Executive Brief
Congress just extended and significantly upgraded one of the most valuable funding programs available to small defense technology companies. Here’s what changed:
- TABA funds can now cover cybersecurity assistance — including CMMC costs and internal staff hiring, stackable on top of your core award
- A new $30M "Strategic Breakthrough Allocation" bridges the “valley of death” — but requires dollar-for-dollar matching and a program office commitment
- Proposal volume caps take effect FY2027 — BD strategies built on high submission volume have an expiration date
- Foreign involvement screening is now embedded at every phase — investor cap tables, subcontractors, and key partners will face scrutiny
Dig deeper and continue learning below!
SBIR/STTR 101
Small Business Innovation Research (SBIR) and Small Business Technology Transfer (STTR) are federally mandated programs that direct a percentage of large R&D agency budgets to small businesses, flowing through three phases: feasibility (Phase I), full development (Phase II), and commercialization (Phase III). To qualify, your company must be a U.S.-based small business under 500 employees, majority American-owned, with the principal researcher primarily employed by you. STTR awards also require a formal research partnership with a U.S. research institution. If that describes your company and you work in defense tech, SBIR/STTR is one of the most accessible non-dilutive funding pathways available.
What’s Changed: Three Things to Know
The Small Business Innovation and Economic Security Act officially was signed into law on April 13, 2026. It extends the SBIR/STTR programs through September 30, 2031, and introduces meaningful structural changes that defense-focused small businesses need to understand.
1. A New Large-Award Pathway — Up to $30 Million
This is the headline change. The bill creates a Strategic Breakthrough Allocation, a new funding mechanism allowing major agencies (those with SBIR obligations exceeding $100M, including the Department of Defense, National Institutes of Health, and Department of Energy) to make awards up to $30 million to a single company over a 48-month period.
Why it matters: This directly targets the “valley of death” — the gap where mature SBIR/STTR technologies stall because they’ve outgrown Phase II funding but haven’t yet landed a major program contract. The new pathway is designed to bridge that gap.
What you need to qualify:
- At least one prior Phase II SBIR or STTR award
- 100% matching funds from new private capital or non-SBIR government funding
- A demonstrated, market-validated solution
It’s worth being direct about who this pathway is designed for. Dollar-for-dollar matching on a $30 million award means $30 million in non-SBIR capital already committed. This is most realistic for companies that have raised institutional capital or have a prime contractor that can backstop the match. If that’s not where you are yet, use this as a roadmap for what “transition-ready” looks like.
For DoD, the bar is higher. You’ll need a written commitment from a program acquisition executive, evidence your technology meets an operational need, and at least 20% of matching funds from DoD funding outside SBIR/STTR. The 90-day award window signals that agencies need pre-sold proposals: relationships built, funds committed, and Phase II results packaged for a decision.
What Most Companies Miss: Phase III Is Where SBIR/STTR Pays Off
Phase III contracts can be awarded sole-source with no full and open competition required, no statutory dollar ceiling, and your SBIR/STTR data rights protections intact. Any federal agency can issue one, not just the one that funded your original work. Your Army-funded sensor technology can become a DHS production contract. Your DOE-funded cybersecurity tool can become an intelligence community procurement. Most small businesses treat SBIR/STTR as a grant program that ends after Phase II. It is not. Phase I proves feasibility. Phase II builds the product. The Breakthrough Allocation funds the transition. Phase III is the production contract. Every decision from Phase I forward should be building toward that conversation with a program office.
COMPLIANCE WITHOUT COMPROMISE
Smarter budgeting for defense contractors. In this guide you will learn:
What it costs to build a compliant environment in-house
Why many companies move toward outsourced models
What a realistic compliance budget looks like today
How to avoid rushed or overpriced implementation
2. TABA Funding Gets Smarter and More Flexible
Technical and Business Assistance (TABA) funding has always been the underused corner of SBIR. The new rules make it significantly more useful, and give you more control: previously, agencies selected the vendors you had to use. Now, you select.
