CMMC Grants and Funding Assistance for Small Businesses: What Actually Exists in 2026

Which funding fits you — and which is a dead end

Before the detail, a fast filter:

• Use it now, no cost:Project Spectrum, your local APEX Accelerator, and — if you make things — your state’s Manufacturing Extension Partnership (MEP) center. These won’t pay your bill, but they’ll keep you from spending wrong.
• Real cash, but conditional: State manufacturing grants (often manufacturers only, often require you to apply before you sign a contract), and SBIR/STTR Technical and Business Assistance (awardees only).
• A cost lever, not a grant: FAR Part 31 cost treatment on contracts you win. Helpful, often misunderstood, never a guarantee.
• Watch, but do not plan around it: The proposed FY2027 federal CMMC grant. Not law yet.
• Not for you at all: The $1 billion State and Local Cybersecurity Grant Program. It funds governments, not contractors. More on that below, because competitors keep pointing people to it by mistake.

Are there CMMC grants for small businesses in 2026?

Yes, but narrower than most contractors hope. As of June 2026, there is no universal enacted federal grant that pays a small business’s full CMMC bill. The reliable help available right now is free advisory support, state and manufacturing cost-share programs, SBIR/STTR Technical and Business Assistance for eligible awardees, and contract-cost planning — plus a proposed federal grant moving through Congress for 2027.

Here’s the honest admission, early, because everything we tell you after it should be more believable for it: if you came hoping to download one federal “CMMC grant” application and have Washington cover the cost it just imposed on you, that application does not exist today. Plenty of small contractors think it should — that sentiment is all over the defense forums — and Congress is finally listening. But “should” and “did” are different words, and we’re not going to blur them.

What does exist is a stack. Four buckets:

1. Free federal help — orientation, a starting score, and referrals at no cost.
2. State and manufacturing assistance — the most direct cash, usually tied to your state and often to manufacturing.
3. SBIR/STTR Technical and Business Assistance (TABA) — real dollars, but only if you hold or pursue a small-business research award.
4. Contract-cost planning — recovering some cost through pricing on work you win, not a grant.

This page is for small DIB suppliers, manufacturers, machine shops, engineering and software firms, subcontractors, and nontraditional contractors trying to fund CMMC readiness or a Level 2 assessment without torching their margin.

This page is not foranyone looking for guaranteed certification, a grant-writing promise, a “best provider” ranking, or legal and accounting advice. For the last one, talk to a CMMC Registered Practitioner (RP/RPO) or a qualified federal-contracts attorney — the contract clause and your CUI handling set your level, not any checklist on the internet, including ours.

The proposed federal CMMC grant — what’s on the table, and why you can’t wait for it

The headline 2026 development: the Senate Armed Services Committee advanced a Fiscal Year 2027 National Defense Authorization Act (NDAA) provision that would create a grant program for small businesses and nontraditional contractors to cover CMMC Level 2 certification costs. Federal News Network reported the proposal would cap grants at $100,000 per company and total program funding at $50 million, limited to direct Level 2 third-party assessment costs. It is not law. If enacted, DoD would have until July 1, 2027 to stand it up.

That’s a real signal worth tracking. It tells you Congress sees the small-business cost problem clearly. But read the timeline against your own: Phase 2 enforcement begins November 10, 2026, and the proposed grant — if it survives the NDAA process and ifit’s funded — wouldn’t even have to exist until July 2027. For most companies staring at a near-term contract requirement, that’s too late to be a plan.

A note on a related rumor: you may also see references to a proposed 30% federal CMMC tax credit. As of June 2026, we could not confirm any such credit enacted into law. Treat it as unverified and do not build your budget around it.

What not to do:do not pause your scoping, your System Security Plan (SSP) and Plan of Action and Milestones (POA&M) work, your CUI environment decisions, or your free-resource checks while you wait on a bill. The contractors who get hurt are the ones who treat a proposal like a parachute.

