NSBA advocates on behalf of small businesses in the federal contracting community, urging policymakers to ensure CMMC cybersecurity requirements are practical, achievable, and appropriately tailored to the realities facing small federal contractors.
AUG. 18, 2026 | Last week, the National Small Business Association (NSBA) submitted comments on the Cybersecurity Maturity Model Certification (CMMC) framework, focused on strengthening federal cybersecurity while ensuring small businesses can realistically meet new requirements. NSBA’s comments emphasize the need for practical, achievable compliance standards that recognize the financial and operational realities facing small federal contractors.
NSBA supports the Department of Defense’s goal of protecting sensitive government information, but warns that costly and complex certification requirements can create significant barriers for small businesses seeking to compete for federal contracts. NSBA will also continue urging policymakers to provide small contractors with clearer guidance, accessible resources, and a compliance framework that strengthens cybersecurity without unnecessarily limiting competition or small-business participation in the Defense Industrial Base.
That advocacy remains particularly timely following the Pentagon’s decision to suspend implementation of CMMC Phase II while the Department reviews the program and considers potential reforms.
NSBA encourages small businesses to continue taking cybersecurity requirements seriously during the suspension, while using the review period as an opportunity to ensure the future CMMC framework is both effective and workable for small contractors.
NSBA will continue engaging with the Department of Defense and policymakers to ensure small-business voices remain central to the future of CMMC and federal cybersecurity policy.
____
Read our full comments here.