New eligible uses include:
- Cybersecurity assistance — explicitly added, a direct signal to defense contractors about compliance expectations
- Foreign involvement screening — you can now use TABA funds to vet your own supply chain, partners, and investors for foreign risk exposure
- Hiring or augmenting staff — a significant expansion; you are no longer locked into purchasing outside services and can use TABA funds to build internal capability
Funding limits: Phase I remains $6,500 per project; Phase II remains $50,000. Both can now be provided on top of the core award rather than carved out of it. The expanded flexibility comes with targeted agency oversight, so document your usage.
3. Proposal Limits Are Coming — Plan Ahead
Starting in FY2027, each agency’s SBIR/STTR program director must cap the number of proposals a single company can submit per fiscal year. Limits can be set by fiscal year, by solicitation, or by topic; the agency chooses the method.
Why this matters for BD and capture teams: If your business development model relies on submitting large volumes of proposals across an agency, that model has an expiration date. The companies with a structural advantage under caps will be the ones that have invested in strong past performance, clear technical differentiation, and real relationships with program offices — not the ones that optimized for volume.
Before you spend one of your limited submissions, your capture team should be able to answer yes to at least two of these three questions:
- Do we have a relationship with the program office behind this topic?
- Do we have past performance that directly maps to this requirement?
- Can we credibly differentiate from the other companies who will also submit?
If you cannot get to two out of three, that topic is probably not worth the slot.
The Window Before the Caps Is the Strategy
FY2027 feels distant, but the companies that will thrive under proposal limits are the ones building their foundation now. Use this window to engage program offices directly, attend industry days, request capability briefings, and get your technology in front of the people who write requirements. When caps take effect, companies with established relationships will know which topics are worth pursuing before the solicitation drops. Everyone else will be guessing from the outside, burning limited submissions on long shots.
A Word on Waivers: Don’t Build Your Strategy Around One
The bill includes a waiver mechanism for time-sensitive, mission-critical topics, but no more than 5% of an agency’s topics in any fiscal year can qualify, and what counts as mission-critical is entirely the agency’s call. Build your prioritization strategy assuming the caps apply to every topic you care about. Treat any waiver as upside, not baseline.
The Security Thread Running Through Everything
One theme ties all these changes together: national security screening is now embedded throughout the SBIR/STTR award process. Agencies must evaluate whether applicant companies have ties to entities on federal watchlists, including the UFLPA Entity List, Chinese Military-Industrial Complex Companies List, and DoD’s Section 889 Prohibition List. If your company has foreign investment, foreign-born founders, international partnerships, or offshore affiliates, expect heightened scrutiny at every phase.
What to do before you submit:
Pull your investor cap table and check every entity against the published watchlists. Do the same for subcontractors and key supply chain partners. If you have foreign nationals in key positions, understand how FOCI screening applies and what mitigation looks like. Know what disclosures any foreign investment will require before the agency asks. An undisclosed foreign connection found during review does not just slow your award; it calls every other representation in your proposal into question.
This is also where the TABA changes connect. Foreign involvement screening is now an eligible use of TABA funds. Use your Phase I allocation to run a baseline screening before Phase II, when scrutiny and dollar amounts both increase.
Can SBIR Funds Help Cover CMMC Costs?
Short answer: yes. CMMC compliance costs are allowable under federal contracts, and the reauthorized TABA provisions now explicitly cover cybersecurity assistance and internal staff hiring. Treat your SBIR and CMMC timelines as a single workstream: use Phase I TABA funds to scope your gap assessment, then Phase II to fund remediation. Companies that integrate CMMC from Phase I will arrive at Phase III conversations with their compliance posture already in place, which is exactly what a contracting officer wants to see. If you have a CISO or GRC team, get them involved in SBIR planning now.
Bottom Line
SBIR reauthorization is not a routine extension. It creates a genuine large-award pathway for transition-ready companies, gives awardees more control over their growth investments, and puts real limits on proposal volume. But the most important shift may be the least obvious: this bill rewards companies that treat SBIR/STTR as a contracting pipeline, not a grant program. The Breakthrough Allocation funds the transition. Phase III delivers the production contract. TABA builds your compliance and security posture along the way. Every piece connects if you plan for it.
The program runs through 2031. Proposal caps take effect in FY2027. The window to build the relationships, past performance, and compliance foundation that will matter under the new rules is right now.
ISI helps small defense contractors navigate security compliance, facility clearance processing, and CMMC readiness. If your team is working through any of the challenges discussed, get in touch.