How to Sell a Defense Contractor Business: 7-10x EBITDA, ITAR/CMMC 2.0, and Named PE Buyers (2026)

Defense contractor M&A in 2026 is a structurally different game than general industrial M&A. EBITDA multiples of 7-10x reflect 5-year DoD budget visibility ($895B FY2025 enacted, projected continued growth), ITAR/CMMC 2.0 barriers to entry that take 18-36 months to clear, security clearance moats (cleared facilities, cleared personnel, multi-year program incumbency), and a buyer pool dominated by defense-focused PE platforms and prime contractor M&A teams who pay premium pricing for compliant, incumbent assets.

This guide is for owners of defense contractor businesses with $1M-$25M of EBITDA. We’ll walk through realistic multiples by sub-vertical (prime contract incumbents, subcontractors, IDIQ holders, commercial dual-use), the named buyers actively acquiring (AE Industrial Partners, Liberty Hall Capital Partners, Arlington Capital Partners, Veritas Capital), the specific compliance requirements buyers diligence (ITAR, CMMC 2.0, DCAA, DFARS, NIST SP 800-171), and the preparation steps that materially shift outcome.

The framework draws on direct work with 76+ active U.S. lower middle market buyers including 38 manufacturing-focused capital partners. We’re a buy-side partner. The buyers pay us when a deal closes — not you. That includes defense-focused PE platforms (AE Industrial Partners, Liberty Hall Capital Partners, Arlington Capital Partners, Veritas Capital, GTCR’s defense portfolio), industrial PE with defense experience (Audax Group, Atlas Holdings), prime contractors (Lockheed Martin, Raytheon Technologies, General Dynamics, Northrop Grumman, BAE Systems Inc., L3Harris Technologies), and family offices targeting defense exposure.

One realistic note before you start. The 7-10x range applies to compliant defense contractors with verifiable ITAR, CMMC 2.0, DCAA, and DFARS compliance status, plus prime contract or strong subcontractor incumbency on multi-year programs. Businesses that “serve the defense industry” without ITAR registration, CMMC certification, or named program participation trade closer to general industrial multiples (5-7x EBITDA). Compliance status is the gating differentiator.

“Defense contractor M&A is a different game than general industrial. ITAR registration, CMMC 2.0 certification, DCAA compliance, and security clearance maintenance create real barriers to entry that PE buyers explicitly value. The owners who realize 8.5-10x EBITDA are the ones who built the regulatory and program incumbency moats systematically over years — and went to market through buy-side partners who already know the named defense PE platforms and prime contractor M&A teams. The right answer is a buy-side partner who knows the defense buyers, not a broker selling them a process.”

Key Takeaways

• Defense contractor multiples by sub-vertical: prime contract incumbents 9-10x; subcontractors to primes 7.5-9x; IDIQ contract holders 7-8.5x; commercial dual-use 6-7.5x.
• Active buyers: AE Industrial Partners, Liberty Hall Capital Partners, Arlington Capital Partners, Veritas Capital, GTCR defense portfolio, plus primes Lockheed Martin (NYSE: LMT), Raytheon Technologies (NYSE: RTX), General Dynamics (NYSE: GD), Northrop Grumman (NYSE: NOC), BAE Systems Inc.
• ITAR registration with DDTC (U.S. State Dept Directorate of Defense Trade Controls) is gating for export-controlled defense work. EAR 15 CFR 730-774 governs dual-use exports.
• CMMC 2.0 certification levels 1, 2, or 3 required by program. Level 2 (110 NIST SP 800-171 controls) is the most common requirement for primes’ supply chains.
• DCAA-compliant accounting systems required for cost-plus contracts. DFARS 252.204-7012 cybersecurity, NIST SP 800-171 implementation, FAR Part 15 cost accounting standards (CAS) for larger contractors.
• Security clearance moats: facility clearance (FCL), personnel clearance counts and levels (Secret/Top Secret/SCI). Cleared workforce typically takes 12-24 months to build.

Why defense contractors trade at premium multiples

Defense contractor EBITDA multiples of 7-10x reflect three structural advantages over general industrial businesses. First, end-market budget visibility: the DoD operates on 5-year Future Years Defense Program (FYDP) plans, with FY2025 enacted at $895B and projected continued growth. This budget visibility gives PE buyers underwriting confidence that general industrial buyers don’t have. Second, ITAR/CMMC 2.0 barriers to entry: becoming a compliant defense contractor takes 18-36 months and significant investment, creating moats that buyers explicitly value.

Third, program incumbency moats. Once a contractor wins a multi-year defense program, displacement is rare. The qualified-supplier infrastructure (security clearances, ITAR registration, CMMC certification, DCAA accounting systems, customer-specific qualifications) is hard to replicate. Multi-year programs (5-10 year IDIQ contracts, 10-20 year platform programs) provide revenue visibility that PE buyers price into multiples.

DoD budget environment and re-shoring tailwinds. FY2025 enacted DoD budget: $895B. National Defense Authorization Act (NDAA) typically grows 3-5% annually. Strategic priorities driving spending: hypersonics, artificial intelligence, autonomous systems, microelectronics (CHIPS Act overlap), shipbuilding, munitions production capacity. Defense Industrial Base (DIB) re-shoring driven by China competition strategy. PE platforms specifically targeting re-shoring exposure pay premium multiples.

