CMMC for small defense contractors
CMMC help where you are, with a route to paid or no-cost support.
CMMC requirements are now showing up in Department of Defense contracts. Pick your state to see its defense contracting base and the public programs that serve it, then tell us what you need. Paid requests go to Capital Cyber. No-cost requests from small businesses go to Cyber Grants Alliance, a nonprofit, as in-kind support.
We work with defense contractors of every size, in all 50 states. If your state is not listed below, use the form anyway.
Four highlighters. Each means one thing.
How to read this siteSourced
A fact with a footnote. Every figure on a state page carries one, and the source link sits beside it.
Level 1
Federal Contract Information. The 15 basic safeguarding requirements in FAR 52.204-21, as an annual self-assessment.
Level 2
Controlled Unclassified Information. The 110 requirements of NIST SP 800-171 Rev 2.
In-kind grants
In-kind support through Cyber Grants Alliance, a nonprofit, for eligible small businesses. No cost to you.
Choose your state
12 state guides · we work in all 50- VirginiaVirginia APEX AcceleratorOpen the Virginia page
- MarylandMaryland APEX AcceleratorOpen the Maryland page
- TexasCross Timbers APEX AcceleratorOpen the Texas page
- CaliforniaSan Diego, Orange, Imperial APEX AcceleratorOpen the California page
- FloridaFlorida APEX AcceleratorOpen the Florida page
- PennsylvaniaSoutheast PA APEX AcceleratorOpen the Pennsylvania page
- OhioOhio APEX Accelerator ProgramOpen the Ohio page
- GeorgiaGeorgia Tech APEX AcceleratorOpen the Georgia page
- North CarolinaSouth Carolina APEX AcceleratorOpen the North Carolina page
- AlabamaAlabama APEX Accelerator (APEX Alabama)Open the Alabama page
- ColoradoColorado APEX AcceleratorOpen the Colorado page
- ArizonaArizona APEX AcceleratorOpen the Arizona page
Where CMMC stands
Sourced- The CMMC program rule, 32 CFR Part 170, took effect on December 16, 2024.
- The DFARS rule that puts CMMC into contracts took effect on November 10, 2025, which started Phase 1 of the rollout.
- Level 1 covers the 15 basic safeguarding requirements in FAR 52.204-21 and is an annual self-assessment. Level 2 covers the 110 requirements of NIST SP 800-171 Rev 2.
- On July 13, 2026 the Department of War suspended Phase 2, which was set to add third-party Level 2 assessments on November 10, 2026, pending a review. Self-assessments, SPRS, the annual affirmation and DFARS 252.204-7012 still apply.
Which level is yours
If you handle Federal Contract Information, you are looking at Level 1. If you handle Controlled Unclassified Information, you are looking at Level 2. Your contract and the data you receive decide which, not the size of your company.
One form. Your first answer decides where it goes.
Three stepsPick the kind of help
Choose CMMC help for your company if you want a firm to do the work with you. Choose in-kind grants if you are a small business looking for no-cost support.
Paid requests go to Capital Cyber
A CMMC and cybersecurity firm in Ashburn, Virginia. It scopes where your Controlled Unclassified Information or Federal Contract Information lives, runs a gap assessment against the level your contracts call for, and builds a plan to close the gaps.
No-cost requests go to Cyber Grants Alliance
A nonprofit that provides in-kind cybersecurity support to eligible small businesses, at no cost to you. It reviews each request and replies about fit.
Iron Lift
Iron Lift is a construction company in Massachusetts and a small supplier carrying the same 110 controls a large prime carries. Capital Cyber wrote their System Security Plan and ran evidence collection.
Certified ourselves
SMB1001:2026 · GOLDCapital Cyber holds CyberCert SMB1001:2026 Gold, Level 3, issued by CyberCert under Dynamic Standards International. The certificate holder is Telco D1 LLC, trading as Capital Cyber.