Win DoD Set-Asides: Certification & CMMC in 2025-2026

For small businesses in the defense sector, the U.S. Department of Defense (DoD) isn't just a client; it's a strategic partner driving innovation and maintaining a competitive industrial base. In 2026, the playing field for DoD small business set-asides is clearer but also more demanding. The emphasis is firmly on legitimate certifications, real cybersecurity, and a keen understanding of where your capabilities fit into the DoD's strategic needs.

The federal government's commitment to small businesses is set in law, with statutory goals that include:

• Overall Small Business: 23%
• Small Disadvantaged Business (SDB) / 8(a): 5%
• Women-Owned Small Business (WOSB): 5%
• Service-Disabled Veteran-Owned Small Business (SDVOSB): 5%
• HUBZone: 3%

DoD earned an "A" on SBA's FY2024 small business scorecard, and the government as a whole routinely beats the 23% goal. The harder targets are the socioeconomic ones. This means opportunities are there, but the path to securing them has become more rigorous.

SBA Certification: Your Non-Negotiable Entry Ticket

If you're an SDVOSB or WOSB firm eyeing federal contracts, including those with the DoD, the biggest change you need to internalize is the shift to mandatory certification by the Small Business Administration (SBA). Self-certification for these set-asides is over, and contracting officers (COs) check SBA's certification records.

So what does this mean for you? This mandate reduces the risk of fraud, strengthening the integrity of these programs. However, it also adds an administrative layer. For your firm, this means planning ahead. The application process takes time, so if you haven't started, you're already behind. Getting this certification is your fundamental gateway to set-aside opportunities in these categories.

CMMC 2.0: Cybersecurity is Now a Bid Requirement

Beyond eligibility, your firm's ability to protect Controlled Unclassified Information (CUI) matters. The Cybersecurity Maturity Model Certification (CMMC) 2.0 is the DoD's answer. Its DFARS rule took effect on 10 November 2025 and started Phase 1, in which solicitations can require Level 1 or Level 2 self-assessments. On 13 July 2026 the Department of War suspended Phase 2, which would have required third-party Level 2 certification from 10 November 2026, and launched a 60-day reform review. As of late September 2026, no new Phase 2 date has been announced.

CMMC 2.0 has three levels:

• Level 1 (Foundational): Requires an annual self-assessment.
• Level 2 (Advanced): Covers CUI. The rule allows a self-assessment or a third-party (C3PAO) certification; solicitations use the self-assessment until Phase 2 resumes.
• Level 3 (Expert): Requires government-led assessments.

So what does this mean for you? This is arguably the most significant hurdle for many small businesses. Level 2 is the level for contracts involving CUI, and meeting its 110 NIST SP 800-171 requirements takes real investment in time, resources and possibly outside help, whatever happens to Phase 2. Without a current CMMC status in SPRS at the level a solicitation requires, you can't be awarded that contract. Begin by understanding the CMMC level your target contracts will likely require and budget for the necessary upgrades, assessments, and training now.

Decoding DoD's Goals & Finding Your Niche

Understanding where the government spends its money and where it struggles to meet goals can guide your targeting efforts. In fiscal year 2025, federal agencies awarded about $179 billion in prime contracts to small businesses, nearly 28% of eligible dollars. Category by category, the FY2025 results are mixed:

• Small Disadvantaged Business (SDB) / 8(a): The government reached 11.60% against a 5% goal. (The goal had been raised to 11% to 13% for FY2022 to FY2024 and went back to 5% for FY2025.) Most 8(a) firms can receive sole-source awards up to $5.5 million, or $8.5 million for manufacturing. Firms owned by tribes, Alaska Native Corporations and Native Hawaiian Organizations can receive larger ones, but a written justification is required above $30 million (above $100 million at DoD). The program is also under heavy scrutiny in 2026: SBA suspended more than 1,000 participants in January 2026 after a data call, and the Department of War ordered a review of set-aside and sole-source contracts over $20 million.
• WOSB: The government achieved 4.52% against a 5% goal, a persistent gap.
• SDVOSB: Congress raised this goal from 3% to 5% in the FY2024 NDAA, in force by FY2025. The government reached 5.01% in FY2025, only just over the line.
• HUBZone: The government achieved 2.66% against a 3% goal.

These figures show where agencies need to make up ground, creating targeted opportunities for eligible firms.

So what does this mean for you? If your firm is WOSB or HUBZone, you sit in a category where the government is short of its goal, and SDVOSB is barely over its new one. That gives contracting officers a reason to set work aside for firms like yours. Beyond that, research specific agencies and their small business utilization reports. Identify those struggling to meet specific goals and tailor your outreach accordingly. Focusing on niche capabilities that address unmet needs within these target agencies can further sharpen your competitive edge.

Your Action Plan for Success in 2025-2026

This environment demands a proactive and strategic approach. Here's your practical action plan to compete effectively for DoD small business set-asides:

• Prioritize SBA Certification (Now!): If you're an SDVOSB or WOSB, your SBA certification is your golden ticket. Without it, you're out. Ensure your status is current and verifiable in the SBA's official databases.
• Invest in CMMC Compliance (Don't Wait!): This isn't a future problem. Phase 1 self-assessments are in solicitations now, and DFARS 252.204-7012 already requires NIST SP 800-171 if you handle CUI. Understand the CMMC level your target contracts will require. Budget for assessments, technology upgrades, and staff training. Early movers will capture more opportunities.
• Strategic Teaming and Subcontracting: Don't go it alone. Consider teaming with other small businesses to pursue larger contracts or use each other's complementary capabilities. For 8(a) firms, this is essential for growth beyond sole-source limits. For all small businesses, look for subcontracting opportunities with large primes: those holding contracts over $900,000 generally must have small business subcontracting plans with goals.
• Relentless Market Research and Relationship Building: Actively engage with DoD agencies. Attend industry days, virtual events, and network with Program Managers (PMs) and Contracting Officers (COs). Use tools like SAM.gov, SBA's Small Business Search (which replaced DSBS), and agency forecasts to identify upcoming solicitations. Understand their needs and position your firm as the expert solution provider.
• Focus on Niche Capabilities: Small businesses often thrive by specializing. Identify specific unmet needs within the DoD, perhaps an emerging technology, a specialized service, or a particular geographic requirement. Position your firm as the go-to expert in that niche.

So what does this mean for you? This isn't a checklist to complete once; it's an ongoing strategy. The firms that will win in 2026 and beyond are those that embed certification and cybersecurity into their core operations, actively seek out opportunities, and build strong relationships based on specialized value. Your proactive engagement on these fronts will directly translate into contract wins.

Conclusion

The DoD's commitment to small businesses remains unwavering, but the path to participation is becoming more rigorous and defined. For 2026, the watchwords are certification, cybersecurity, and strategic engagement. Small businesses that proactively work through the SBA certification process and embrace CMMC 2.0 will be best positioned for success. By understanding the rules, using your socio-economic status, and preparing for the technological demands, your firm can effectively compete and secure vital DoD contracts, contributing to the nation's defense while growing your business.

DoD Small Business Set-Aside Programs