The move:map your situation now, then layer in whatever funding lands later. If you don’t yet know your level, scope, and the provider category you’ll need, that’s the first dollar-saving decision — and it’s free.

The CMMC Funding Reality Matrix: active, free, state, awardee-only, proposed, and closed

The fastest way to stop wasting time is to separate funding by status. Below is our source-checked matrix of every path a small business is likely to hear about — what it is, whether it’s actual cash, who it can help, what it may cover, its status as of June 2026, and the catch nobody else lists. Verify any single row before you rely on it; grant availability changes faster than the regulations do.

We built this because the rest of the internet scatters it across a news story, a dozen state pages, a FAR commentary, and a Reddit thread — and half the lists still show closed programs as if they’re open. One table, dated, with the catch attached.

Use the CMMC Funding Stack Checker

Personalization beats a generic answer here. Answer a few quick questions — your state, business type, whether you’re a DoD prime or sub, whether you hold or pursue an SBIR/STTR award, your expected CMMC level, FCI-only or CUI, your assessment type, and your timeline — and you get your likely funding stack: the free resources to use first, the state programs worth checking, whether TABA applies, the contract-cost questions to ask, and the provider category to evaluate next.

Where to look first: the funding stack, in order

Start with the cheapest, lowest-risk help and work outward. Confirm what your contract actually requires, then use free resources before paid ones, then chase state and awardee-specific money, then ask the cost-recovery questions — and only then hire. Sequencing in this order is how small contractors avoid paying for the wrong scope.

Notice that “find a grant” isn’t step one. It’s step four, after you know what you’re actually buying.

How much of the CMMC bill can funding realistically cover?

Funding can cover a meaningful slice — gap assessment, remediation help, documentation, training, sometimes the assessment itself — but it rarely eliminates the full burden. DoD’s own rulemaking analysis (32 CFR Part 170) estimated a small entity’s Level 2 self-assessment and affirmation at roughly $34,277, and a small entity’s Level 2 C3PAO certification assessment and affirmation at roughly $101,752. Those are DoD’s assessment-and-affirmation estimates, not your total remediation or managed-compliance budget.

Two things to sit with there. First, the six-figure number is real and it’s the government’s own. Second — and this is the part that reframes the whole funding question — that estimate covers preparing for and completing the assessment, including working with an outside provider and paying the Certified Third-Party Assessment Organization (C3PAO). It does notcover building the cybersecurity program from scratch. DoD’s position is that the underlying security requirements have been contractually required since 2016; CMMC verifies them, it didn’t invent them.

What funding often covers:gap assessment, cybersecurity assessment, SSP and POA&M support, training, remediation planning, some tooling or infrastructure, and in some programs the assessment cost.

What funding usually doesn’t cover: ongoing managed services, every software subscription, a full environment rebuild, all of your internal labor, or future assessment cycles.

Why scope reduction often beats grant-chasing:for a lot of small companies, the biggest dollar savings don’t come from a grant at all. They come from shrinking what’s in scope — isolating CUI in a smaller enclave, or confirming you’re genuinely FCI-only and Level 1 before you overbuild for Level 2. We’ve watched companies spend hard for Level 2 readiness on a contract that only ever required Level 1. Get the scope right and you may not need as much funding in the first place. For the full cost picture, see our CMMC Level 2 cost guide.

Free CMMC help you should use before paying anyone

Free help won’t replace a full readiness engagement or a C3PAO assessment, but it can stop expensive early mistakes. Project Spectrum, APEX Accelerators, NIST MEP centers, and Small Business Development Centers can help you understand the requirement, get a starting score, and decide whether — and what kind of — paid help you actually need.

