In 2018 Maryland started three programs to stimulate cybersecurity commerce in the state: (1) tax credits for Maryland small businesses to buy cybersecurity products and services from Maryland suppliers, (2) tax credits for investment in Maryland cybersecurity suppliers, and (3) grants for Maryland Government contractors to become compliant with Department of Defense (DoD) cybersecurity rules.  

1. Tax credits for Maryland small businesses to buy cybersecurity products or services from Maryland companies.

The cybersecurity spending tax credit, the “Buy Maryland Cybersecurity Tax Credit,” is only available to a Maryland company with less than 50 employees. It provides a credit against Maryland income taxes of up to 50% of the cost of purchasing cybersecurity services or products from a Qualified Maryland Cybersecurity Seller (QMCS).

A QMCS is a company that has been certified by the Maryland Department of Commerce as a for-profit business with its headquarters and base of operations in Maryland, which either has annual revenues of less than $5 million, or is minority-owned, woman-owned, veteran-owned, or located in a Historically Underutilized Business (HUB) Zone. Furthermore, it must do at least 51% of its business in developing proprietary cybersecurity technology, or providing cybersecurity services; if it doesn’t have proprietary technology, then it must primarily provide a cybersecurity service. [1]

For buyers of cybersecurity services or technology, tax credits up to $50,000 per year are available for services and for products (up to $100,000 in total), but credits are awarded on a first-come, first-serve basis, using funding made available to the Maryland Department of Commerce. Twenty-five percent of the Maryland annual funding is earmarked for cybersecurity services purchases, with the balance reserved for cyber technology acquisitions. There is no limit on how many years a company may claim the credit.

As of the date of this post, 20 QMCS’s are listed on the Maryland Department of Commerce website. For the 2019 tax year, the Maryland Department of Commerce has $4 million available for tax credits. [2]

2. Maryland Cybersecurity Investment Tax Credit.

Maryland also wants more cybersecurity vendors, so it now offers tax credits for investments in qualified cybersecurity firms. The “Cybersecurity Investment Incentive Tax Credit” aims to help cybersecurity vendors grow, and to create jobs and intellectual property in Maryland. [3]

An eligible vendor (a Qualified Maryland Cybersecurity Company, QMCC) must first be certified by the Department of Commerce, and must, among other things, be for-profit, headquartered and based in Maryland, nonpublic, with fewer than 50 employees, and engaged primarily in the development of proprietary cybersecurity technology. There is a two-year limit for participating in the investment credit program.

Tax credits are available for investments of at least $25,000, and are equal to 33%   of that investment into a QMCC, up to a limit of $250,000 credit per fiscal year. For investments into a QMCC located in the Allegheny, Dorchester, Garrett or Somerset counties, the credit is 50% of the investment, up to a limit of $500,000.

The credit is available to any investor that has Maryland tax liability. However, credits are only available on a first-come, first-serve basis, and no single investor can receive total credits exceeding 15% of the program appropriation per fiscal year. Notably, the credit is refundable, to the extent the credit exceeds the investor’s Maryland income tax liability.

Eligible firms can apply to the Maryland Department of Commerce for certification, prior to finalizing an investment. For calendar year 2019, $4 million will be available for the program. [4]

3. Grants to achieve compliance with DoD cybersecurity rules.

The Maryland Defense Cybersecurity Assistance Program (DCAP) provides grants and assistance for defense contractors to achieve compliance with DoD cybersecurity regulations, which are based upon National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 standards for cybersecurity. [5]

This program is available to companies of any size with a location in Maryland, so long as they do 10% or more of gross revenues in DoD-related business, or hold a DoD contract requiring compliance with DoD Cybersecurity rules. Service firms, as well as manufacturers are eligible. [6]

The DCAP grants will reimburse up to $2500 of the cost for analyzing a company’s requirements to achieve compliance with NIST SP 800-171. Based upon the analysis, both technical assistance and funding may be available to achieve compliance. Funding limits are up to 10% of the cost of consulting (up to $5000), and up to 75% of the cost of tech (tools, hardware and software, up to $3000).

Notably, DCAP funding can be combined with the Buy Maryland Cybersecurity Incentive Tax Credit, so that small businesses can get both types of assistance to help become eligible for DoD contracting.

This program is funded by the Department of Defense’s Office of Economic Adjustment (OEA) through the Maryland Department of Commerce, and is being administered by the Maryland Manufacturing Extension Partnership (MEP). Maryland MEP is a nonprofit organization funded by NIST’s Manufacturing Extension Partnership Program, the state of Maryland and the industry. It seeks to grow and strengthen Maryland manufacturers, mostly small-and midsize manufacturers with 500 employees or less.

Maryland experiments with new approaches to build cybersecurity expertise.

These programs are all new, having just begun in the second half of 2018. Time will tell whether they effectively stimulate Maryland businesses to realize robust cybersecurity, develop industrial cybersecurity expertise, or compete for DoD contracts.

But for now, companies should check eligibility rules to see if they can take advantage of the new Maryland tax credits or grants. Maryland may be offering free money!

[1] For full details, see the Maryland Department of Commerce website at: http://commerce.maryland.gov/fund/programs-for-businesses/buy-maryland-cybersecurity-tax-credit.
[2] Maryland Department of Commerce Presentation to Montgomery County Chamber of Commerce Government Contractor Network (Feb. 22, 2019).
[3] For full details, see the Maryland Department of Commerce website at: http://commerce.maryland.gov/fund/programs-for-businesses/cyber-tax-credit.
[4] Maryland Department of Commerce Presentation to Montgomery County Chamber of Commerce Government Contractor Network (Feb. 22, 2019).
[5] See, e.g., DoD FAR Supplement 252.204-7012 (48 C.F.R. § 252.204-7012).
[6] For full details, see: http://www.mdmep.org/wp-content/uploads/2019/02/Defense-Cybersecurity-Assistane-Program.pdf.

Opinions and conclusions in this post are solely those of the author unless otherwise indicated. The information contained in this blog is general in nature and is not offered and cannot be considered as legal advice for any particular situation. The author has provided the links referenced above for information purposes only and by doing so, does not adopt or incorporate the contents. Any federal tax advice provided in this communication is not intended or written by the author to be used, and cannot be used by the recipient, for the purpose of avoiding penalties which may be imposed on the recipient by the IRS. Please contact the author if you would like to receive written advice in a format which complies with IRS rules and may be relied upon to avoid penalties.

[View source.]