
A capability statement is a short document that summarizes what your business can deliver and the proof behind it, in a format a buyer can scan and file. The Queensland Government’s business portal compares it to a resume for your business, and that’s the right mental model. It isn’t a proposal. You don’t price anything, you don’t respond to a specific scope, and you don’t explain your methodology in detail.
In US government contracting the document has settled into a familiar shape. HUD’s small business office publishes a guide, Creating an Effective Capability Statement, that recommends three section labels (Core Competencies, Past Performance, Differentiators) plus company data and contact information, kept to one page and sent as a PDF. Contracting officers see hundreds of these. When yours follows the expected layout, they find what they need fast, and that’s the point.
Corporate buyers and districts use the term more loosely (“one pager,” “vendor profile”). Same document, same job.
Who reads your capability statement, and what they look for
Think about who will actually hold this page:
- Federal contracting officers and small business specialists. They check whether you fit a set aside, whether your NAICS codes match the work, and whether you’re registered. They will look you up in SAM.
- School district business offices and safety directors. They want to know if you’ve done this work for districts like theirs, whether you carry the insurance they require, and who to call.
- Corporate procurement and supplier diversity teams. They want certifications (such as small, veteran owned or women owned status), references and a clean description of scope.
None of them read paragraphs. They scan for a match between their need and your bullets. And the person who met you at the event will forward it internally, so it has to make sense without you in the room.
The five sections every capability statement needs
Here is the standard layout, in the order most buyers expect it. You can rearrange slightly for a corporate audience, but don’t drop any block.
1. Core competencies
Open with one or two sentences that tie your work to the buyer’s mission. Then list four to eight bullets of what you actually do, written in the words buyers use in their solicitations. “Physical security vulnerability assessments for K to 12 campuses” beats “holistic protective solutions.” HUD’s guide makes a point many people ignore: include only the competencies relevant to the agency you’re approaching, not everything your firm has ever done.
2. Past performance
List three to five relevant engagements. Each gets a client name (or a description if you can’t name them), what you did, and when. HUD suggests ordering them by relevance: work for the same agency first, then similar agencies, then other government and commercial work.
Two practical notes. First, if a client won’t let you name them, write “Large suburban school district, Midwest, 2025” and keep going; buyers understand confidentiality, especially in security work. Second, leave reference phone numbers off the version you hand out at conferences. Add them to the version you send after a real conversation.
New firm with no government work yet? Use relevant commercial projects and your own prior roles, clearly labeled. “As director of security at a regional hospital system, led the annual risk assessment program” is honest past performance for a founder. Our guide on how to start a security consulting business covers how to turn early projects into references.
3. Differentiators
This is the “why you” block, and it’s where most statements go soft. “Quality service” and “client focused” are not differentiators. Real ones are specific and checkable: a credential few competitors hold, a former role at the type of agency you’re selling to, a method with a name, a response time you guarantee, a clearance, a geographic footprint. Three or four bullets. If a competitor could paste your bullet into their statement without changing a word, cut it.
4. Company data
This block is boring and it matters more than you think, because it’s how a buyer gets you into their system. For federal work include:
- UEI (Unique Entity ID). SAM.gov assigns it during registration. The SBA describes it as a unique 12 character alphanumeric value. It replaced the old DUNS number, so if your template still says DUNS, update it.
- CAGE code. A five character ID assigned by the Defense Logistics Agency. According to the U.S. Fish and Wildlife Service’s financial assistance guidance, a CAGE code is assigned automatically as part of your SAM registration.
- NAICS codes. The North American Industry Classification System uses codes of up to six digits, each digit narrowing the industry. List your primary code first, then secondary ones, as numbers only (HUD advises leaving off the long descriptions). Consulting firms often look at codes in the 5416 group, such as 541611 for administrative and general management consulting and 541690 for other scientific and technical consulting. Check the exact titles in the Census NAICS search before you print.
- Certifications and set asides. Small business, woman owned, service disabled veteran owned, 8(a), HUBZone, or state and local certifications such as MBE, WBE or DBE.
- Contract vehicles and payment. Any GSA schedule or existing contract numbers, and whether you accept government purchase cards.
Add one line of basics: year founded, location, headcount, service area.
5. Contact information
A real person’s name, title, direct email, direct phone and your website. Not info@. HUD recommends a named contact on every page or side, and it’s good advice: the buyer who wants to call you should never have to hunt.
How to write a capability statement, step by step
Here’s the order we recommend when a client asks us to help draft one. It assumes you’re starting from scratch; if you have an old version, run it through the same steps.
Pick one target buyer
Write the first version for a specific agency, district or company you actually want to win. A generic statement reads generic. You will make other versions later.
Get registered first if you sell to the federal government
Register your entity in SAM.gov so you have a UEI and CAGE code to print. SAM.gov notes that you must renew your registration every 365 days to keep it active.
Collect your raw material
Pull your services list, three to six best past projects, credentials, certifications, codes and insurance details into one document before you design anything.
Write core competencies in the buyer's language
Read two or three solicitations or RFPs from your target and borrow their nouns. If they say "threat assessment training," don't write "behavioral risk education."
