NAICS codes for cybersecurity: there's no cyber code, so pick by what you deliver

This page is for cybersecurity firms filling in a NAICS or SIC field (SAM.gov, a GSA schedule or prime contractor form, an insurer, an investor data room) and for sellers building lists of security companies.

There's no cybersecurity NAICS code

NAICS groups businesses by production process, not by subject, and the Census Bureau's 2022 NAICS index file has no entry containing cybersecurity, cyber or information security. A security firm takes the code for the kind of work it does. These are the candidates:

Codes that look right but aren't

How to choose

NAICS classifies by primary activity, measured in practice by revenue, so add up last year's revenue by type of work:

Then list the others you'd bid under. On federal work the contracting officer, not you, assigns one code to each solicitation, and federal spending shows how spread out those choices are. On USAspending.gov, contract obligations in fiscal year 2025 on awards matching the keyword "cybersecurity" were coded:

Keyword matching is broad, so treat these as a guide to which codes agencies use, not a measure of the cyber market. The practical lesson: a security contractor registered only under 541512 misses work coded 541519, 541330 and 541513.

The SIC codes for cybersecurity

SIC has no security code either. The SIC equivalents of the codes above:

The SEC's EDGAR list uses these codes too, and listed security companies are scattered across them: Palo Alto Networks and Fortinet file under 3577 (computer peripheral equipment), CrowdStrike and Okta under 7372, Zscaler under 7371.

How many businesses use these codes

County Business Patterns 2023 counts establishments with paid employees on a 2017 NAICS basis. It can't isolate security firms, because NAICS doesn't, but it sizes the codes they sit in:

Software Publishers moved from 511210 to 513210 in the 2022 revision, so CBP 2023 still reports it under 511210. The top states for 541512 are California (7,616), Texas (7,226), Virginia (3,968), Florida (3,819) and New York (3,105). Of the 13,275 establishments in 541519, 10,281 have fewer than five employees.

SBA size standards

From the SBA's table effective March 17, 2023:

The engineering exception matters for cyber work on weapons systems: a contract coded 541330 under the military exception carries the $47.0 million standard.

Finding cybersecurity companies

Because there's no code, a code-based list of "cybersecurity companies" is really a list of IT services and software firms. The largest listed security vendors, from their latest 10-K:

For the ranked list, see the largest cybersecurity companies. For private firms, a better filter than the code is what they say about themselves: services pages, certifications, the frameworks they audit against and the roles they hire. Bebop finds security firms from a plain-language description and researches each account.

Worked example

Illustrative example. The company and figures are invented to show the method.

Bastion Ridge Security (bastionridge.example) has 60 employees in Maryland. Revenue: 45% managed detection and response from its own operations center, 30% penetration tests and compliance assessments, 25% security architecture and tool deployment projects.

1. Primary code: 541519. Monitoring and response plus assessments are services, 75% of revenue.
2. Other codes in SAM.gov: 541512 for architecture projects, 541513 for on-site operations work, and 541330 because agencies code some cyber engineering work there.
3. Size check: average annual receipts of $14.5 million. Small under 541519 and 541512 ($34.0 million) and under 541330 ($25.5 million).
4. SIC for a bank form: 7379.

Next step: compare the codes for the rest of IT on the NAICS code for IT consulting page.