Buy Maryland Cybersecurity Tax Credit (BMC)

Buy Maryland Cybersecurity Tax Credit (BMC) is sponsored by Maryland Department of Commerce. This tax credit helps small Maryland businesses offset the cost of buying cybersecurity technology and services from Maryland-based cybersecurity companies. A Qualified Maryland Company may claim a tax credit for 50% of the net purchase price.

Buy Maryland Cybersecurity Tax Credit (BMC) | Maryland Department of Commerce Buy Maryland Cybersecurity Tax Credit (BMC) About this page. This page explains the Buy Maryland Cybersecurity Tax Credit in plain language. The credit is authorized under Maryland Tax-General Article §10-733.

1 (Purchase of Cybersecurity Technology and Cybersecurity Service). A copy of the statute is available here - PDF . If anything on this page conflicts with the statute or regulations, the statute and regulations control.

Important — some sellers have reached their cap for tax year 2026 Certain Qualified Maryland Cybersecurity Sellers have reached their statutory cap for tax year 2026. Commerce is no longer able to award tax credits to buyers who made purchases from those sellers in tax year 2026. Contact Cindy Zeng to confirm a seller's remaining capacity before completing a buyer application.

The program is currently active. Commerce may award up to $4 million in tax credits each tax year , subject to available funding. Credits are awarded on a first-come, first-served basis until funding is exhausted.

Individual sellers also have their own annual cap, and some reach it before the end of the tax year. Confirm seller availability with Commerce before applying. The Buy Maryland Cybersecurity Tax Credit helps small Maryland businesses strengthen their cybersecurity protections by offsetting the cost of buying cybersecurity technology and services from Maryland-based cybersecurity companies.

A Qualified Maryland Company may claim a tax credit for 50% of the net purchase price of cybersecurity technologies and services bought from a Qualified Maryland Cybersecurity Seller. The program also supports the growth of Maryland’s cybersecurity industry. It was created in 2018.

The program involves two parties , each with its own eligibility rules and application.

Buyers — Qualified Maryland Companies Maryland businesses that: have fewer than 50 employees in Maryland are required to file a Maryland income tax return purchase cybersecurity technology or services from a certified Qualified Maryland Cybersecurity Seller Sellers — Qualified Maryland Cybersecurity Sellers Maryland cybersecurity companies certified by Commerce.

Certification makes their products and services eligible for the credit, which encourages Maryland businesses to buy from them. Qualified Maryland Company. A buyer with fewer than 50 employees in Maryland that is required to file a Maryland income tax return.

A company certifies its employee count and filing requirement when it applies for the credit. Qualified Maryland Cybersecurity Seller.

A for-profit company certified by Commerce that is primarily engaged in developing innovative and proprietary cybersecurity technology or providing cybersecurity service, has its headquarters and base of operations in Maryland, owns or properly licenses what it sells, and meets at least one of the size or ownership criteria described under Seller eligibility. Reseller.

Any company selling cybersecurity technologies or services that is not itself a certified Qualified Maryland Cybersecurity Seller. Purchases through a reseller can qualify, at a reduced amount, if the product or service originated from a Qualified Maryland Cybersecurity Seller. Net purchase price.

The purchase price after taxes and fees are subtracted. The credit is calculated on the net amount.

Program Duration and Limits Limit Amount Applies to Statewide annual funding $4,000,000 All applicants combined Technology purchases (75%) Maximum credit per buyer per year Equal to $100,000 in eligible purchases Maximum credits generated per seller per year Equal to $400,000 in eligible sales Funding is split by purchase type: 75% of the annual amount is available for cybersecurity technology purchases and 25% is earmarked for cybersecurity service purchases.

Seller caps matter to buyers. Once $200,000 in credits have been claimed for purchases from a single seller in a tax year, additional purchases from that seller are not eligible for the credit that year — even if statewide funding remains. Check with Commerce before buying.

