Small Contractors Spend $150,000+ on Cybersecurity Rules — Congress Just Stepped In

If you've ever bid on a Department of War contract and hit a wall of acronyms — CMMC, NIST 800-171, DFARS — you're not alone, and you're not imagining the cost. Small business owners trying to comply with federal cybersecurity certification requirements have been reporting bills that stretch into six figures, just to prove they're secure enough to keep doing business with the federal government. On September 3, 2026, a bipartisan group of House members introduced a bill aimed directly at that problem.

The Bill: What H.R. 10238 Actually Does

The Cybersecurity for Small Businesses Act, introduced by Rep. Tony Wied (R-WI) along with original cosponsors Rep. Beth Van Duyne (R-TX) and Rep. Kimberlyn King-Hinds (R-CNMI), takes aim at the confusion surrounding the Cybersecurity Maturity Model Certification, or CMMC — the tiered certification program that defense contractors and their subcontractors must complete to handle certain government information and win Department of War contracts.

The bill would require the Small Business Administration to work directly with the Cybersecurity and Infrastructure Security Agency to produce practical, accessible cybersecurity guidance specifically written for small businesses, rather than the dense compliance documentation currently aimed at large defense contractors with dedicated IT compliance teams. It also requires the SBA to coordinate directly with the Secretary of War on how CMMC's requirements apply to small businesses, and adds new annual reporting obligations under the Small Business Act to track how the program is affecting smaller firms.

Why Lawmakers Are Acting Now

"Small businesses shouldn't be forced to spend hundreds of thousands of dollars to obtain a level of cybersecurity they don't need simply because Washington has failed to provide clear rules," Wied said in introducing the bill. Van Duyne echoed the concern more bluntly: "They shouldn't have to spend six figures trying to decipher Washington's one-size-fits-all bureaucratic cybersecurity rules."

Those aren't exaggerated numbers. Industry compliance estimates for CMMC certification vary widely depending on the required maturity level, but they routinely run from the low five figures for the most basic self-assessment tier up past $150,000 — and in some cases beyond $300,000 — for the higher certification levels that require a third-party assessment and more extensive security infrastructure. For a small manufacturer or IT services firm with a handful of employees, that's not a line-item expense — it can be the difference between bidding on a defense contract and walking away from it.

The bill also arrives against a backdrop of uncertainty: the Department of War recently paused implementation of CMMC's Phase II and Phase III requirements to conduct a 60-day review of the program, leaving many small contractors unsure exactly which requirements apply to them right now, or when the paused phases will resume. That whiplash — rules tightening, then pausing, then facing legislative scrutiny — is precisely the kind of confusion the bill's sponsors say they're trying to fix.

Who This Affects

This bill matters most directly to small businesses in the defense industrial base: manufacturers, IT service providers, engineering firms, and any company that handles Controlled Unclassified Information as part of a Department of War contract or subcontract. If you've never bid on federal defense work, CMMC itself doesn't apply to you. But the bill's broader push — clearer, small-business-specific cybersecurity guidance from SBA and CISA — is written to help any small business trying to figure out a baseline level of cybersecurity without hiring an expensive consultant to translate federal requirements.

For businesses currently mid-certification or planning to bid on defense contracts in the next year, the practical impact right now is limited: this is a bill that has been introduced, not one that has passed. It has not yet been assigned to committee action publicly reported, and it faces the normal path through the House before it could become law. But its introduction is itself a signal worth watching — it reflects growing bipartisan frustration in Congress with how CMMC has rolled out, on top of the Department of War's own decision to pause parts of the program for review.

What to Do While You Wait

Don't pause your own compliance planning

Even with a review underway and a bill pending, existing CMMC requirements for contracts already in place haven't disappeared. If you have current defense contracts or subcontracts that reference CMMC obligations, continue meeting them under existing rules rather than assuming a pause or a pending bill changes your current contractual obligations.

Get your cost estimate before you commit

If you're considering bidding on a Department of War contract for the first time, get a realistic cost estimate for the certification level that contract requires before you factor it into your bid pricing. A five-figure self-assessment and a six-figure third-party assessment are very different investments, and the two are often confused early in the bidding process.

Watch for SBA-issued guidance

If this bill or similar guidance efforts move forward, the SBA becomes a more direct resource for plain-language cybersecurity requirements. Keep an eye on SBA communications rather than relying solely on defense-industry compliance consultants, who have financial incentive to recommend the most extensive (and expensive) compliance path.

Review your business structure and insurance before you certify

Cybersecurity compliance costs are easier to plan for when your underlying business finances are in order. Confirm your EIN and entity paperwork are current, and check whether your business insurance includes cyber liability coverage — a growing number of defense contracts and subcontracts now expect it as a baseline, independent of CMMC certification itself.

Factor compliance costs into financing decisions

If a six-figure certification cost is standing between your business and a defense contract, it may be worth exploring whether an SBA loan could bridge that gap, especially if the contract itself would generate revenue well beyond the certification cost. Model the return before committing, and build the certification cost into your profit and loss statement projections rather than treating it as a sunk cost outside your normal budgeting.

Clarify who's doing the compliance work

Many small businesses bring in outside IT consultants or contractors to handle cybersecurity assessments. Make sure you understand whether that arrangement is properly classified — the line between independent contractor and employee status matters for tax and liability purposes, especially for ongoing compliance relationships rather than one-time projects.

What's Next

H.R. 10238 is early in the legislative process, and there's no guarantee it becomes law in its current form, or at all. But its bipartisan sponsorship and the specific dollar figures its authors are citing suggest the pressure on federal cybersecurity compliance costs for small businesses isn't going away. Combined with the Department of War's own pause and review of CMMC's later phases, small contractors have a real opportunity right now to make their compliance concerns heard before the rules — whichever direction they end up moving — are locked back in.

Photo by Adi Goldstein on Unsplash