Buy Maryland Cybersecurity Tax Credit (BMC)
About this page. This page explains the Buy Maryland Cybersecurity Tax Credit in plain language. The credit is authorized under Maryland Tax-General Article §10-733.1 (Purchase of Cybersecurity Technology and Cybersecurity Service). A copy of the statute is available here - PDF. If anything on this page conflicts with the statute or regulations, the statute and regulations control.
Important — some sellers have reached their cap for tax year 2026
Certain Qualified Maryland Cybersecurity Sellers have reached their statutory cap for tax year 2026. Commerce is no longer able to award tax credits to buyers who made purchases from those sellers in tax year 2026.
Contact Cindy Zeng to confirm a seller's remaining capacity before completing a buyer application.
Program Status
The program is currently active.
Commerce may award up to $4 million in tax credits each tax year, subject to available funding. Credits are awarded on a first-come, first-served basis until funding is exhausted.
Individual sellers also have their own annual cap, and some reach it before the end of the tax year. Confirm seller availability with Commerce before applying.
What This Program Does
The Buy Maryland Cybersecurity Tax Credit helps small Maryland businesses strengthen their cybersecurity protections by offsetting the cost of buying cybersecurity technology and services from Maryland-based cybersecurity companies.
A Qualified Maryland Company may claim a tax credit for 50% of the net purchase price of cybersecurity technologies and services bought from a Qualified Maryland Cybersecurity Seller.
The program also supports the growth of Maryland’s cybersecurity industry. It was created in 2018.
Who This Is For
The program involves two parties, each with its own eligibility rules and application.
Buyers — Qualified Maryland Companies
Maryland businesses that:
- have fewer than 50 employees in Maryland
- are required to file a Maryland income tax return
- purchase cybersecurity technology or services from a certified Qualified Maryland Cybersecurity Seller
Sellers — Qualified Maryland Cybersecurity Sellers
Maryland cybersecurity companies certified by Commerce. Certification makes their products and services eligible for the credit, which encourages Maryland businesses to buy from them.
Definitions
Qualified Maryland Company. A buyer with fewer than 50 employees in Maryland that is required to file a Maryland income tax return. A company certifies its employee count and filing requirement when it applies for the credit.
Qualified Maryland Cybersecurity Seller. A for-profit company certified by Commerce that is primarily engaged in developing innovative and proprietary cybersecurity technology or providing cybersecurity service, has its headquarters and base of operations in Maryland, owns or properly licenses what it sells, and meets at least one of the size or ownership criteria described under Seller eligibility.
Reseller. Any company selling cybersecurity technologies or services that is not itself a certified Qualified Maryland Cybersecurity Seller. Purchases through a reseller can qualify, at a reduced amount, if the product or service originated from a Qualified Maryland Cybersecurity Seller.
Net purchase price. The purchase price after taxes and fees are subtracted. The credit is calculated on the net amount.
Program Duration and Limits
| Limit | Amount | Applies to |
|---|---|---|
Statewide annual funding | $4,000,000 | All applicants combined |
Technology purchases (75%) | $3,000,000 | Cybersecurity technology |
Service purchases (25%) | $1,000,000 | Cybersecurity services |
Maximum credit per buyer per year | $50,000 | Equal to $100,000 in eligible purchases |
Maximum credits generated per seller per year | $200,000 | Equal to $400,000 in eligible sales |
Funding is split by purchase type: 75% of the annual amount is available for cybersecurity technology purchases and 25% is earmarked for cybersecurity service purchases.
Seller caps matter to buyers. Once $200,000 in credits have been claimed for purchases from a single seller in a tax year, additional purchases from that seller are not eligible for the credit that year — even if statewide funding remains. Check with Commerce before buying.
Seller certification is valid for one year and must be renewed annually.
How the Program Works
Credit amount
- The credit equals 50% of the net purchase price
- Maximum credit per buyer per tax year: $50,000
- Maximum eligible purchases per buyer per tax year: $100,000
Example. A $40,000 cybersecurity purchase produces a $20,000 credit.
Example. A $100,000 purchase produces a $50,000 credit — the maximum. Purchases above $100,000 in a single tax year do not generate additional credit.