Seller certification is valid for one year and must be renewed annually. The credit equals 50% of the net purchase price Maximum credit per buyer per tax year: $50,000 Maximum eligible purchases per buyer per tax year: $100,000 Example. A $40,000 cybersecurity purchase produces a $20,000 credit.

Example. A $100,000 purchase produces a $50,000 credit — the maximum. Purchases above $100,000 in a single tax year do not generate additional credit.

Example. A company buys both technology and a service from a Qualified Maryland Cybersecurity Seller. Both are eligible, but the combined credit is still capped at $50,000 per year.

Taxes and fees. Taxes and fees must be subtracted from the purchase price before calculating the credit. The credit must be claimed for the same tax year in which the purchase was made , and Commerce must approve it before it can be claimed.

Purchases through resellers Purchases made through third-party resellers may qualify if the product or service originated from a Qualified Maryland Cybersecurity Seller. When purchasing through a reseller: The purchase price is reduced by 20% before the credit is calculated. This reflects Commerce’s estimate of the reseller markup.

The 50% credit is then applied to the reduced amount. Example. A $50,000 reseller purchase is reduced by 20% to $40,000.

The credit is 50% of $40,000 = $20,000 . The invoice from the reseller must identify: the name of the Qualified Maryland Cybersecurity Seller, and a description of the cybersecurity technology or service purchased Extended service contracts How the credit is calculated depends on how the contract is paid: Paid in full up front: the credit is based on the full amount paid, up to the $50,000 annual cap.

Paid in installments: only the amounts actually paid during that tax year are eligible. Example. A company signs a one-year cybersecurity service contract on July 1 with monthly payments of $1,000.

Only the payments made that calendar year count — six months of payments, or $6,000 in eligible purchases. The company may apply again the following year for payments made in that year.

Key Eligibility Requirements Have fewer than 50 employees in Maryland Be required to file a Maryland income tax return Purchase eligible cybersecurity technology or services Purchase from a Qualified Maryland Cybersecurity Seller (or from a reseller, where the product originated with a qualified seller) Eligible cybersecurity technology Eligible technology includes proprietary goods and products designed to protect information systems, electronically stored data, and data transferred between information systems — including products designed to detect or prevent: Unauthorized access to information systems, stored data, or data in transfer Data exfiltration or extrusion Manipulation or impairment of the integrity, confidentiality, or availability of data stored or transferred by an information system Eligible cybersecurity services To qualify, the seller must primarily perform an activity identified in the National Institute of Standards and Technology’s most recent Cybersecurity Framework: Framework Core - PDF .

To be certified as a Qualified Maryland Cybersecurity Seller, a company must: Be primarily engaged in cybersecurity — at least 51% of its business must be developing innovative and proprietary cybersecurity technology or providing cybersecurity service Maintain its headquarters and base of operations in Maryland Own or properly license the cybersecurity technology or service offered Be in good standing with the Maryland Department of Assessments and Taxation and current with all Maryland tax obligations The company must also meet at least one of the following: Have less than $5 million in annual revenue Be service-disabled veteran-owned Be located in a Historically Underutilized Business (HUBZone) A seller may sell technologies alone, services alone, or both.

Certification is valid for one year and must be renewed annually. There is no deadline — a company may apply for certification at any time during the year.

Documents You Will Need to Apply Applicants should be prepared to provide: A copy of the invoice for the cybersecurity technology or service For reseller purchases: an invoice identifying the Qualified Maryland Cybersecurity Seller and describing the technology or service purchased No ongoing reporting.

Buyers do not need to maintain records beyond the invoice and proof of payment, and there are no reporting requirements after the credit is claimed. Proof of good standing with the Maryland Department of Assessments and Taxation . A screenshot from Maryland Business Express showing good standing is accepted in place of a paid Certificate of Status.

