- Whether CMMC cost is recoverable depends on your tier and your contract mix. **The answer is not binary.**
- **FAR Part 31 allows recovery, but the naive interpretation costs you contracts.** Distributed across years, contracts, and at partial recovery, it works. Full recovery in one year on one contract loses bids.
- State grants cover a meaningful slice for the smallest contractors, a useful slice for mid-small, and almost nothing for mid. Connecticut's CAP grant ($35K cap) is the most generous dedicated CMMC program in any state.
- The federal tax credit is not coming. Senior DoD leadership backed it. The SBA pushed for it. The DoD declined to add it. *Plan as if it doesn't exist.*
- **The pricing pressure that feels permanent today is a transition cost.** It resolves in 18 to 24 months as 33,000 to 44,000 non-compliant contractors exit the bidding pool.
The most contested question in CMMC isn’t whether the regulation is fair. It’s whether you can recover the cost. Contractors who’ve tried to bake compliance into competitive bids say no. They lose to whoever didn’t. The DoD says yes through FAR Part 31. State grants exist but cap at amounts that barely cover the assessment fee. The federal tax credit that everyone keeps mentioning has not become law. Each side is partially right, which is why the question keeps recurring on LinkedIn without resolution.
Your tier decides this. Most CMMC funding content treats the question as binary — funded or not funded — when recovery mechanisms work for some contractors and don’t work for others. The same FAR Part 31 clause produces very different results in a sub-$1M revenue machine shop versus a $30M tier-1 supplier. This article walks through the recovery mechanisms that actually exist, what each one delivers in practice, and what the math looks like for the three contractor tiers that make up most of the affected market.
The three positions, all partially right.
The CMMC funding conversation has three loud voices, each pushing a partial truth. None on its own is the whole picture. The argument keeps recurring on LinkedIn because each position is talking past the other two.
"FAR Part 31 covers it. Compliance costs are allowable."
The DoD points to the rule that allows CMMC compliance costs to flow into contract pricing. Technically accurate. Operationally naive. What the regulation says and what works in a competitive bid are different questions, and the DoD has not addressed the second one.
"Apply for state grants. Connecticut, Maryland, Michigan."
Industry consultancies headline programs like the Connecticut CAP Grant ($35K cap) and Maryland's tax credits. Real money for small contractors. They don't approach the cost of certification for any contractor above 50 CUI users, and even at the smallest tier, they cover fragments of the total bill.
"In a competitive bid, baking $100K of CMMC cost in means losing."
Contractors on LinkedIn, especially small machine shops and tier-2 suppliers, push back hard on the recovery story. They're right about the current dynamic. The market is in a transition period: some contractors have absorbed CMMC costs, others haven't. That gap closes within 18 to 24 months. The pricing floor has to rise to reflect a universal cost basis.
This article unpacks all three positions in the order most contractors actually need them: how FAR Part 31 actually works, where state grants help and where they don’t, why the federal tax credit isn’t coming, why the math gets easier in 18 to 24 months, and what to do this quarter regardless of tier.
What FAR Part 31 actually does, and doesn’t.
FAR Part 31 governs allowable costs on federal contracts. The DoD has confirmed on the record — in DFARS Case 2019-D041 final rulemaking — that CMMC compliance costs are allowable under FAR Part 31 if incurred per FAR 31.201-2.3 That’s the regulatory floor. Two important things follow from it. One important thing doesn’t.
What follows. On cost-reimbursable contracts, CMMC compliance costs can be charged as direct or indirect expenses to the contract. On fixed-price contracts, CMMC costs can be allocated to overhead pools and recovered through the indirect cost rates that drive bid pricing. Typically G&A or overhead, depending on your accounting structure.
What doesn’t follow. FAR Part 31 doesn’t tell the contractor next to you in the bidding pool to also recover their CMMC cost. The regulation makes recovery permissible. Not enforced. If you allocate $100,000 of compliance cost to your overhead pool and your indirect rate rises to reflect it, your bid price rises by whatever portion of that cost lands on the specific contract. If your competitor decides to absorb their CMMC cost into margin instead of pricing it in — and many small contractors are choosing this — your bid is now uncompetitive on price by exactly the amount you’re recovering.
This is the disconnect that makes the LinkedIn discourse so frustrated. The DoD is technically correct that FAR Part 31 enables recovery. Contractors are correct that recovery, applied naively, costs them contracts. Both observations are true at the same time.
The resolution isn’t to abandon FAR Part 31. It’s to use it more carefully than the naive interpretation suggests.
The distribution that makes FAR Part 31 actually work.
Sophisticated contractors handle FAR Part 31 differently from how it’s described on LinkedIn. Three mechanics, used in combination, make recovery viable without sacrificing competitiveness.
- Distribute over multiple years. A $100K compliance spend allocated to a single fiscal year’s overhead rate produces a steep one-year rate increase that distorts every bid for twelve months. The same $100K distributed across three years produces a much smaller per-year impact, typically $30K to $40K depending on your overhead base.4
- Distribute over multiple active contracts. FAR 31.201-4 allocates indirect costs proportionally across all active contracts based on the allocation base, typically total cost input or direct labor. A contractor with five active contracts and $30K of compliance cost in a given year sees that cost spread across all five contracts, not loaded into one.
