The defense contracting landscape is about to undergo a significant transformation with the implementation of new cybersecurity requirements. These requirements are estimated to have an impact on 220,000 large and small prime contractors and subcontractors as outlined in the CMCC Program Final Rule. These new CMMC cybersecurity requirements will hit small defense contractors especially hard, as they must pay for expensive third-party assessments and remediation – costs that larger contractors can more easily absorb.
Small Business Cybersecurity Act Details
To prevent the Cybersecurity Maturity Model Certification (CMMC) program from becoming a barrier to entry for smaller defense suppliers, Congress and small business advocates are working on solutions as highlighted by Air & Space Forces Magazine. The proposed Small Business Cybersecurity Act of 2024, introduced by Rep. Scott Fitzgerald (R-Wis.), offers a tax credit of up to $50,000 for companies with fewer than 50 employees to offset CMMC compliance costs. This credit would cover expenses related to assessments and remediation of cybersecurity gaps, providing crucial financial relief for small businesses struggling to meet these new requirements.
The timing is critical, as the Department of Defense plans to begin including CMMC requirements in contracts next year. The Pentagon estimates that achieving level two CMMC certification could cost approximately $101,000 – a substantial burden for smaller contractors. This financial hurdle becomes particularly significant considering that manufacturing companies with even fewer staff members (20 employees) make up 70% of the Defense Industrial Base according to a 2023 release by the Department of Defense.
The proposed legislation addresses these concerns through several mechanisms. Beyond the direct tax credit, the bill would require the Small Business Administration to provide technical assistance and guidance to small businesses navigating the CMMC certification process. This support structure could prove invaluable for companies with limited internal IT expertise or resources to dedicate to cybersecurity compliance. Industry experts have noted that the $50,000 tax credit, while significant, may still leave some businesses with substantial out-of-pocket expenses. However, the credit could make the difference between maintaining or abandoning defense contracts for many small suppliers.
The True Cost of Losing Small Defense Contractors
The impact of fewer small contractors cannot be underestimated. It could lead to reduced competition and innovation which, in turn, could potentially result in higher costs for the Department of Defense – and American taxpayers. Further, the defense industrial base’s diversity and resilience could be compromised if smaller suppliers cannot afford to maintain their certification status and, as highlighted by the Society of American Military Engineers. These new requirements could make a long-running problem even worse – fewer businesses signing up to be defense contractors – continuing a decline that has lasted for decades.
While the Small Business Cybersecurity Act is unlikely to be included in this year’s National Defense Authorization Act, Federal News Network suggests it could feature in tax cut extension discussions expected next year. This legislation represents a crucial first step in balancing national security requirements with the practical needs of small defense contracting businesses. As these cybersecurity requirements roll out, the success of measures like the Small Business Cybersecurity Act will be vital in maintaining a diverse, competitive, and secure defense contracting ecosystem.
The coming months will be critical for small defense contractors as they prepare for the new CMCC requirements. Industry associations and advocacy groups are actively working to ensure their members’ voices are heard as implementation details are finalized. The ultimate success of the CMMC program will depend largely on finding the right balance between securing the defense supply chain and maintaining the vital participation of small defense contractors that have historically been essential to American military readiness and innovation.
Contact CyberShield Alliance today to schedule a consultation and ensure your business is prepared for the upcoming CMMC requirements.