Cybersecurity Maturity Model Certification assessment grants for small businesses and new entrants

(a) Program establishment (1) In general Not later than July 1, 2027, the Secretary of Defense shall, acting through the Chief Information Officer of the Department of Defense and in coordination with the Director of the Department of Defense Office of Small Business Programs, establish a program to award grants to small businesses and new entrants to the defense industrial base to offset the costs of Cybersecurity Maturity Model Certification assessments conducted by Certified Third-Party Assessment Organizations. (2) Designation The program established under paragraph (1) shall be known as the Cybersecurity Maturity Model Certification Assessment Grant Program (in this section the Program). (b) Grants (1) In general Under the Program, the Secretary shall award one-time grants to eligible entities described in paragraph (2) to offset costs they incur for Cybersecurity Maturity Model Certification assessments conducted by Certified Third-Party Assessment Organizations. (2) Eligible entities described An eligible entity described in this paragraph is a small business concern or a nontraditional defense contractor that— (A) holds or is actively seeking a Department of Defense contract or subcontract requiring Cybersecurity Maturity Model Certification at Level 2 from a Certified Third-Party Assessment Organization; and (B) has not previously received a Cybersecurity Maturity Model Certification at the applicable level from a Certified Third-Party Assessment Organization. (3) Grant amounts (A) Maximum amount per grant The maximum amount of a grant awarded under the Program to an eligible entity described in paragraph (2) is $100,000. (B) Maximum amount for all grants The total amount of all grants awarded under the Program shall not exceed $50,000,000. (c) Selection of grant recipients In awarding grants to eligible entities described in subsection (b)(2) under the Program, the Secretary shall give priority to eligible entities that have not previously held a Department of Defense prime contract or subcontract. (d) Use of funds A recipient of a grant awarded under the Program shall use the amount of the grant only to offset direct costs associated with Cybersecurity Maturity Model Certification at Level 2 from a Certified Third-Party Assessment Organization. (e) Program requirements In carrying out the Program, the Secretary of Defense shall— (1) establish an application process that minimizes administrative burden on eligible entities described in subsection (b)(2); (2) ensure that recipients of grants awarded under the Program demonstrate a good-faith effort toward achieving Cybersecurity Maturity Model Certification within one year of receiving an award; (3) coordinate with the Office of Small Business Programs of the Department of Defense to leverage existing small business support infrastructure, including APEX Accelerators and the Mentor-Protege Program of the Department, to provide technical assistance to grant recipients; and (4) ensure that the Program does not duplicate or conflict with any other Department of Defense cybersecurity support initiative. (f) Annual reports (1) In general Not later than July 1, 2028, and annually thereafter until December 31, 2031, the Secretary of Defense shall submit to the congressional defense committees an annual report on the activities carried out under the Program. (2) Elements Each report submitted under paragraph (1) shall include, for the period covered by the report, the following: (A) The number of grants awarded under the Program, disaggregated by industrial base sectors of the recipients of the grants. (B) The total amount of funds expended under the Program. (C) The number of recipients of grants awarded under the Program that successfully achieved Cybersecurity Maturity Model Certification at the applicable level following receipt of a grant. (D) An assessment of the extent to which the Program has reduced barriers to entry for small businesses and nontraditional defense contractors in the defense industrial base. (g) Derivation of funds Subject to the availability of funds appropriated for operation and maintenance, Department-wide, the Secretary shall carry out the Program in a fiscal year using amounts appropriated or otherwise made available for such fiscal year for operation and maintenance, Department-wide. (h) Definitions In this section: (1) The term Certified Third-Party Assessment Organization has the meaning given such term in part 170 of title 32, Code of Federal Regulations. (2) The term nontraditional defense contractor has the meaning given such term in section 3014 of title 10, United States Code. (3) The term small business concern has the meaning given such term in section 3 of the Small Business Act (15 U.S.C. 632).