Two Things That Changed in the Last 60 Days
**November 10, 2025:** CMMC enforcement began. Phase 1 is live. If you handle Controlled Unclassified Information (CUI) and don't have cybersecurity certification, the clock started. **December 18, 2025:** President Trump signed the FY2026 NDAA. Section 1826 exempts all small businesses from Cost Accounting Standards, FAR Part 31 cost principles, and certified cost data requirements. This is the biggest regulatory relief for small defense contractors in decades. These aren't future possibilities. They're current law affecting contracts being awarded right now.
The CMMC Reality: You Have Until November 2026
The Cybersecurity Maturity Model Certification (CMMC) is no longer theoretical. Here's what's actually happening: **Phase 1 (November 10, 2025 – November 10, 2026):** Self-assessments for select contracts. DoD can include CMMC Level 1 or Level 2 requirements at their discretion. You can still bid, but you need a self-assessment score in SPRS. **Phase 2 (November 10, 2026 – November 10, 2027):** Third-party certification required for Level 2 contracts. This is when it gets real. **Phase 3 (November 10, 2027 onward):** Level 2 third-party assessments become standard. Level 3 requirements appear for sensitive programs. **October 31, 2026:** By this date, every new DoD contract involving CUI will list CMMC requirements. No certification = no bid. **Current Certification Status:** - 337,968 Defense Industrial Base contractors are affected - 229,818 of those (68%) are small businesses - 80,000 contractors need CMMC Level 2 certification - 200 have completed third-party assessments so far Do the math: 80,000 contractors need certification. 200 have it. Assessment wait times are already 3-6 months. If you're not actively working on CMMC today, you're choosing to exit defense contracting by late 2026. **What CMMC Levels Actually Mean:** **Level 1:** Federal Contract Information (FCI). 17 basic practices. Annual self-assessment posted to SPRS. Most commercial-adjacent contracts. **Level 2:** Controlled Unclassified Information (CUI). All 110 NIST SP 800-171 practices. Third-party assessment required for most contracts involving CUI. This is where 80,000 contractors need to be. **Level 3:** Advanced Persistent Threats. 110+ practices including NIST 800-172. Government assessment by DIBCAC. Reserved for the most sensitive programs.
🔍 Search related opportunities now
NDAA 2026: Regulatory Relief for Small Business
Section 1826 of the FY2026 NDAA creates sweeping regulatory relief. If you haven't held a full Cost Accounting Standards (CAS) covered contract in the prior year, which includes all small businesses, you're now exempt from: - Certified cost or pricing data requirements - FAR Part 31 cost principles - Certain business system compliance requirements - Automatic flow-down of defense-specific rules from prime contractors **Translation:** The compliance burden that kept many small businesses out of defense contracting just got lighter. The George Mason Baroni Center estimates 92.5% of the Defense Industrial Base now qualifies as a "nontraditional defense contractor" under these rules. **Other NDAA Provisions Worth Knowing:** **Section 824 (Past Performance):** DoD must issue guidance allowing past performance references from commercial contracts. If you've done commercial work but no government contracts, this helps you break in. **Section 1806 (CAS Threshold):** Full cost accounting requirements now kick in at $100 million, up from $50 million. Fewer contracts trigger the most stringent compliance. **Section 1824 (Subcontractor Relief):** Defense-specific rules no longer automatically flow down to subcontractors of large primes. Primes can't shift their compliance burden onto you as easily. **What Didn't Pass: SBIR/STTR** The 2026 NDAA does not reauthorize SBIR/STTR. The programs lapsed October 1, 2025. Existing awards continue, but no new solicitations until Congress acts separately. If SBIR was your entry strategy, you need Plan B.
What We Track: 11,909 Open DoD Opportunities
Our database includes **11,909 open DoD opportunities** from SAM.gov. Here's the breakdown: **By Type:** | Category | Count | What It Is | |----------|-------|------------| | Procurement | 11,710 | Active solicitations | | RFI | 57 | Market research, not awards | | BAA | 56 | Research white papers | | Grants | 49 | SBIR/STTR and research | | Sources Sought | 30 | Capability assessments | **By Service Branch:** | Branch | Open Opportunities | |--------|-------------------| | Defense Logistics Agency | 1,097 | | Navy/Marines | 702 | | Army | 525 | | Air Force | 266 | | DARPA | 50 | | Other DoD | 9,269 | **Small Business Set-Asides:** | Set-Aside Type | Count | |----------------|-------| | Small Business (Total) | 747 | | Service-Disabled Veteran (SDVOSB) | 47 | | HUBZone | 30 | | 8(a) | 20 | | Women-Owned (WOSB) | 15 | **747 opportunities** are explicitly set aside for small businesses right now. That's where the reduced competition is.