Project Spectrum.A DoD Office of Small Business Programs initiative, free to DIB contractors, and now backed by statute — the FY2026 NDAA (P.L. 119-60) directed DoD to stand it up as a platform of cybersecurity resources, training, and services for small and medium businesses. Its most useful piece for a small shop is the NIST SP 800-171 Cyber Readiness Check, a guided self-assessment that produces a Supplier Performance Risk System (SPRS) score so you can see, for free, roughly where you stand. (projectspectrum.io) It’s a starting picture, not a professional gap assessment — don’t confuse the two.

APEX Accelerators.Formerly the Procurement Technical Assistance Centers (PTACs), this is a DoD-funded network of roughly 95 centers across all 50 states and the territories, and their services are free. (apexaccelerators.us) An APEX counselor can help you figure out which level your contracts point to, walk you through SPRS, and refer you to RPOs and C3PAOs. They’re strongest at orientation and connections; technical depth on CMMC varies center to center, so treat them as your free front door.

NIST Manufacturing Extension Partnership (MEP). If you make things, MEP is often your best bridge between CMMC, a cybersecurity assessment, state funding, and a local implementation provider. MEP is federally funded and runs a center in every state. (nist.gov/mep) Your state center is also the fastest way to learn which state grants are currently open — see the next section.

SBDCs and agency resources.Small Business Development Centers (roughly 900+ nationwide, SBA-backed) can help with the business side — including how to think about CMMC as an allowable or indirect cost. The Department of the Air Force’s Blue Cyber initiative offers free small-business cybersecurity education as well. None of these is funding, so don’t let anyone frame them that way — but all of them are real help you’ve already paid for through your taxes.

The point of this section is simple: spend a week on free help before you spend a dollar on paid help. It’s the highest-ROI move on this page.

State CMMC grants and manufacturing programs: active, limited, and closed

State programs are where the most direct CMMC cash tends to live — but they change fast, frequently apply only to manufacturers or defense suppliers, and very often require you to apply before any work starts. Below are a strong active example, two to verify, and a closed-program watchlist so you don’t build a plan around money that’s already gone.

The one that quietly costs people money: apply before you sign

This is the trap we promised you in the intro. Many cost-share programs will not fund work you’ve already started. Connecticut’s program, for example, makes companies ineligible for funding on a project where they’ve already signed a proposal or put down a deposit. Read that twice, because it’s the most common way a small contractor leaves a grant on the table: they sign the readiness SOW first, then go looking for funding, and disqualify themselves. Check the program, apply, get your acknowledgment — then sign.

Active example worth modeling: Connecticut CAP

Connecticut’s Cybersecurity Adoption Program (CAP) is the clearest, best-documented active state program we verified (as of March 2026). It’s funded through the state’s Manufacturing Innovation Fund and administered by the Connecticut Center for Advanced Technology (CCAT), with CONNSTEP, the state’s MEP, supporting delivery. Eligible Connecticut manufacturers can apply for up to $35,000 in matching funds— the company pays half — toward cybersecurity assessment, remediation, training, SSP documentation, and CMMC Level 1/2 implementation, with a portion available for the initial assessment and the balance for remediation. Eligibility runs to manufacturers with a defined employee range and a majority of revenue from manufacturing, and you must engage a third-party vendor. (CONNSTEP / CCAT / manufacturing.ct.gov) Confirm current budget availability before you scope, because state rounds run until the money’s gone.

Verify before you rely: New York and Maryland

Other defense-heavy states run programs through their MEP centers, but availability and dollar amounts shift by round. New York’s MEP network (including FuzeHub and AIM) describes cybersecurity manufacturing initiatives on a selected-applicant model — treat it as “check the current round,” not guaranteed funding. (newyorkmep.org) Maryland’s MEP currently reports funding support for qualifying manufacturers; note that the older Defense Cyber Assistance Program funding, which came through the DoD Office of Local Defense Community Cooperation, expired in late 2022, so confirm what’s actually covered today. (mdmep.org) Several other states have programs too — confirm directly with your state’s MEP rather than trusting a third-party list, including this one.

