Looking for CMMC Grants? Read This First

If you typed "CMMC grants" into a search bar this month, you're in good company. It's one of the most common questions we hear in exploratory calls with Wichita-area suppliers, and the honest answer is short. There is no federal grant program that pays for CMMC compliance today. There's no CMMC loan program and no CMMC tax credit either. Several have been proposed. None has passed.

The search for money usually hides a better question. The suppliers we see spending the most in prospect assessments aren't the ones who couldn't find a grant. They're the ones who bought tools and enclaves before they knew where their CUI actually lived. Scope sets the bill, and financing only decides who carries it. So this piece covers both: the funding that exists today, and how to keep the bill from growing past what the work requires.

Here's the straight read on both.

What funding actually exists

The closest thing to a real CMMC grant is a provision in the Senate's FY2027 defense authorization bill, S. 4784. Section 1626 would direct DoD to stand up a grant program for small businesses and new entrants, capped at $100,000 per award and $50 million in total, with a July 1, 2027 deadline to establish it. Read the fine print. It would pay for the third-party Level 2 assessment only, not the work it takes to pass one. The House passed its own defense bill on July 22 with no matching grant. The Senate bill cleared committee but stalled on the floor after a July 14 procedural vote failed 50 to 46, and it has been pushed to the post-election session. Nothing has been enacted or funded. Watch it. Don't budget against it.

If it does pass, not everyone qualifies. The Senate language limits awards to SBA small businesses or nontraditional defense contractors that already hold, or are actively pursuing, a DoD contract or subcontract that requires Level 2 C3PAO certification. You can't already hold a third-party certification at that level. Companies that have never held a DoD contract get priority, but existing contractors aren't shut out. Recipients have to show a good-faith effort to reach certification within a year. That's effort, not a guarantee you pass.

The money is narrow. It covers the C3PAO Level 2 certification assessment and, subject to the program rules, assessment charges tied directly to that certified assessor. It does not cover readiness consulting, gap analysis or remediation, writing your System Security Plan and policies, new servers, firewalls or security tools, Microsoft 365 GCC High or licensing, ongoing managed IT, or Level 1 self-assessments. This is a check written to the assessor, not a general cybersecurity improvement grant.

The $100,000 number is doing a lot of work too. DoD's own 2024 regulatory cost model put a small business's Level 2 assessment and first affirmation at $101,752, a $31,234 C3PAO assessment fee plus $70,518 in assessment support and participation. That's a regulatory estimate, not a vendor quote or a promise of what you would get. The $50 million is a ceiling, not money sitting in an account. At $100,000 each it would reach about 500 businesses nationwide, more if the awards run smaller.

Three things still have to break the right way. The Senate has to pass its bill. The House version has no grant and instead tells DoD to study lowering CMMC costs and improving assessor capacity, so the grant could be reshaped or dropped in conference. And the grant is tied to a certification requirement that DoD just suspended, which Congress and DoD would have to square first. If you are already a client and eventually need certification, a grant like this could offset the independent assessment and free up cash for the compliance work. It would not pay for that work, or for us. We're an RPO, not a C3PAO.

Here's the bottom line on grants. Congress is talking about helping companies pay for the certification assessment, not the cybersecurity work it takes to pass it. Keep your readiness and managed IT budget where it is. Don't build it around a grant that doesn't exist yet.

A 30 percent tax credit for cybersecurity spending at companies under 50 employees has been floated in Congress and has drawn public support from DoD leadership. It hasn't been enacted. Same advice.

Everything above is still just proposed, and none of it can help you this quarter. What can help you already exists, and it is less exciting only because it is real. Direct CMMC grant money isn't available today, but other assistance is. APEX Accelerators (the old PTACs) are DoD-funded and free. Kansas has one, and its counselors will walk a supplier through Level 1 and the front end of Level 2 at no charge. The NIST Manufacturing Extension Partnership network cost-shares readiness projects for small manufacturers, and Kansas Manufacturing Solutions is the Kansas center. Project Spectrum, run by the Defense Department's Office of Small Business Programs, is free too. It offers CMMC training courses and a NIST 800-171 readiness self-check so you can see where you stand. None of it is grant money, and the self-check doesn't replace a formal assessment. It just gets you ready for one. You will also see "in-kind gap assessment grants." Those aren't grant money either. They're vendors or RPOs offering a free or discounted gap assessment to win your paid engagement. The assessment can be useful, but no cash changes hands, so don't budget around it as funding. Your prime may also have supplier development resources it hasn't advertised. Ask.

On the tax side, compliance spending is generally deductible as an ordinary business expense, and hardware may qualify for accelerated depreciation under Section 179. Confirm both with your CPA. None of that is a program, just how the code already works, but it does change the after-tax number.

Loans are the same story. Nothing CMMC-specific. A standard SBA 7(a) loan can cover eligible working capital and equipment for a compliance project the same way it covers a new CNC machine. SBA 504 loans are limited to fixed assets like equipment and real estate, so they can't finance working capital, consulting or labor. Match the loan to the cost.

The pause changes timing, not the requirement

The same cost pressure that put those grant bills in front of Congress is what stalled the rollout. On July 13, 2026, the Department of War suspended the transition to CMMC Phase 2, which would have started putting third-party Level 2 assessment requirements into contracts on November 10, 2026. A September 3 class deviation made the suspension binding on contracting officers. The stated reason was cost and assessor capacity. In its own filings the SBA Office of Advocacy estimated the total cost of compliance near $593,800 for a company pursuing third-party certification and near $388,600 for one relying on self-assessment. Those are full compliance estimates, not assessment fees. It counted roughly 100 approved assessors against more than 120,000 small DIB businesses (Secureframe CMMC news tracker, September 2026). As of October 20, 2026, DoD has not announced a replacement Phase 2 date.