Example. A company buys both technology and a service from a Qualified Maryland Cybersecurity Seller. Both are eligible, but the combined credit is still capped at $50,000 per year.
Taxes and fees. Taxes and fees must be subtracted from the purchase price before calculating the credit.
The credit must be claimed for the same tax year in which the purchase was made, and Commerce must approve it before it can be claimed.
Purchases through resellers
Purchases made through third-party resellers may qualify if the product or service originated from a Qualified Maryland Cybersecurity Seller.
When purchasing through a reseller:
- The purchase price is reduced by 20% before the credit is calculated. This reflects Commerce’s estimate of the reseller markup.
- The 50% credit is then applied to the reduced amount.
Example. A $50,000 reseller purchase is reduced by 20% to $40,000. The credit is 50% of $40,000 = $20,000.
The invoice from the reseller must identify:
- the name of the Qualified Maryland Cybersecurity Seller, and
- a description of the cybersecurity technology or service purchased
Extended service contracts
How the credit is calculated depends on how the contract is paid:
- Paid in full up front: the credit is based on the full amount paid, up to the $50,000 annual cap.
- Paid in installments: only the amounts actually paid during that tax year are eligible.
Example. A company signs a one-year cybersecurity service contract on July 1 with monthly payments of $1,000. Only the payments made that calendar year count — six months of payments, or $6,000 in eligible purchases. The company may apply again the following year for payments made in that year.
Key Eligibility Requirements
Buyer eligibility
A company must:
- Have fewer than 50 employees in Maryland
- Be required to file a Maryland income tax return
- Purchase eligible cybersecurity technology or services
- Purchase from a Qualified Maryland Cybersecurity Seller (or from a reseller, where the product originated with a qualified seller)
Eligible cybersecurity technology
Eligible technology includes proprietary goods and products designed to protect information systems, electronically stored data, and data transferred between information systems — including products designed to detect or prevent:
- Unauthorized access to information systems, stored data, or data in transfer
- Data exfiltration or extrusion
- Manipulation or impairment of the integrity, confidentiality, or availability of data stored or transferred by an information system
Eligible cybersecurity services
To qualify, the seller must primarily perform an activity identified in the National Institute of Standards and Technology’s most recent Cybersecurity Framework: Framework Core - PDF.
Seller eligibility
To be certified as a Qualified Maryland Cybersecurity Seller, a company must:
- Be a for-profit business
- Be primarily engaged in cybersecurity — at least 51% of its business must be developing innovative and proprietary cybersecurity technology or providing cybersecurity service
- Maintain its headquarters and base of operations in Maryland
- Own or properly license the cybersecurity technology or service offered
- Be in good standing with the Maryland Department of Assessments and Taxation and current with all Maryland tax obligations
The company must also meet at least one of the following:
- Have less than $5 million in annual revenue
- Be minority-owned
- Be woman-owned
- Be veteran-owned
- Be service-disabled veteran-owned
- Be located in a Historically Underutilized Business (HUBZone)
A seller may sell technologies alone, services alone, or both. Certification is valid for one year and must be renewed annually. There is no deadline — a company may apply for certification at any time during the year.
Documents You Will Need to Apply
Buyers
Applicants should be prepared to provide:
- A copy of the invoice for the cybersecurity technology or service
- Proof of payment
- For reseller purchases: an invoice identifying the Qualified Maryland Cybersecurity Seller and describing the technology or service purchased
No ongoing reporting. Buyers do not need to maintain records beyond the invoice and proof of payment, and there are no reporting requirements after the credit is claimed.
Sellers
Business standing
- Proof of good standing with the Maryland Department of Assessments and Taxation. A screenshot from Maryland Business Express showing good standing is accepted in place of a paid Certificate of Status.
- Good Standing Certificate from the Comptroller of Maryland - PDF showing the company is current with Maryland tax obligations
- Documentation confirming Maryland headquarters and base of operations
Business plan and financials
A business plan should include, at minimum:
- Executive summary
- History of the entity
- Description of technologies or services
- Intellectual property
- Market analysis
- Product development
- Pricing strategy
- Competition
- Company leadership
- Financials — historical revenues and expenses, present and projected revenues and expenses, with research and development expenses shown separately from sales, general, and administrative expenses
- Appendices as necessary
Intellectual property
Documentation showing patented or patent-pending intellectual property, a license, copyright, trademark, or other evidence of trade secrets.
