Cyber Grants Alliance offers gap assessment grants for defense manufacturers

Cyber Grants Alliance is urging defense industrial base manufacturers to move on cybersecurity gap assessments before CMMC enforcement changes settle. The group says Level 1 and Level 2 in-kind grants can help companies document compliance and avoid rushed remediation later.

Why it matters: - Defense manufacturers still face cybersecurity compliance obligations even though Phase 2 CMMC third-party assessments are paused. - Companies that do not document their compliance posture now could face contract risk, rushed remediation, and added costs later. - Gap assessments can help manufacturers identify weaknesses before primes or future rules put more pressure on suppliers.

What happened: - Cyber Grants Alliance issued an advisory on July 23, 2026, telling defense industrial base manufacturers to use Level 1 and Level 2 gap assessment grants before enforcement deadlines tighten. - The group pointed to the Department of Defense’s July 13, 2026, announcement suspending Phase 2 CMMC third-party assessments. - Cyber Grants Alliance said the pause does not change core cybersecurity obligations for manufacturers handling Federal Contract Information or Controlled Unclassified Information.

The details: - Phase 1 self-assessments, NIST SP 800-171 Rev. 2 compliance, and DFARS 252.204-7012 safeguarding requirements remain legally enforceable, including under the False Claims Act. - Prime contractors may still require C3PAO certifications for supplier programs during the 60-day review period. - Cyber Grants Alliance said companies without documented compliance evidence risk losing contract opportunities while the framework is under review. - The organization said the pause affects certification mechanics, not the underlying need to protect FCI and CUI. - The Level 1 CMMC Gap Assessment Grant is valued at $5,000 in-kind and covers all 17 basic cyber hygiene practices across 6 control families under FAR 52.204-21. - The Level 2 CMMC Gap Assessment Grant is valued at $10,000 in-kind and evaluates all 110 NIST SP 800-171 Rev. 2 controls across 14 control families for companies handling CUI. - Cyber Grants Alliance says the programs are designed to remove financial barriers for small manufacturers. - Rick Dassler, executive director of Cyber Grants Alliance, said manufacturers cannot afford to sit on the sidelines and that establishing an accurate baseline is a crucial step to safeguard defense contracts. - The group directs applicants to its Level 1 Grant and Level 2 Grant pages. - Cyber Grants Alliance describes itself as a nonprofit that supports small and medium-sized businesses in the defense industrial base through grants, education and resources. - The organization lists social media links on LinkedIn and Facebook.

Between the lines: - The advisory is a signal that the compliance market is not standing still, even if one assessment pathway is paused. - Companies that wait for the review to finish may end up with less time, fewer resources, and more pressure to prove compliance quickly. - The grants also function as a competitive tool, since documented readiness can matter with primes as much as formal certification.

What's next: - The Department of Defense’s 60-day review could lead to modified, reinstated, or alternative CMMC frameworks. - Defense manufacturers that complete gap assessments now may be better positioned for whichever model emerges next. - Companies seeking support can apply for the in-kind assessment grants immediately.