The closed-program watchlist (don’t let anyone pitch these as live)

Outdated grant lists are everywhere, and a vendor quoting you “there’s a grant for that” may be working from a page that’s a year stale. As of June 2026, these are closed:

• Michigan Defense CyberSmart— ended and no longer accepting applications, per the University of Michigan’s Economic Growth Institute.
• Indiana / Purdue MEP CMMC Level 1 assistance — ran through August 2025 or until funds ran out; expired unless reauthorized.
• Massachusetts manufacturing cybersecurity round — the up-to-$30,000 round (deadline in mid-2025) is closed. (A separate, active Massachusetts grant funds security monitoring/MDR services — a different thing, covering a different slice.)

If someone tells you one of these will cover your costs, that’s your signal to verify everything else they’ve told you, too.

A last warning on state money: programs commonly require proof of manufacturing status, proof of your DoD supply-chain role, an approved vendor, and matching funds — and, again, application before a signed SOW. Get those boxes checked before you commit.

The $1 billion cybersecurity grant that is NOT for you

If your search turned up the State and Local Cybersecurity Grant Program (SLCGP), stop — it’s the single most common false lead in CMMC funding. SLCGP’s roughly $1 billion is for state, local, tribal, and territorial governments, with local and tribal governments eligible only as subrecipients. A private defense contractor cannot apply for it to pay for CMMC.

We’re flagging this hard because we keep seeing it pointed at contractors by mistake — including by pages that should know better. The program is run jointly by the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Emergency Management Agency (FEMA), and per CISA, the only eligible applicants are state and territory administrative agencies; the money is for protecting government-owned information systems. (cisa.gov; fema.gov) The only way it touches you is if you happen to sell services toa government recipient — not by receiving a grant yourself. If a list told you this $1 billion is available for your company’s CMMC costs, it’s wrong, and that’s a useful tell about the rest of the list.

Can SBIR/STTR TABA help pay for CMMC?

If you hold or are pursuing a Small Business Innovation Research (SBIR) or Small Business Technology Transfer (STTR) award, Technical and Business Assistance (TABA) may be one of your most useful funding-adjacent paths, because current policy allows cybersecurity assistance as a supported activity. It’s not a general CMMC grant for every contractor, and the rules are agency-specific, but eligible companies should check it before treating CMMC as entirely out-of-pocket.

TABA lets SBIR/STTR awardees use a defined amount of funding for technical and business help on top of their research award. The commonly cited caps are up to $6,500 in Phase I and up to $50,000 in Phase II, subject to the rules of the specific agency funding your award — and recent policy guidance explicitly includes cybersecurity assistance among supported activities. (SBA SBIR policy; NIH notice NOT-OD-26-075) It won’t cover a full Level 2 program, but for a research-stage company facing CMMC scope questions, it’s real money you may already be entitled to.

If you’re an SBIR/STTR company, the eligibility and agency-by-agency mechanics deserve more room than this page can give. We cover the deep version on our CMMC compliance guide for SBIR companies — start with your award phase, your funding agency, your CUI scope, and your timeline.

Can you recover CMMC costs through your contracts instead of grants?

Possibly — but this is a contracts and cost-accounting question, not a grant, and definitely not a guarantee. Under the Federal Acquisition Regulation (FAR), whether a cost is allowable turns on reasonableness, allocability, the contract’s terms, and applicable cost-principle limits (FAR 31.201-2), and a cost is “allocable” only when it has a defined relationship to a contract or to your business operations (FAR 31.201-4). DoD has stated that costs to implement CMMC, support the assessment, and contract with a C3PAO are an allowed cost — but “allowable” is not the same as a check in the mail.

This is where we part ways with the more aggressive funding pages, which wave at FAR Part 31 as if it reimburses CMMC. It doesn’t work like that. Here’s the regulation-stated picture versus the operational reality:

Questions to bring to a contracts or cost-accounting advisor before you assume recovery: Is this a direct or an indirect cost for us? Which of our contracts are cost-reimbursable or otherwise flexibly priced? What documentation must we keep? What do the contract terms actually say? Does this cost benefit one contract or the business broadly? And have we already received state or federal funding that changes the treatment? Get those answered by someone who can see your books — not by a blog, including this one.