Two things follow from that. First, the money question is being taken seriously in Washington precisely because the numbers are that large, which is why the grant bills exist. Second, nothing underneath Phase 2 moved. DFARS 252.204-7012, NIST SP 800-171, your SPRS score, the Level 1 and Level 2 self-assessments, and the annual affirmation your company signs are all still in force. An inaccurate affirmation still carries False Claims Act exposure, and on September 1 the Justice Department announced a $2 million settlement with a large aerospace contractor over alleged 800-171 shortfalls from 2020 to 2023, before any CMMC assessment requirement existed in contracts (Secureframe, September 2026).

So the pause buys time. It doesn't buy relief. Use the time to scope correctly instead of sprinting toward a date that no longer exists.

Where the money actually goes

Three scoping decisions set the size of a CMMC project, and in the assessments we run they get made by default far more often than on purpose. Level, boundary, and stack. Each one moves the number more than any grant on the table.

The first is level. A surprising share of suppliers assume they need Level 2 because a prime mentioned CMMC, when the data they actually receive is Federal Contract Information and Level 1 is the requirement. Level 1 is 15 practices and a self-assessment, while Level 2 runs to 110 controls. Confirm what you handle before you buy anything, and get it in writing from the prime if the contract language is vague.

The second is boundary. If CUI touches every workstation, every file share and every email account in the building, all of it is in scope and all of it has to meet 110 controls. If CUI lives in a segmented enclave that a handful of people access, the assessment boundary shrinks to that enclave, and so does the bill. We find, more often than we'd like to, that a supplier has already paid to bring the whole network up to Level 2 when a third of it never needed to be there. One caution. An enclave doesn't make everything outside it vanish from the assessment. The security tools that protect the enclave and certain external service providers stay in scope, so the boundary has to be drawn to the scoping rules, not just drawn small.

The third is stack. Buying a separate product for every control family produces a pile of overlapping licenses and a documentation burden that outlives the project. A smaller set of platforms, chosen to cover as many control families as they reasonably can, keeps that burden down. Software alone won't get you there. CMMC has operational and administrative requirements sitting next to the technical ones, so tools handle part of the picture and people and process handle the rest. CMMC also doesn't require that your documentation and your IT operations come from the same company. But putting them together helps. It cuts duplicated effort, keeps the System Security Plan matching how the systems actually run, and makes continuous compliance easier to hold. When the SSP and the live network are maintained by different hands, they drift, and the drift is what an assessor finds.

We build PCs and servers on our own line and have lived inside the DFARS flowdown as a manufacturer, which is part of why we push the boundary conversation before the product conversation. Segmentation and hardware placement are cheaper to get right on paper than to re-do after the enclave is built.

What to do this quarter

Start with your level. Confirm whether you handle FCI or CUI and what your contracts actually require, and get it from your prime in writing. Next, map where CUI enters, moves and sits, and which systems and people touch it, so you know what a boundary would have to contain. Then look at the assistance that exists and work out what technical work you actually need. The Kansas APEX Accelerator and Kansas Manufacturing Solutions can help with readiness at little or no cost, and they're worth a call. Keep your SPRS score honest and your affirmation current the whole way through. Government assessment and enforcement are still on the table even with Phase 2 paused, and you're the one signing that affirmation.

The next step is to have someone who knows the framework look at your scope before you spend on tools or a full 110-control build. That's the conversation we'd rather have first. Our CMMC readiness work is bundled with Managed IT because running the environment and owning the documentation together keeps the two in sync, and the first call is about whether your scope, your contract and your timing make that worth doing at all. If they don't, we'll say so.

Book a 30-minute exploratory call. Bring your contract clauses and a rough idea of where CUI lands. We can't define your full scope without seeing your environment, but we can point to the requirements you're likely facing, where the savings probably sit, and what needs a closer look before anyone talks about buying anything.

FAQ

Is there a federal grant for CMMC compliance?

Not today. The Senate FY2027 NDAA includes a proposed grant program that would cover the third-party Level 2 assessment for small businesses, capped at $100,000 per award and $50 million in total. It pays for the certification assessment, not the work to pass it. The bill is stalled, and even if enacted the legislation directs DoD to establish the program by July 1, 2027, so it is not money you can count on this quarter.

Are CMMC costs tax deductible?

Compliance spending is generally deductible as an ordinary business expense, and qualifying hardware may be eligible for Section 179 accelerated depreciation. Confirm treatment with your CPA. No CMMC-specific tax credit has been enacted.

Does the Phase 2 pause mean I can stop working on CMMC?

No. The pause suspended the new third-party Level 2 assessment requirement, not your existing contractual obligations. DFARS 252.204-7012, NIST SP 800-171, SPRS scoring and the annual self-assessment affirmation all remain in force, and an inaccurate affirmation carries False Claims Act exposure.

What free help is available in Kansas?

The Kansas APEX Accelerator offers free one-on-one counseling for DoD contractors. Kansas Manufacturing Solutions, the state's NIST MEP center, cost-shares some readiness projects for eligible small manufacturers. Project Spectrum, run by the Defense Department's Office of Small Business Programs, offers free CMMC training and a NIST 800-171 readiness self-check online. It is not a grant. Availability and eligibility vary, so confirm what you qualify for.

What cuts CMMC cost the most?

Confirming the correct level, shrinking the CUI boundary to a segmented enclave, and consolidating the tool stack. Scope has to be reduced within CMMC's scoping rules, so an enclave still has to account for the assets that protect it, but done correctly these decisions move the total more than any grant or credit currently proposed.