Ownership certification, if applicable
- Minority Business Enterprise (MBE) certification from the Maryland Department of Transportation — for minority- and women-owned businesses
- For veteran or service-disabled veteran-owned businesses: a copy of the owner’s DD-214 with an attestation of principal ownership, or U.S. Department of Veterans Affairs certification
- HUBZone certification from the U.S. Small Business Administration. Check an address on the SBA HUBZone Map.
Commerce may request additional documentation to verify eligibility.
How to Apply
Buyers
- Identify a Qualified Maryland Cybersecurity Seller using the current seller list.
- Contact Commerce to confirm the seller has remaining capacity for the tax year.
- Purchase eligible cybersecurity technology or services.
- Apply through the Commerce online portal.
- Receive a Certificate of Approval from Commerce.
- Attach the certificate to your Maryland income tax return.
Online only. Commerce accepts applications only through the online portal. Applications in any other format are not accepted.
Sellers
Cybersecurity companies apply online to be certified as a Qualified Maryland Cybersecurity Seller. Certification must be renewed each year, and applications may be submitted at any time. Online applications are not available at this time. Please reach out directly to the contact listed below.
Application fee: None.
Application Review Timeline
- Seller certification: approximately 60 days
- Seller recertification: approximately 60 days
- Buyer tax credit certification: approximately 60 days
Processing times are estimates and depend on submission of a complete application with all required documentation.
How You Claim the Credit
After Commerce approves the application, the business receives a Certificate of Approval.
- Attach the certificate to the Maryland income tax return filed with the Comptroller of Maryland.
- Claim the credit for the same tax year in which the cybersecurity purchase was made.
Frequently Asked Questions
Buy Maryland Cybersecurity FAQs
Sellers are certified by Commerce. Check the current list of Qualified Maryland Cybersecurity Sellers before purchasing.
Once $200,000 in credits have been claimed for purchases from a single seller in a tax year, additional purchases from that seller are not eligible that year. Contact Cindy Zeng at Commerce to confirm a seller’s remaining capacity before completing a purchase or a buyer application.
Yes, provided both are eligible purchases. The combined credit is still capped at $50,000 per buyer per year, so combined purchases above $100,000 do not generate additional credit.
No. Taxes and fees must be subtracted from the purchase price before the credit is calculated.
If the contract is paid in full at the start, the credit is based on the full amount paid, up to the $50,000 cap. If it is paid in installments, only the amounts actually paid during that tax year are eligible. A company may apply again the following year for payments made in that year.
Yes, if the technology or service originated from a Qualified Maryland Cybersecurity Seller. The purchase price is reduced by 20% before the 50% credit is calculated. The reseller’s invoice must name the Qualified Maryland Cybersecurity Seller and describe what was purchased.
Buyers need only the invoice and proof of payment. There are no reporting requirements after the credit is claimed.
No. A cybersecurity company may apply for certification at any time during the year. Certification lasts one year and must be renewed annually.
No. A seller may offer technologies alone, services alone, or both.
Legal Notices and Required Language
This credit is authorized under Maryland Tax-General Article §10-733.1 (Purchase of Cybersecurity Technology and Cybersecurity Service). Tax credits are subject to annual funding availability and statutory limits.
Program resources:
- Statute — Buy Maryland Cybersecurity §10-733.1 (PDF) - PDF - 150.48 KB
- Buy Maryland Cybersecurity application portal
- Current list of Qualified Maryland Cybersecurity Sellers
- NIST Cybersecurity Framework: Framework Core (PDF) - PDF
Cybersecurity resources for small businesses:
- Stop.Think.Connect. Small Business Resources (U.S. Department of Homeland Security)
- Small Business Information Security: The Fundamentals (PDF) - PDF (NIST)
- Maryland Defense Cybersecurity Assistance Program
Applicants should consult the statute and applicable regulations for the complete legal requirements governing this tax credit.
Contact
Cindy Zeng
Tax Specialist
Maryland Department of Commerce
Office of Finance Programs
Email: [email protected]
Phone: 410-767-6351