Keeping small defense suppliers eligible to bid

The gap

The federal government spends about $793B a year on contracts, and small businesses take roughly 28% of it, above the 23% goal. That headline hides the trend that matters. The number of small firms doing the work keeps falling: from about 121,000 in 2010 to 56,725 last year. The dollars are concentrating in fewer hands.

Most of the venture money that noticed this market went to winning bids: opportunity search and AI proposal writing. GovDash, Procurement Sciences, Vultron, GovEagle and GovSignals all raised in the last two years, and incumbents like Unanet now bundle proposal AI into their ERP. Drafting is getting crowded.

The quieter problem sits one step earlier: staying eligible to bid at all. For defense suppliers that now means CMMC, a cybersecurity certification with its own controls, evidence, assessors and timelines. Large primes have compliance teams. A 15-person machine shop or engineering firm has an office manager and a consultant's quote.

Why now

The deadline is set. The CMMC program rule took effect in December 2024 and the contract clause in November 2025. Phase 2, which brings third-party Level 2 assessments into new contracts, starts November 10, 2026.

The government priced the burden itself. DoD estimates about $104,670 over three years for a small entity's Level 2 assessment and affirmations, before the cost of becoming compliant. More than half of contractors in Deltek's 2025 study expected compliance costs to rise.

The paperwork is model-shaped. CMMC readiness is mostly policies, evidence collection and mapping controls to proof, the kind of document work that got much cheaper as model prices fell between 9 and 900 times a year, depending on the task.

Who pays, and how they buy

The buyer is the owner or operations lead of a defense supplier with 10 to 100 people, often a subcontractor two tiers below a prime. They are not choosing whether to comply. Their prime will ask for proof, and the clause will sit in the contract.

Today they pay consultants, managed service providers and assessors, or they use free help from APEX Accelerators where they can get it. Firms that cannot afford either face a quiet exit from the defense supply chain.

Money already moving

• DoD's own cost estimate for a small firm's three-year Level 2 assessment is $104,670, before remediation. govinfo.gov
• Enterprise contractors report having already spent $100,000 or more each on CMMC readiness. deltek.com
• SAM.gov sees more than 56,000 entity registrations created or renewed every month, a standing chore to stay eligible. origin-www.gsa.gov
• Small businesses already pay for bid tools at $720 to $3,600 a year. semafor.com

The wedge I would back

An eligibility desk for small defense suppliers. It scopes which systems hold controlled information, walks the team through the controls in plain language, collects the evidence as people work, keeps the System Security Plan current, and hands the assessor a clean package. Then it keeps SAM registration and certifications from lapsing.

I would sell it through the primes. A prime with hundreds of small suppliers needs them certified on time, and has a reason to pay for or recommend one tool across its supply chain.

What I would not fundAnother AI proposal writer. The layer has at least five funded startups and incumbents bundling it in, and a better proposal does not help a firm that cannot bid.

The founder I would back

Someone who has done CMMC or NIST 800-171 work for small manufacturers, an assessor or compliance consultant tired of doing it by hand, paired with an engineer who can build on the systems these firms already run.

Who is already building

Risks

• Spend is concentrating: GAO found DoD dollars to small businesses rising while the number of small firms fell, a decade-long pattern. gao.gov
• Consolidation policy pushes common purchases through GSA-managed contracts, and the number of small vendors for common goods fell every year. gao.gov
• Policy volatility: DOGE-era terminations reached 6,335 contracts by April 2025, and 61% had gone to small businesses. govspend.com
• Contractor confidence hit a six-year low in Deltek's 2025 study, and small firms report the most difficulty adopting AI. deltek.com