- Recover partial amounts, not full. Nothing in the regulation requires a contractor to allocate 100% of compliance cost to overhead. The strategic question isn’t “can I recover all of it?” It’s “what’s the maximum recovery I can apply without losing competitiveness in my specific market?” That number is rarely 100%, and rarely zero.
These three mechanics together change the calculation. The contractor who tries to recover $100K through one year, one contract, full allocation will lose bids. The contractor who distributes the same $100K over three years, five active contracts, at 50% recovery is recovering roughly $3,000 per contract per year. Small enough to remain competitive, while still absorbing more than half the cost over the recovery period.
Bake it in, lose the bid.
- Cost recovered $100K
- Time horizon 1 fiscal year
- Contracts 1 active
- Recovery rate 100%
Bid price rises by $100K. Competitor absorbs the cost into margin and underbids you by exactly that. Contract lost.
Spread it, keep the bid.
- Cost recovered $100K
- Time horizon 3 fiscal years
- Contracts 5 active
- Recovery rate 50%
Bid price rises by ~$3K per contract per year. Competitive bid stays competitive. Half the cost recovered over three years.
The contractors who lose the argument on LinkedIn are typically describing the naive interpretation. The contractors who quietly use FAR Part 31 successfully are using the distributed interpretation. Both can be in the same room without realizing they’re talking about different mechanics.
When does this money come back?
Here’s the question every CFO asks, and most CMMC content avoids. You’re spending $150K on remediation in 2026 to win contracts in 2027. When do you actually see that money?
The honest answer: pre-award costs aren’t directly recoverable. The DoD’s proposed rule was explicit. “No plans for separate reimbursement of costs to acquire cybersecurity capabilities or a required cybersecurity certification.”5 If you spend $150K to become eligible for contracts you don’t yet have, you absorb that cost up front.
Post-award is different. Once you’re under contract, ongoing CMMC compliance costs flow through your indirect rates. The CMMC director, Stacy Bostjanick of OSD Acquisition and Sustainment, said it directly: “Up to Level 3 will be included in your indirect rates. You don’t get a direct charge to do it, but you do get to recoup the cost over time. You have to spread it across all of your business.”6
Documentation, gap remediation, technology stack, assessment prep. Not directly recoverable. The contractor carries this on the balance sheet.
2026
C3PAO certification becomes mandatory for Level 2 contracts. Recovery clock starts only on contracts you actually win.
onward
Each contract absorbs its proportional share. Mature finance teams handle this routinely. The smaller the contract base, the slower the recovery.
2028
For mid-tier contractors with steady DoD revenue, manageable. For contractors with lumpy revenue or new-to-DIB, the cash-flow gap is real.
One more wrinkle for contractors with mixed work. If your business has both commercial and government revenue, Cost Accounting Standards (specifically CAS 418) require you to allocate CMMC costs between the two.8 Allocate too much to government and DCAA may flag over-recovery. Too little and you absorb the cost in commercial overhead. The right ratio depends on which systems are in scope, which contracts they support, and how your existing cost pools are structured. Worth a conversation with your contracts lead before you finalize the allocation.
State grants and tax credits, by tier.
State funding programs do real work for small contractors. Their value scales inversely with company size. Meaningful for the smallest tier. Marginal for the largest. Most articles list grants without contextualizing them against contractor scale, which is what makes the conversation feel more useful than it is for mid-tier contractors.
The four most generous dedicated programs as of April 2026:
- Connecticut CAP Grant. Up to $35,000 for CMMC adoption costs. Administered by CCAT. Funded through the CT Manufacturing Innovation Fund. Dollar-for-dollar match, $5K project minimum. The most generous dedicated CMMC grant in any state.9
- Maryland BMC + ESCC tax credits. The Buy Maryland Cybersecurity tax credit ($50K cap, $4M annual pool) plus the Employer Security Clearance Costs tax credit (up to $200K, $2M annual cap) can stack for Maryland-based contractors with security clearance obligations.10
- Michigan Defense CyberSmart. Up to $22,500 in matching funds, administered by ODAI.
- Massachusetts cybersecurity infrastructure programs. Up to $30K capital cost-share plus $25K for managed SOC services.15
For a small contractor in one of these states, combined value can move the post-recovery cost from $80K to $40K. Material to a sub-$1M revenue contractor. For a Mid contractor with $250K total compliance cost, a $35K Connecticut grant is 14% of the total. Useful, not transformative. Time spent on grant applications competes with time spent on contract bidding.
Grant programs change. Funding pools open and close. Eligibility evolves. The figures above are current as of April 2026, but a contractor checking grants in late 2026 or 2027 should verify each program directly.14
CMMC Funding Calculator
State-by-state list of every active CMMC funding program. Filter by state, see the cap, the eligibility, the application link. Updated monthly. Free, no email required to use.
