If your shop touches defense work — even as a second- or third-tier supplier — cybersecurity requirements are now part of doing business. The rules have shifted recently, and Ohio has free programs to help you keep up. Here's where things stand, what to do about it, and exactly who to contact.
Where CMMC stands now
The Cybersecurity Maturity Model Certification (CMMC) program verifies that defense contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It builds on long-standing DFARS clauses that already require NIST SP 800-171 security controls.
The big recent development: on July 13, 2026, the Department of War announced the immediate suspension of CMMC Phase II requirements, which had been scheduled to take effect November 10, 2026. Phase I self-assessment requirements remain firmly in place, and the department is reviewing the program with an eye toward lowering barriers for small and medium businesses. The official word lives on the Department of War's CMMC page.
The practical takeaway: don't panic-buy an expensive certification, but don't ignore cybersecurity either. Self-assessment obligations are live now, prime contractors are still flowing down security expectations, and the direction of travel is clearly toward more verification, not less.
Free help in Ohio: the CyberSECURE program
Ohio's CyberSECURE program (Small Enterprise Cybersecurity Upgrade & Resiliency Enhancement) offers free, one-on-one cybersecurity support to Ohio small businesses:
- Up to 15 hours of free consulting for eligible small businesses generally
- Up to 60 hours for defense contractors working on CMMC requirements
- A cybersecurity assessment, tailored planning documentation, and a written plan of action at the end
To be eligible you need to be a for-profit Ohio business, operating at least one year, with 2–500 employees, and registered with your local SBDC or Ohio APEX Accelerator.
How to apply: start on the CyberSECURE program page. If you hit any issues with the application, email the program team directly at [email protected]. Note that applying doesn't guarantee placement — but it costs nothing to try.
Ohio APEX Accelerators: your contracting front door
If you want defense work and don't know where to start, start here. Ohio's APEX Accelerators help businesses find contract opportunities, prepare bids, and navigate requirements — all at no cost, and CyberSECURE registration runs through them.
- Find your regional office and its counselors on the Ohio APEX Accelerator contact page — there are offices in Athens, Youngstown, Cleveland, Akron, Columbus, Cincinnati, Dayton, Lima, and more
- Statewide office: Ohio Department of Development, Office of Business Assistance — (614) 644-1637 or [email protected]
Other resources worth knowing
- **CMMC CompliancePro — an interactive playbook from Ohio State's Center for Design and Manufacturing Excellence, built with federal funding, that walks small and medium manufacturers through CMMC 2.0 Level 2 step by step. Questions: [email protected] or (614) 292-6888**
- Your regional MEP center — several of Ohio's six MEP centers offer cybersecurity risk assessments and CMMC preparation as part of their service menus. Our [guide to Ohio's MEP centers](/blog/ohio-manufacturing-resources-mep) has the full list with links
- **Project Spectrum** — the Department of War's own free platform with cybersecurity training and tools for small businesses in the defense supply chain
A sensible order of operations
- Register with your local APEX Accelerator or SBDC — it's free and unlocks the other programs
- Apply to CyberSECURE for a baseline assessment
- Close the obvious gaps — multi-factor authentication, backups, access controls, and employee training cover most of what self-assessments check
- Document everything — compliance is as much about evidence as it is about practice
Printable checklist: your first 90 days
Print this section and work through it in order. Every item is free unless noted.
Step 1 — Get a free advisor ☐ Find your regional office on the Ohio APEX Accelerators contact page and register — statewide line (614) 644-1637, email [email protected] ☐ Ask your APEX counselor to confirm which CMMC level your contracts require
Step 2 — Get a baseline assessment ☐ Apply to Ohio CyberSECURE for a no-cost cybersecurity assessment — questions to [email protected] ☐ Defense contractors: ask about the extended consulting hours (up to 60) when you apply
Step 3 — Close the gaps ☐ Turn on multi-factor authentication for email and remote access ☐ Verify backups run automatically and test a restore ☐ Limit access to controlled information to only the people who need it ☐ Schedule annual security awareness training for all staff ☐ Work through the CMMC CompliancePro playbook — [email protected], (614) 292-6888
Step 4 — Document and maintain ☐ Write your System Security Plan describing how you meet each requirement ☐ Complete your Phase I self-assessment and record the score ☐ Set a calendar reminder to review controls every six months ☐ Bookmark Project Spectrum for free ongoing training
Step 5 — Stay connected ☐ Contact your [regional MEP center](/blog/ohio-manufacturing-resources-mep) about cybersecurity services ☐ [Claim or update your listing](/claim) so prime contractors can find you
Defense work has always demanded more from its suppliers. The shops that treat cybersecurity as a capability rather than a chore will be the ones still eligible when the next phase arrives.
Doing defense work is a selling point — make sure it's on your profile. [Claim or update your listing](/claim) on the Ohio Manufacturers Directory.