Cut everything to bullets
No paragraph longer than two lines. Aim for fewer than 400 words on the whole page.
Design it and save as PDF
Logo, brand colors, two columns, readable type. Name the file with your company name, for example "CompanyName Capability Statement.pdf".
Run the 60 second test
Hand it to someone outside your firm for one minute. If they can't say what you do and who for, fix the page.
Publish it and keep a master copy
Put the current version on your website and keep an editable master. Update it after every significant win.
Capability statement design and length
Length: one page. HUD’s guide allows front and back if you must but says one side is preferred. The Queensland guide notes longer statements exist for big tenders, but for consultants and small firms, one page is the norm and the expectation.
Format: PDF. HUD points out that many federal agencies block Word and Publisher files, so sending a .docx can mean your statement never arrives. A PDF also keeps your layout intact on any device.
Layout that works:
| Zone | What goes there |
|---|---|
| Top band | Logo, company name, “Capability Statement,” one line positioning statement |
| Left column (wide) | Core competencies, then past performance |
| Right column (narrow) | Differentiators, then company data (UEI, CAGE, NAICS, certifications) |
| Bottom band | Named contact, phone, email, website, address |
Use your brand colors, but keep the background white so it prints cleanly. Body text no smaller than about 10 point. One small photo is fine (a headshot works well for solo consultants), but skip stock imagery. And title it “Capability Statement.” HUD is blunt about that, and it helps when the PDF lands in a shared folder with fifty others.
Canva or InDesign is fine. If you have a brand style guide, follow it so the statement matches your website.
Do you need a UEI and CAGE code on a capability statement?
Only if you’re pursuing federal work, or state and local work funded by federal grants that requires SAM registration. If you sell mostly to school districts and private companies, those buyers will want your state vendor number, W9, insurance certificate and any district vendor ID instead. Leave out codes nobody asked for; they waste space.
One caution from SAM.gov itself: you can get a UEI without completing full registration, but SAM.gov states that if you only get a UEI, you cannot apply directly for federal awards. If federal contracts are part of your plan, complete the full registration and keep it renewed.
Publish your capability statement on your website as a procurement page
Here’s the part most guides skip. Buyers often look you up before they ever email you, and a PDF buried in a footer link doesn’t get found. We recommend a dedicated page, usually at a short URL like /procurement/, that does a few jobs:
- Shows the content as real web text. Core competencies, past performance, differentiators and company data, written as HTML headings and lists. Search engines can read it, and so can a buyer on a phone.
- Offers the PDF download. One clear button: “Download Capability Statement (PDF).” Keep the file name stable so links in old emails still work.
- Gives procurement what it needs in one place. UEI, CAGE code, NAICS codes, certifications, insurance summary, a W9 on request, and the named contact for contracting questions.
- Links to proof. Your case studies, credentials page and services pages, so a curious buyer can go deeper.
Add the page to your main navigation or footer under a label like “Procurement” or “For Agencies.” On sites we build for security and safety consultants, this page sits next to the services and about pages, because the people who look for it are often the people holding the budget. Our guide to what makes a strong security consultant website explains where it fits in the overall structure.
Keep the web page and the PDF in sync. The Queensland guide recommends keeping your website consistent with your capability statement, and buyers do notice when the PDF lists a service your site doesn’t mention.
Common capability statement mistakes
- Writing about yourself instead of the buyer. The opening line should name their problem, not your founding story.
- Listing every service. A statement that does everything looks like it specializes in nothing.
- Old identifiers. DUNS numbers, expired certifications, a lapsed SAM registration. Buyers check.
- One version for everyone. A district superintendent and a federal contracting officer care about different things. Tailor at least the competencies and past performance.
Frequently asked questions
How long should a capability statement be?
One page. HUD's small business guide allows a second side if you truly need it, but one side is preferred. Aim for under 400 words and let your website hold the detail.
Should a capability statement include pricing?
No. Pricing belongs in a proposal or quote that responds to a specific scope. A capability statement helps you get on the list for that conversation.
Can a new consulting firm write a capability statement with no past performance?
Yes. Use relevant commercial work and the founder's prior roles, clearly labeled as such. Buyers know new firms exist; they want to see that the people behind the firm have done the work.
What file format should a capability statement be?
PDF. Many federal agencies block Word and Publisher attachments, according to HUD's guide, and a PDF keeps your layout intact everywhere.
Do I need a capability statement for school districts and corporate clients?
It helps. Districts and corporate procurement teams often ask for a one page vendor summary, and the same structure works. Swap federal codes for your state vendor number, insurance details and certifications.
How often should I update my capability statement?
After every significant win, when a certification or registration changes, and at least once a year. SAM registration itself must be renewed every 365 days.
Turn your capability statement into a page that works for you
A capability statement earns its keep when it’s specific, current and easy to find. Write the master version once, tailor it for each serious buyer, and keep the PDF and your website saying the same thing. That alone puts you ahead of most small firms chasing the same contracts.
If your website isn’t ready for procurement teams yet, we can help. See how we approach web design for security consultants, or get in touch and we’ll send you a free homepage concept before you pay anything.
