Sign In

Cybersecurity Investment Incentive Tax Credit (CIITC)

View the FY 2020 Unofficial Queue.

CIITC provides a refundable income tax credit to Qualified Investors who invest in Qualified Maryland Cybersecurity Companies (QMCCs). The purpose of this program is to attract investment in Maryland cybersecurity companies in order to help them grow, create jobs, and retain intellectual property in Maryland.​

New Policy Effective January 1, 2020
An investment does not include any transaction in which a purchase of an interest in a qualified Maryland cybersecurity company is to be financed, in whole or part, by the qualified Maryland cybersecurity company (or any of its subsidiaries).  This would include a transaction in which a potential investor has agreed to pay any portion of the tax credit to the qualified Maryland cybersecurity company.


Qualified Investors receive a credit equal to 33% of an eligible investment in a QMCC. There is a limit of $250,000 for the tax credit for a Qualified Investor in a fiscal year. A QMCC may not receive total credits exceeding 15% of the total program appropriation for each fiscal year. Total credits issued during the fiscal year cannot exceed the budget amount and are, therefore, issued on a first come basis. The credit is refundable to the extent that the amount of the credit exceeds the Qualified Investor's Maryland income tax liability.

For Qualified Investors who invest in a QMCC located in Allegany, Dorchester, Garrett or Somerset Counties, the amount of the credit is 50% of the investment in the QMCC, not to exceed $500,000.


A qualified investor is an individual or entity that invests at least $25,000 in a QMCC and is required to file an income tax return in any jurisdiction.

A QMCC is a company that meets the following requirements and has been certified by the Department of Commerce (Commerce):

  • Is a going concern, organized for profit, and engaged primarily in the development of innovative and proprietary cybersecurity technology;
  • Has its headquarters and base of operations in Maryland;
  • Has an aggregate capitalization of at least $100,000;
  • Has fewer than 50 employees;
  • Has not participated in the CIITC no more than 2 fiscal years;
  • Has no publicly traded securities on any exchange; and 
  • Is in good standing with the Department of Assessments and Taxation and is current on the payment of all tax obligations and not in default under any contract with the State of Maryland or any of its units or subdivisions.

Note: Cybersecurity technology means products or goods intended to detect or prevent activity intended to result in unauthorized access to, exfiltration of, manipulation of, or impairment to the integrity, confidentiality, or availability of an information system or information stored on or transiting an information system.


Beginning on May 15, 2019, Commerce will accept Form B applications for companies to be pre-qualified as a QMCC. Pre-qualification applications will be accepted through May 22 , 2019.  Commerce will review pre-qualification requests as soon as completed Form B applications have been received and will send pre-qualification out no later than June 10, 2019.

Please submit Form B applications to Commerce's office: Tax Incentives Group, Cybersecurity Investment Incentive Tax Credit, 401 E. Pratt Street, 17th Floor, Baltimore, MD 21202, or apply via the Cybersecurity Incentive Investment Tax Credit Online Portal.


Beginning June 3, 2019, Commerce will be accepting completed Investor Forms A.1, A.2 or A.3, and Form B applications at Commerce's office: Tax Incentives Group, Cybersecurity Investment Incentive Tax Credit, 401 E. Pratt Street, 17th Floor, Baltimore, MD 21202, or via the Cybersecurity Incentive Investment Tax Credit Online Portal.

Commerce will accept applications from investors to enable participation in the electronic filing process that takes place starting on July 1, 2019.  

To qualify for the credit, please complete and submit the CIITC application forms to the Department of Commerce. Include Investor Form (Form A1, A2 or A3) and the QMCC Form (Form B).

Qualified Investor Forms:

  •  Form A1​ – Qualified Investor, Individual 
  •  Form A2 – Qualified Investor, Corporation (all kinds including Sub-Chapter S)
  •  Form A3 – Non Sub-Chapter S Corporation Pass-Through Entities

Qualified Maryland Cybersecurity Company Form B for FY2020:

  • Form B​​​ – Print out and submit via hard copy.

    Note: Multiple Attachment 11 (Form B) is not required for investor applications if prospective QMCC has a current Form B on file with the Department of Commerce and is less than 30 days old.

Certification Process

  1. June 3, 2019: Completed applications with all attachments will be accepted at the Department of Commerce (ATTN: Tax Incentives) offices located at 401 E. Pratt Street, 17th Floor, Baltimore, MD 21202, or via the Cybersecurity Incentive Investment Tax Credit Online PortalA User Name and Reference Number will be issued within 72 hours for applications received by June 24, 2019. Applications received after June 24, 2019, will have a User Name and Reference Number issued after July 1, 2019.

  2. The second step of the application process will require that the User Name and Reference Number be used to complete the submission electronically beginning at 9:00 am EDT on July 1, 2019 through the website.

  3. Submission order of the applications will be determined by "first come, first served" based ONLY on the electronic submission of the User Name and Reference Number. No physical application can be filed for purposes of the ordering of first come first served.

  4. Multiple submissions by an applicant using the same user name and reference number will be considered filed at the date and time of the LAST submission. This rule is to maintain that the application procedure is as fair and equitable as possible.

  5. Any decision made by Commerce during the application process is considered final.

Investor applications are reviewed and approved in the order received. After receiving a fully completed application, Commerce will either issue an initial tax credit certificate certifying the amount of an approved tax credit to a Qualified Investor or reject the application. A Qualified Investor has 30 days after the date Commerce issues the initial tax credit certificate to make an investment in the QMCC. Within 10 days after making the investment, the QMCC must provide written notice of the investment, with supporting documentation, to Commerce. If the QMCC fails to provide a notice of investment to Commerce within 40 days after the issuance of the initial tax credit certificate Commerce will rescind the initial tax credit certificate. Based upon the actual investment, Commerce will issue a final tax credit certificate.

Note: If a login window opens prompting you to input a user name/password, close the login window to continue opening the form. Once the form is open, please remember to save it to your computer before changing or completing the form.



For more information about CIITC contact:

Jason Sobel, Tax Specialist
Office of Finance Programs
(410) 767-4980

Vince DeFrancisci, Director
Cybersecurity and Aerospace
(410) 767-2368