What should different small businesses do next?

Your best next move depends on your business type. A manufacturer should usually check MEP and state manufacturing programs early; a software firm should focus first on CUI scope, environment, and enclave strategy; a subcontractor should confirm flow-down before assuming Level 2 C3PAO applies. Funding doesn’t change those priorities — it follows them.

• Small manufacturer or machine shop. Your MEP center first; state manufacturing funding second; scope and provider category third. Pay special attention to where drawings and other CUI flow on your shop floor and into any operational-technology systems, and to what your primes are flowing down.
• Software, SaaS, or engineering firm. Lead with CUI scope and your cloud environment. The biggest lever here is often a CUI enclave or a Government Community Cloud strategy, plus the right GRC platform and managed-security support — not a grant.
• Aerospace or defense supplier. Confirm CUI flow, shop-floor and OT boundaries, and prime flow-down requirements, then check state manufacturing grants.
• SBIR/STTR company.Check TABA and your funding agency’s specific rules before anything else. See our CMMC SBIR guide.
• FCI-only contractor.Do not overbuy Level 2 help if your contract and information type only support Level 1’s 15 basic safeguarding requirements. This is one of the most common ways small contractors overspend.

If you get funding, what provider category should you hire?

Funding tells you what you can afford; it doesn’t tell you who to hire. Your scope and assessment type do that. Readiness and remediation usually point to an RPO/RP, an MSP/MSSP, a GRC platform, or a CUI enclave provider; a C3PAO is for the formal assessment, only when you’re assessment-ready and the contract requires it. And per the Cyber AB, the organization that helps you implement cannot also be the one that assesses that same work — readiness and formal assessment must stay separate.

• RPO / RP (Registered Provider Organization / Registered Practitioner). Readiness, gap identification, SSP and POA&M work, and implementation advice. Where most small contractors should start.
• MSP / MSSP (Managed Security Service Provider). Ongoing IT and security operations and a managed compliance environment — including Government Community Cloud and enclave operations.
• GRC platform.Evidence management, SSP/POA&M workflow, and assessment prep. A supporting layer, not the whole CMMC solution — software alone does not make you compliant.
• CUI enclave. Scope reduction and secure collaboration, where isolating CUI is smarter than securing your whole environment. See our enclave cost guide.
• C3PAO.The formal Level 2 certification assessment — and only when you’re genuinely ready and your contract requires third-party assessment. Don’t pay for an assessment you’ll fail; remediate first.

Using a grant to hire the wrong category is one of the fastest ways to waste it. That’s the entire reason we route to a category before a vendor.

What to gather before you apply for CMMC funding

Funding conversations move faster when you can show what’s driving CMMC and what work you’re trying to fund. Pull together the requirement documents, your eligibility documents, and your technical planning documents — but never upload CUI, drawings, or sensitive contract details into a public grant or quote form.

• Requirement documents: the solicitation or prime flow-down, the CMMC level language, and the relevant DFARS clauses (252.204-7012, -7019, -7020, -7021, -7025).
• Eligibility documents: your state, NAICS code, employee count, manufacturing status, prime/subcontractor status, and any SBIR/STTR status.
• Technical planning documents:a scope diagram, a CUI data-flow map, your draft SSP and POA&M, any gap assessment, and your vendor quotes.
• The safety line, again: do not submit CUI, drawings, export-controlled data, or sensitive contract details into generic grant, quote, or matching forms — including ours.

Use the CMMC Readiness Checklist to make sure you have the right artifacts in hand before you apply.

