Help for small defense contractors, much of it free, and what it cannot do

Checked on 8 October 2026.

What happened

On 5 October 2026 NIST (the National Institute of Standards and Technology, which publishes NIST SP 800-171) published its Small Business Cybersecurity Support Programs Finder. It lists programs across the United States, hosted by non-profit institutions, that help their region’s small businesses with cybersecurity.

NIST also announced a webinar for 29 October 2026 about its small business primer for NIST SP 800-171A Revision 3, the guide to how the security requirements for CUI (Controlled Unclassified Information: sensitive government information your contract marks or describes) are assessed.

What it means for you

Here are three places a small defense contractor can start.

APEX Accelerators: help with government contracting

APEX Accelerators, once called the Procurement Technical Assistance Program, are a program of the Department of War (the new name of the Department of Defense). There are more than 300 offices nationwide, and their guidance costs nothing. Staff give one-on-one help to understand requirements, deal with compliance and compete for government work, from registering in government databases to finding bids and preparing proposals.

NIST: the Finder and the primer

The Finder lists non-profit programs that give direct help, such as risk assessments, penetration tests (an approved attempt to break in, to find weak spots) and compliance services. NIST does not vouch for the programs, and the Finder does not say what they charge.

NIST’s Small Business Cybersecurity Corner lists resources for small businesses, and the primer is now available there. The primer covers Revision 3. As of 8 October 2026, defense contracts that involve CUI still call for NIST SP 800-171 Revision 2, and a CMMC (Cybersecurity Maturity Model Certification) Level 2 self-assessment follows the June 2018 edition of NIST SP 800-171A.

CISA: no-cost services and tools

CISA (the Cybersecurity and Infrastructure Security Agency) keeps a list of its own no-cost services and of no-cost tools from other organizations. It suggests three to start with: your Regional Cybersecurity Advisor, from one of its 10 regional offices; its Cyber Hygiene services, which help protect the systems you have on the internet from weak settings and known flaws; and its Cybersecurity Performance Goals, a common set of basic practices. CISA does not endorse the outside tools on its list.

What this help cannot do

None of these takes over your CMMC work, and none of them is a CMMC assessment. Your self-assessment, your entry in SPRS (the government website where you report your results) and your yearly confirmation stay yours. We suggest keeping CUI out of anything you send to an outside helper.

What comes next

  • 29 October 2026. The day NIST set for its webinar on the small business primer. NIST lists its events on its Small Business Cybersecurity Corner.
  • 10 November 2026. The day NIST set for a Small Business Cybersecurity Community of Interest call.

What to do now

  1. Find your local APEX Accelerator on the map on its website. Ask what help it offers with the requirements in your contracts, including the cybersecurity clauses.
  2. Look for a program in your region in NIST’s Finder. Ask any program what it offers, and what it costs, before you start.
  3. Go through CISA’s list with your IT provider, and ask whether your company can use a service and whether it fits.
  4. If you read the primer or join a NIST event on it, keep in mind that it covers Revision 3, not the Revision 2 that defense contracts involving CUI call for.

Sources