Open SBIR and STTR topics

361 topics, open or in pre-release, read from DSIP and SBIR.gov on Nov 12, 2026.

274Open now 87Pre-release 10Closing within 7 days 0Released in the last 7 days

All agencies NSF 230NAVY 43 USAF 33 USDA NIFA 10 DTRA 9 MDA 9 HHS ARPA-H 7 ARMY 6 OSD 6 DARPA 4 HHS 3 HHS NIH 1

All Open Pre-release

What you can bid on Skip ITAR (43) Include closed Clear filters

CMMC requirements: Level 1 15Level 2 (Self) 95 what do the levels mean?

Level 1: Basic protection of Federal Contract Information: the 15 requirements of FAR 52.204-21. You assess yourself every year and post the result in SPRS.
Level 2: Protection of Controlled Unclassified Information: the 110 requirements of NIST SP 800-171 Rev. 2. "Self" means you assess yourself every three years; "C3PAO" means an accredited third-party assessor certifies you every three years. Both need a yearly affirmation.
Level 3: Level 2 certification plus 24 selected requirements of NIST SP 800-172, assessed by the government (DIBCAC) every three years.

CMMC is the Defense Department's cybersecurity certification; a topic that lists a level expects it by the time of award. This is a summary: the solicitation and 32 CFR Part 170 govern.

Showing 0 of 0 topics, closing within 7 days

No topics match these filters. Show all topics.