The CMMC funding mistakes that waste the most money

The most expensive mistake is treating “find a grant” as step one. Contractors burn money chasing closed programs, signing SOWs before checking grant rules, hiring a C3PAO before they’re ready, overbuilding for Level 2 when scope is unclear, and assuming FAR cost principles guarantee reimbursement.

1. Working from outdated grant lists. Michigan, Indiana/Purdue, and the Massachusetts manufacturing round are closed. If a list shows them as open, distrust the list.
2. Signing the SOW before checking the rules. Many cost-share programs require application before work begins. Sign first and you may disqualify yourself.
3. Hiring assessment before readiness. A C3PAO assessment is verification, not remediation. Walking in unprepared means a failed assessment and a months-long wait to try again.
4. Confusing NIST SP 800-171 Revision 3 with current CMMC Level 2. CMMC Level 2 maps to NIST SP 800-171 Revision 2— its 110 requirements across 14 families — unless and until DoD amends the rule. Building to Rev. 3 because it’s newer can mean building to the wrong target.
5. Submitting CUI in a form.Don’t. Not in a grant application, not in a quote request, not anywhere it isn’t protected.

What we verified for this guide

We built this from primary and authoritative sources, and we’re telling you what we couldn’t confirm. Regulatory facts come from the CMMC Program Rule and the DFARS rule themselves; program facts come from official DoD, CISA/FEMA, and program pages; the proposed federal grant comes from Senate FY2027 NDAA materials and trade reporting, clearly labeled as proposed. We re-verify funding details monthly, because grant availability changes faster than the regulations.

• Regulatory sources read: the CMMC Program Rule (32 CFR Part 170; Federal Register, effective December 16, 2024); the DFARS rule (Federal Register, effective November 10, 2025) and clauses 252.204-7012/-7019/-7020/-7021/-7025; NIST SP 800-171 Revision 2; NIST SP 800-172 (for Level 3); and the DoD CIO and acquisition CMMC pages. Phase 1 runs November 10, 2025 through November 9, 2026; Phase 2 enforcement begins November 10, 2026.
• Funding sources checked (June 2026): Project Spectrum, APEX Accelerators, NIST MEP, Connecticut CAP (CCAT/CONNSTEP), New York and Maryland MEP, SBA SBIR/STTR TABA policy, CISA/FEMA on SLCGP, FAR 31.201-2 and 31.201-4, the Cyber AB on consulting/implementation roles and assessor independence, and the closed Michigan, Indiana/Purdue, and Massachusetts programs.
• The proposed federal grant: Senate Armed Services Committee FY2027 NDAA materials and Federal News Network reporting (June 2026). Labeled proposed, not enacted.
• What we could not verify:any enacted federal CMMC tax credit (treat as unconfirmed); exact current dollar amounts and open/closed status for every state program (these move — confirm with your state directly); and any single-source state claim, which we softened to “verify directly.” We do not verify every local grant in all 50 states; we identify the strongest source-checked paths and tell you how to confirm yours.

FAQ: CMMC grants and funding assistance for small businesses

Is there a federal CMMC grant for small businesses?

Not as a broadly available, enacted program as of June 2026. A federal CMMC grant is proposedin the Senate’s FY2027 NDAA — reported at up to $100,000 per company and $50 million total, for Level 2 assessment costs — but it is not law. Today’s reliable help is free DoD resources, state and manufacturing programs, SBIR/STTR TABA for awardees, and contract-cost planning.

What is the proposed Senate CMMC grant?

A Fiscal Year 2027 NDAA provision, advanced by the Senate Armed Services Committee, that would create a grant program for small businesses and nontraditional contractors to cover CMMC Level 2 certification costs. Federal News Network reported caps of $100,000 per grant and $50 million total, limited to direct Level 2 third-party assessment costs, with DoD required to stand it up by July 1, 2027 if enacted.

Is Project Spectrum free?