Good Standing Certificate from the Comptroller of Maryland - PDF showing the company is current with Maryland tax obligations Documentation confirming Maryland headquarters and base of operations Business plan and financials A business plan should include, at minimum: Description of technologies or services Financials — historical revenues and expenses, present and projected revenues and expenses, with research and development expenses shown separately from sales, general, and administrative expenses Ownership certification, if applicable Minority Business Enterprise (MBE) certification from the Maryland Department of Transportation — for minority- and women-owned businesses For veteran or service-disabled veteran-owned businesses: a copy of the owner’s DD-214 with an attestation of principal ownership, or U.S. Department of Veterans Affairs certification HUBZone certification from the U.S. Small Business Administration.

Check an address on the SBA HUBZone Map . Commerce may request additional documentation to verify eligibility. Identify a Qualified Maryland Cybersecurity Seller using the current seller list .

Contact Commerce to confirm the seller has remaining capacity for the tax year. Purchase eligible cybersecurity technology or services. Apply through the Commerce online portal .

Receive a Certificate of Approval from Commerce. Attach the certificate to your Maryland income tax return. Online only.

Commerce accepts applications only through the online portal. Applications in any other format are not accepted. Cybersecurity companies apply online to be certified as a Qualified Maryland Cybersecurity Seller.

Certification must be renewed each year, and applications may be submitted at any time. Online applications are not available at this time. Please reach out directly to the contact listed below.

Application Review Timeline Seller certification: approximately 60 days Seller recertification: approximately 60 days Buyer tax credit certification: approximately 60 days Processing times are estimates and depend on submission of a complete application with all required documentation. After Commerce approves the application, the business receives a Certificate of Approval .

Attach the certificate to the Maryland income tax return filed with the Comptroller of Maryland. Claim the credit for the same tax year in which the cybersecurity purchase was made. Frequently Asked Questions Buy Maryland Cybersecurity FAQs How do I know if I am buying from a Qualified Maryland Cybersecurity Seller?

Sellers are certified by Commerce. Check the current list of Qualified Maryland Cybersecurity Sellers before purchasing. What if the seller has already reached its cap?

Once $200,000 in credits have been claimed for purchases from a single seller in a tax year, additional purchases from that seller are not eligible that year. Contact Cindy Zeng at Commerce to confirm a seller’s remaining capacity before completing a purchase or a buyer application. Can I claim the credit for both technology and services?

Yes, provided both are eligible purchases. The combined credit is still capped at $50,000 per buyer per year, so combined purchases above $100,000 do not generate additional credit. Are taxes and fees included in the purchase price?

No. Taxes and fees must be subtracted from the purchase price before the credit is calculated. How is the credit calculated for an extended service contract? If the contract is paid in full at the start, the credit is based on the full amount paid, up to the $50,000 cap.

If it is paid in installments, only the amounts actually paid during that tax year are eligible. A company may apply again the following year for payments made in that year. Can I claim the credit if I buy through a reseller?

Yes, if the technology or service originated from a Qualified Maryland Cybersecurity Seller. The purchase price is reduced by 20% before the 50% credit is calculated. The reseller’s invoice must name the Qualified Maryland Cybersecurity Seller and describe what was purchased.

What records do I need to keep? Buyers need only the invoice and proof of payment. There are no reporting requirements after the credit is claimed.

Is there a deadline for seller certification? No. A cybersecurity company may apply for certification at any time during the year. Certification lasts one year and must be renewed annually.

Does a seller have to offer both technology and services? No. A seller may offer technologies alone, services alone, or both. Legal Notices and Required Language This credit is authorized under Maryland Tax-General Article §10-733.

1 (Purchase of Cybersecurity Technology and Cybersecurity Service). Tax credits are subject to annual funding availability and statutory limits. Buy Maryland Cybersecurity application portal Current list of Qualified Maryland Cybersecurity Sellers NIST Cybersecurity Framework: Framework Core (PDF) - PDF Cybersecurity resources for small businesses: Stop.

Think. Connect. Small Business Resources (U.S. Department of Homeland Security) Small Business Information Security: The Fundamentals (PDF) - PDF (NIST) Maryland Defense Cybersecurity Assistance Program Applicants should consult the statute and applicable regulations for the complete legal requirements governing this tax credit.

Maryland Department of Commerce Office of Finance Programs