Capability statement template: every section filled in, with notes

The layout below is a complete capability statement for a fictional small business ("Acme Cybersecurity LLC"). Copy the structure. Replace the content with yours. The six numbered blocks match the six sections covered on the main capability-statement page.

Every field above is fictional and illustrative. Replace with your own verified content.

The template shows the shape. These notes cover what a buyer actually looks for in each block.

Core competencies (3-6 bullets)

Phrases, not paragraphs. Use the buyer's vocabulary. "FISMA-compliant security audits (NIST 800-53 Rev. 5)" tells a federal CO what you do and signals familiarity with the controls framework. "Innovative cybersecurity solutions" tells a CO you do not know how they buy. Reference specific frameworks, standards, or agency programs your work aligns with.

Past performance (3 recent contracts)

Format as a table. Columns: customer, contract number, period of performance, total contract value, one-line outcome. Federal work first, then state or local if you need to fill the table. If a contract is classified or restricted, sanitize the customer ("USG intelligence component") and drop the contract number. Outcome should be specific and measurable where possible (MTTR reduced from 6h to 38min, zero audit findings, 18 vulnerabilities remediated). "Client satisfied" adds nothing.

Differentiators (3-5 real ones)

A differentiator is something you can prove on a checklist. Certifications with verification dates. Clearance levels with cleared headcount. Geographic response times with office addresses. Contract vehicles held. Approved-product-integrator status with specific OEMs. If a competitor can claim the same thing in their capability statement, it is not a differentiator. Cut adjectives like "innovative," "cutting-edge," and "customer-focused" entirely.

Corporate data

This block is reference data. UEI is required (visible on SAM). CAGE is required if you have one (auto-assigned when DLA registers you). NAICS codes should match your active SAM registration exactly. Socioeconomic certifications should cite the verifying registry (VetCert for SDVOSB, certify.SBA.gov for 8(a)/HUBZone/WOSB, SAM for self-certified small). Contract vehicles held should specify prime vs sub where relevant.

Contact

One named person with a direct phone and a non-generic email. "Info@acmecyber.example" reads as a lead-capture inbox. "Jane.smith@acmecyber.example" with the role reads as a real BD lead. If you genuinely route all federal inquiries through a BD team, name the team lead, not the inbox.

Design signals

Logo at roughly 120-160px wide in the top-left or centered header. Clean sans-serif body font (Helvetica, Arial, Inter, Open Sans). One accent color for section headings, not five. File output to PDF, filename like acme-cybersecurity-capabilities-UEI-ABCDE12345FG.pdf. If you must include an image, keep it small and relevant (office photo, team photo). Stock imagery of handshakes and lightbulbs hurts you.

Short list of the mechanical rules.

• Length. One page. Two pages (front and back) only if you have substantial content for both sides. If your content fits on one page with whitespace, leave the whitespace.
• Orientation. Landscape or portrait. Landscape often fits the past-performance table better. Pick what displays your content; be consistent across future versions.
• File format. PDF only. Not Word, not PowerPoint, not Keynote, not Google Docs share links.
• Filename. Company name, UEI, "capabilities" or "capability-statement." Example: acme-cybersecurity-capabilities-UEI-ABCDE12345FG.pdf. This makes the file identifiable when a BD team has 200 capability statements in a folder.
• Typography. Body text 10-11pt. Headings 12-14pt. Margins at least 0.5" on every side. Never below 9pt body text; a CO reading on a laptop at 75% zoom will not strain.
• Color. One accent color, used for section headings. Body text black or near-black. Avoid colored backgrounds that waste printer ink if the document is printed.

Patterns that show up in capability statements buyers discard.

• Listing every NAICS code in your SAM profile. Pick the 3-6 that actually describe your primary work. A list of 18 NAICS codes reads as "we will bid on anything."
• Using a commercial brochure layout. Federal buyers expect a one-page reference document, not a tri-fold. If your capability statement could double as a trade-show handout, rewrite it.
• Burying the UEI. UEI and CAGE should be in the corporate-data block near the middle or bottom of the page, clearly labeled. Some firms tuck them in a footer in 6pt type. Do not make a CO hunt.
• Making the logo larger than the content. A banner-sized logo at the top followed by a half page of whitespace and then a tiny content block signals "we are not serious about federal work." Keep the logo modest.
• Vague past performance. "Provided IT services to federal customers" with no contract number, no period, no value is not past performance. It is noise.
• Listing training courses as differentiators. Individual training certs belong on a resume, not on a company capability statement. List organizational credentials (CMMC Level, ISO 27001, clearance level) instead.
• Letting it go stale. A capability statement dated 18 months ago that still shows a past-performance contract that ended 3 years ago reads as inactive. Date every version and refresh at least semi-annually.

The template above is rendered as HTML so you can copy it. To save as PDF without external tools: open your browser's print dialog (Cmd+P on macOS, Ctrl+P on Windows), select "Save as PDF" as the destination, and print. Most browsers respect the styled layout and produce a clean single-page PDF.

If you prefer a standalone editable version, any word processor accepts HTML paste. Copy the template block, paste into Google Docs or Word, edit the content, and export to PDF. The structure carries over cleanly; the formatting may need light cleanup.