Yes. Project Spectrum is a DoD Office of Small Business Programs resource — codified in the FY2026 NDAA — offering free CMMC Level 1 and Level 2 courses, a NIST SP 800-171 cyber readiness check that generates an SPRS score, and advisor support for small and medium businesses. It is not a substitute for a professional gap assessment or a C3PAO assessment.

Are state CMMC grants real?

Yes, but they’re state-specific and often limited to manufacturers. Connecticut’s CAP (up to $35,000 in matching funds) is a strong, source-checked active example as of March 2026. Several once-popular programs — Michigan, Indiana/Purdue, and the Massachusetts manufacturing round — are now closed, so verify current availability before you rely on any of them.

Can CMMC grants pay for a C3PAO assessment?

Some programs and the proposed federal grant focus on assessment costs, while many current state and manufacturing programs focus on readiness, remediation, training, documentation, or implementation. Always confirm what a specific program covers before you schedule an assessment.

Can SBIR/STTR TABA pay for CMMC?

It may support cybersecurity assistance for eligible SBIR/STTR awardees, subject to agency rules — commonly up to $6,500 in Phase I and $50,000 in Phase II. It’s awardee-specific, not a general CMMC grant.

Can I recover CMMC costs through my contracts?

Possibly, depending on contract type, reasonableness, allocability, contract terms, and your cost-accounting treatment (FAR 31.201-2 and 31.201-4). DoD treats CMMC implementation, assessment support, and the C3PAO fee as an allowed cost, but FAR Part 31 is not a grant and not a guarantee of reimbursement. Talk to a contracts or cost-accounting advisor.

Can I use the State and Local Cybersecurity Grant Program for CMMC?

No. The roughly $1 billion SLCGP funds state, local, tribal, and territorial governments, not private contractors. CISA confirms that only state and territory administrative agencies are eligible applicants.

Should I hire a C3PAO first if I find funding?

Usually not, unless you’re already assessment-ready. Use readiness and provider-category logic first — most small contractors should start with an RPO/RP, MSP/MSSP, GRC platform, or CUI enclave — and bring in a C3PAO for the formal assessment when you’re ready and the contract requires it.

What if my state’s CMMC grant is closed?

Check Project Spectrum, your APEX Accelerator, your MEP center, SBIR/STTR TABA if you’re an awardee, and the contract-cost questions above — and look hard at scope reduction before assuming the full cost is unavoidable.

Sources

• CMMC Program Rule — 32 CFR Part 170 (Federal Register, Oct 15, 2024; effective Dec 16, 2024); eCFR Title 32, Part 170
• DFARS final rule (Federal Register, Sep 10, 2025; effective Nov 10, 2025); DFARS 252.204-7012/-7019/-7020/-7021/-7025 (Acquisition.gov)
• NIST SP 800-171 Revision 2; NIST SP 800-172 (NIST CSRC)
• DoD CIO — About CMMC; DoD CMMC 2.0 resources (business.defense.gov); DoD CMMC FAQ
• FAR 31.201-2 (Determining allowability) and FAR 31.201-4 (Determining allocability) — Acquisition.gov
• Project Spectrum (projectspectrum.io); FY2026 NDAA (P.L. 119-60)
• APEX Accelerators (apexaccelerators.us)
• NIST Manufacturing Extension Partnership (nist.gov/mep)
• SBA SBIR/STTR policy (sbir.gov); NIH Notice NOT-OD-26-075 (TABA)
• CISA — State and Local Cybersecurity Grant Program; FEMA — SLCGP
• Connecticut CAP — CONNSTEP; CCAT; Connecticut Manufacturing Innovation Fund
• Maryland MEP; New York MEP (FuzeHub/AIM)
• University of Michigan Economic Growth Institute (Michigan Defense CyberSmart — closed); Purdue MEP (CMMC Level 1 funding — expired); MassTech CAM (Massachusetts manufacturing cybersecurity round — closed)
• Senate Armed Services Committee FY2027 NDAA materials; Federal News Network, “Senate NDAA proposes CMMC grant program” (June 2026)