CMMC for small defense contractors
CMMC help where you are, with a route to paid or no-cost support.
CMMC requirements are now showing up in Department of Defense contracts. Pick your state to see its defense contracting base and the public programs that serve it, then tell us what you need. Paid requests go to Capital Cyber. No-cost requests from small businesses go to Cyber Grants Alliance, a nonprofit, as in-kind support.
Choose your state
12 states- VirginiaVirginia APEX Accelerator
- MarylandMaryland APEX Accelerator
- TexasCross Timbers APEX Accelerator
- CaliforniaSan Diego, Orange, Imperial APEX Accelerator
- FloridaFlorida APEX Accelerator
- PennsylvaniaSoutheast PA APEX Accelerator
- OhioOhio APEX Accelerator Program
- GeorgiaGeorgia Tech APEX Accelerator
- North CarolinaSouth Carolina APEX Accelerator
- AlabamaAlabama APEX Accelerator (APEX Alabama)
- ColoradoColorado APEX Accelerator
- ArizonaArizona APEX Accelerator
Where CMMC stands
Sourced- The CMMC program rule, 32 CFR Part 170, took effect on December 16, 2024.Source: federalregister.gov
- The DFARS rule that puts CMMC into contracts took effect on November 10, 2025, which started Phase 1 of the rollout.Source: federalregister.gov
- Level 1 covers the 15 basic safeguarding requirements in FAR 52.204-21 and is an annual self-assessment. Level 2 covers the 110 requirements of NIST SP 800-171 Rev 2. Phase 2, which adds third-party Level 2 assessments to applicable contracts, starts one year after Phase 1.Source: ecfr.gov
If you handle Federal Contract Information, you are looking at Level 1. If you handle Controlled Unclassified Information, you are looking at Level 2. Your contract and the data you receive decide which, not the size of your company.
Case study: Iron Lift
CMMC Level 2Iron Lift is a construction company in Massachusetts and a small supplier carrying the same 110 controls a large prime carries. Capital Cyber wrote their System Security Plan and ran evidence collection.
Certified ourselves
SMB1001:2026 · GOLDCapital Cyber holds CyberCert SMB1001:2026 Gold, Level 3, issued by CyberCert under Dynamic Standards International. The certificate holder is Telco D1 LLC, trading as Capital Cyber.