The federal tax credit that probably isn’t coming.
A 30% federal tax credit for cybersecurity spending by small defense contractors has been floated repeatedly since late 2024. Senior DoD leadership has publicly backed the concept.11 No legislation has passed. The proposal has not seen meaningful Congressional movement in over twelve months.
The legal record is clearer than the political record. In the final CMMC rule, the SBA filed concerns about the disproportionate cost burden on small businesses and asked for tax incentives to offset it. The DoD acknowledged the concern, declined to add tax incentives or carve-outs, and stated explicitly that CMMC requirements would be enforced uniformly across the Defense Industrial Base.12 The federal tax credit, if it comes, will require Congressional action that no powerful constituency is currently pushing for.
Build your CMMC budget against the funding mechanisms that are actually in place — FAR Part 31, state programs, free advisory services. If the tax credit eventually passes, treat it as a windfall. Treating it as expected funding is the kind of mistake that produces underfunded compliance projects and contractors who run out of budget before reaching certification.
Why the math gets easier in 18 to 24 months.
Here’s an argument we don’t see made elsewhere in the discourse, but that follows directly from supply-side dynamics: every contractor who survives CMMC certification carries the same cost basis. The pricing pressure that feels insurmountable today is a transition cost. Not a permanent one.
The numbers behind the argument:
- Industry analysts estimate 33,000 to 44,000 contractors will exit the Defense Industrial Base between 2025 and 2027 because they can’t or won’t achieve CMMC certification.13 That’s 15 to 20% of the current DIB, concentrated heavily in the smallest tier where the math is hardest. The contractors who exit are largely the ones who couldn’t bake costs into bids.
- The contractors who remain are bidding against other certified contractors, all of whom have absorbed similar compliance burdens. The cost gap that allows non-compliant contractors to underbid certified ones today closes when the non-compliant contractors are no longer in the bidding pool.
- The pricing floor has to rise to reflect the universal cost basis. When input costs rise across all suppliers in a market and the supplier set contracts simultaneously, prices rise to reflect the new cost basis. The contractors who survive are bidding into a market where everyone has the same compliance overhead and prices reflect it.
Contractors expected to exit the Defense Industrial Base between 2025 and 2027 because they can’t or won’t certify. Concentrated in the smallest tier. The bidding pool you’re competing in today is not the bidding pool you’ll be competing in by late 2027.
Strike Graph · 2026 CMMC impact projectionThis argument doesn’t help the contractor whose competitive bid is uncompetitive today. It does change the strategic calculation. The question isn’t “can I afford CMMC at current pricing?” It’s “can I survive 18 to 24 months of pricing compression while the market normalizes?” Those are different questions. The first looks at the current month’s bid. The second looks at the structural dynamic.
For Mid-Small and Mid contractors, the implication is straightforward: certify, distribute the cost using FAR Part 31, ride out the transition. For Small tier contractors, the question is sharper. Whether you have the cash flow to survive on tighter margins.
The honest answer for each tier.
Pulling the analysis together produces concrete recommendations for the three tiers that make up most of the affected contractor population.
If DoD revenue is above $500K with three active contracts, certify. Below that, the strategic question is whether to refocus on commercial.
Certify. Use enclave architecture to reduce in-scope cost. Distribute FAR Part 31 recovery across all contracts. Apply for state grants as bonus.
Certify. Funding question is largely solved by competent FAR Part 31 distribution. Spend less time on grants, more on early-mover contract wins.
CMMC Readiness Assessor
Twelve questions. Tier-specific diagnosis of which tier you’re actually in and which of three readiness states. Same logic C3PAO assessors use. Free. Email only to send you the report.
What to do this quarter.
Three things, regardless of tier.
Before the next bidding cycle that has CMMC in it.
- Calculate your real CMMC spend. Most contractors underestimate by 30 to 40% because they only count assessment fees and software licenses. Not the people-time for documentation, evidence collection, and policy work. Walk through the full cost with whoever runs your environment, not just whoever signs the checks.
- Talk to your contracts lead about indirect rate negotiation. If you're on cost-reimbursable contracts, your indirect rate gets renegotiated periodically. If your CMMC costs aren't yet in your forward-pricing rate, they're absorbing margin you could have recovered. Get them in.
- Decide your strategy by tier. Small contractors absorb costs and price aggressively to win the contracts that justify them. Mid-tier contractors restructure overhead and amortize. Larger contractors negotiate. The wrong strategy for your tier costs you money. Sometimes a lot.
The contractors who pass CMMC and stay in business will be the ones who understood the funding landscape clearly enough to make sound decisions about distribution, recovery, and competitive bidding. Not the ones who waited for tax credits that never came. Not the ones who tried to absorb the full cost in a single year while bidding against contractors who didn’t. Not the ones who treated FAR Part 31 as either a magic recovery mechanism or a useless one. It’s neither. It’s a precision tool that requires careful handling. The math is genuinely hard for the smallest contractors. Manageable for everyone else, with discipline. Knowing which group you’re in is the most important strategic call CMMC will require of you.