CMMC, the Department of Defense's cybersecurity certification program, became a binding contract requirement in late 2025, and 2026 is the year those requirements expand. The change most worth watching is Phase 2, which begins November 10, 2026, and introduces third-party Level 2 certification for many contracts that handle sensitive defense information. Because assessments take time to prepare for, readiness is the practical priority this year.
Winning a small business set-aside contract feels like crossing a finish line. The award letter comes in, the team celebrates, and then someone on the operations side starts asking a question that should have been asked weeks earlier: how much of this work can we actually subcontract out?
That question has a real answer, and the answer matters. Get it wrong and you're not just risking a contract. You're risking a finding that you operated as a pass-through, which is one of the more serious problems a small business contractor can have.
This is the rule that catches more newer contractors than almost any other compliance trap. Here's what's actually going on.
Most contractors scroll past sources sought notices. They look like noise. No money attached, no contract to win, no clear next step. So the notice gets skipped, and a month later a solicitation drops for that same requirement and the contractor wonders why it's structured the way it is.
Here's the part nobody tells you: the way that solicitation got structured was decided partly by who responded to the sources sought, and what they said. If you weren't in that conversation, somebody else was.
You're registering in SAM for the first time, or your renewal just got kicked back, and you're staring at an error message about your physical address. Maybe you tried a virtual office because that's where your business actually operates. Maybe you used a UPS Store address because you work from home and didn't want your house on a government website. Maybe your address is completely legitimate and the system rejected it anyway.