Specific Opportunities Closing Soon
These are real opportunities in our database with deadlines in the next 60 days: **DARPA Programs (Research Entry Points):** **Young Faculty Award (YFA) 2026**, January 20, 2026 DARPA Defense Sciences Office. For junior faculty doing defense-relevant research. This is how academic researchers break into DoD funding. **GUARDIAN Industry Day**, January 22, 2026 DARPA program briefing. Attending industry days signals interest and gets you on the radar for future solicitations. **Adaptive Capabilities Office BAA**, January 30, 2026 DARPA office-wide Broad Agency Announcement. Submit white papers on aerospace and advanced capabilities. **Generative Optogenetics (GO)**, February 26, 2026 DARPA biological research program. Emerging technology focus. **NASCENT Future Program**, February 28, 2026 DARPA forward-looking research opportunity. **Navy Research:** **NAWCTSD R&D Broad Agency Announcement**, January 25, 2026 Naval Air Warfare Center Training Systems Division. NAICS 541720 (Research and Development in Social Sciences and Humanities). **Future Submarine Platforms BAA**, October 31, 2026 $1 billion total funding for submarine survivability, hull/mechanical/electrical systems. Major research opportunity with long timeline. **Army Research:** **Army BAA MPP-I-25-001**, January 31, 2026 Army Contracting Command - Aberdeen Proving Ground. NAICS 541611 (Administrative Management Consulting). **Strategic Environmental Research BAA**, February 5, 2026 Army Corps of Engineers environmental research program.
The Realistic Timeline: 12-24 Months
Getting a first DoD contract takes most small businesses 12-24 months. Here's why: **Months 1-3: Registration** - SAM.gov registration (2-4 weeks if everything validates) - UEI and CAGE code (automatic after SAM) - SPRS score for CMMC self-assessment - NAICS code selection **Months 4-8: Compliance** - CMMC preparation (Level 1 or Level 2 depending on target contracts) - If Level 2: implement all 110 NIST 800-171 controls - Documentation, policies, technical controls - Plan of Action & Milestones (POA&M) for gaps **Months 6-12: Relationship Building** - Industry days and small business conferences - Meet contracting officers and small business advocates - Identify prime contractor partners for subcontracting - Respond to RFIs and Sources Sought notices **Months 12-24: Competing** - Target specific opportunities matching your capabilities - Develop proposal capability - Submit first proposals - Lose some. Learn. Resubmit. **Why Subcontracting First Makes Sense:** Large defense primes have small business subcontracting goals. They're required to report subcontracting spend to SBA. This creates demand for small business partners. Benefits: - Builds past performance you can cite - Teaches you defense contract administration - Gets you CMMC-ready working alongside certified primes - Lower risk than prime contractor directly Search SAM.gov for contract awards in your NAICS code. Identify who's winning. Reach out about subcontracting opportunities.
The Set-Aside Advantage
Set-asides restrict competition to qualified small businesses. Instead of competing against Lockheed Martin, you're competing against other small businesses. **Current Certifications:** **Small Business (SB):** Size standard varies by NAICS. Check sba.gov/size-standards. **8(a) Business Development:** For socially and economically disadvantaged owners. Sole-source contracts up to $4.5M (goods) or $7M (services). 9-year program. **SDVOSB (Service-Disabled Veteran-Owned):** Owned by service-disabled veterans. FY2024 NDAA increased the goal from 3% to 5%. **HUBZone:** Office and 35%+ employees in designated zones. Check maps.certify.sba.gov. **WOSB/EDWOSB:** Women-owned. EDWOSB for economically disadvantaged women owners. **The Mentor-Protégé Program:** DoD's Mentor-Protégé Program pairs small businesses with large contractors. Benefits: - Technical and management assistance from mentor - Mentor gets credit toward subcontracting goals - Often leads to subcontracting opportunities **Eligibility:** Can only participate for 5 years. Can only have one DoD mentor-protégé agreement at a time. The program became permanent in 2023 after 35+ years of success.
What You Should Do This Week
**1. Check CMMC readiness.** If you handle CUI and don't have a POA&M for NIST 800-171, start today. You have until November 2026 before third-party assessment becomes mandatory. **2. Get into SPRS.** The Supplier Performance Risk System is where your self-assessment scores live. DoD contracting officers check it. **3. Verify SAM.gov registration.** Registrations expire annually. Many contractors discover their registration lapsed when they try to submit a proposal. **4. Find your PTAC.** Procurement Technical Assistance Centers are free, DoD-funded counseling for small businesses. Find yours at aptac-us.org. **5. Identify your NAICS sweet spot.** Our data shows these NAICS codes have the most DoD activity: - 541715: R&D Physical/Engineering/Life Sciences (1,043 opportunities) - 336413: Aircraft Parts Manufacturing (851 opportunities) - 236220: Commercial Building Construction (409 opportunities) - 541330: Engineering Services (290 opportunities) **6. Search for set-asides.** 747 opportunities are small business set-asides right now. Start there if you're certified.
Summary: Key Changes
**CMMC enforcement is live.** Phase 1 started November 10, 2025. Phase 2 (third-party certification required) starts November 10, 2026. If you're not preparing now, you're too late. **NDAA 2026 helps small businesses.** Section 1826 exempts you from CAS, FAR 31, and certified cost data. Section 824 lets you cite commercial past performance. The compliance burden dropped significantly. **SBIR/STTR is still lapsed.** No reauthorization in the 2026 NDAA. Find alternative entry points. **We track 11,909 open opportunities.** 747 are small business set-asides. 56 are BAAs accepting white papers. Specific deadlines: DARPA YFA (Jan 20), NAWCTSD BAA (Jan 25), DARPA ACO BAA (Jan 30). CMMC preparation timelines require planning now given the November 2026 Phase 2 deadline.