Where the 7-10x range has limits. The 7-10x multiple applies to compliant defense contractors with verifiable program participation. Businesses described as “defense supply chain” without ITAR registration, CMMC certification, or named program participation trade at 5-7x EBITDA — closer to general industrial multiples. Compliance status, program incumbency, and security clearance documentation are gating differentiators that determine where in the 5-10x range a business actually lands.

Sub-vertical multiples: prime incumbents vs subcontractors vs IDIQ holders

Within defense contracting, multiples vary 2-3x EBITDA by program type and incumbency. Prime contract incumbents trade at the top. Subcontractors to primes in the upper-middle. IDIQ contract holders in the middle. Commercial dual-use businesses at the bottom. Knowing your program portfolio shapes positioning to buyers.

Prime contract incumbents: 9-10x EBITDA. Companies holding prime contracts directly with DoD (Army, Navy, Air Force, Marine Corps, Space Force, Coast Guard) on multi-year programs. Highest multiple category because of revenue visibility and customer relationship depth. Active buyers: AE Industrial Partners (defense PE focus), Liberty Hall Capital Partners (aerospace and defense), Arlington Capital Partners (defense and government services). Multiples can reach 10x for category-leading prime contractors with multiple multi-year programs.

Subcontractors to primes: 7.5-9x EBITDA. Companies serving as subcontractors to Lockheed Martin, Raytheon, General Dynamics, Northrop Grumman, BAE Systems, L3Harris, Boeing Defense, Honeywell Aerospace, Textron Systems, and other primes. Strong category because of program stickiness (primes rarely re-source qualified suppliers) and stable cash flow. Active buyers: defense-focused PE plus industrial PE with defense experience plus primes themselves for strategic acquisitions.

IDIQ contract holders: 7-8.5x EBITDA. Companies holding IDIQ (Indefinite Delivery, Indefinite Quantity) contracts and BPAs (Blanket Purchase Agreements) with DoD or federal agencies (DoE, DHS, NASA). Revenue visibility depends on task order issuance rate and customer relationship. Strong IDIQ ceiling capacity ($100M+) and consistent task order issuance drive top-of-range multiples. Active buyers: defense PE plus government services PE.

Commercial dual-use businesses serving defense: 6-7.5x EBITDA. Companies primarily serving commercial customers with defense exposure as a percentage of revenue. Lower multiple because of less revenue visibility and weaker incumbency. Strong defense percentage (30%+) and named program participation drive top-of-range multiples. Active buyers: defense PE for businesses with growth runway in defense; industrial PE for businesses with primarily commercial focus.

Defense sub-vertical	Multiple range	Customer relationships	Active buyers
Prime contract incumbents	9-10x EBITDA	DoD direct, multi-year programs	AE Industrial, Liberty Hall, Arlington Capital
Subcontractors to primes	7.5-9x EBITDA	Lockheed, Raytheon, GD, Northrop, BAE	Defense PE + industrial PE + primes
IDIQ contract holders	7-8.5x EBITDA	DoD, DoE, DHS, NASA IDIQ contracts	Defense PE + gov services PE
Commercial dual-use w/ defense	6-7.5x EBITDA	30%+ defense revenue	Industrial PE, defense PE for growth runway
Pure commercial supplier	5-7x EBITDA	<30% defense revenue, no programs	General industrial PE

Who actually buys defense contractor businesses in 2026

The 2026 defense contractor buyer pool divides into four archetypes with different deal economics. Defense M&A is dominated by specialized buyers because of the regulatory complexity. Generalist PE platforms typically don’t pursue defense contractors unless they have prior defense industry experience. The buyers who do pursue are defense-experienced and pay premium multiples within the structural ranges.

Archetype 1: Defense-focused PE platforms. AE Industrial Partners (defense and aerospace focus, multiple platforms). Liberty Hall Capital Partners (aerospace and defense focus). Arlington Capital Partners (defense and government services focus). Veritas Capital (defense and government services). GTCR’s defense portfolio. The Carlyle Group’s defense and aerospace investments. KKR’s defense investments. Multiples: 8-10x EBITDA with rollover equity opportunity. Best fit: $5-50M EBITDA defense contractors with verifiable program participation.

Archetype 2: Industrial PE platforms with defense experience. Audax Group (defense and industrial portfolio). Atlas Holdings (precision components for defense). Wynnchurch Capital (industrial defense). Sterling Investment Partners (defense and industrial). Trive Capital (specialty manufacturing including defense). Multiples: 7-9x EBITDA. Best fit: $3-25M EBITDA defense contractors that fit broader industrial portfolio thesis.

Archetype 3: Prime contractors (strategic M&A). Lockheed Martin (NYSE: LMT), Raytheon Technologies (NYSE: RTX), General Dynamics (NYSE: GD), Northrop Grumman (NYSE: NOC), BAE Systems Inc., L3Harris Technologies (NYSE: LHX), Boeing Defense (subsidiary of NYSE: BA), Textron Systems (subsidiary of NYSE: TXT), Honeywell Aerospace (subsidiary of NYSE: HON). Multiples: 8-12x EBITDA for strategic acquisitions, often all-cash structures. Best outcome if positioning aligns with prime’s strategic priorities. Limited to specific capability acquisitions.

Archetype 4: Government services consolidators. Companies like Booz Allen Hamilton (NYSE: BAH), CACI International (NYSE: CACI), Leidos (NYSE: LDOS), ManTech International, Engility, Vectrus, V2X (NYSE: VVX), and Amentum acquire defense services contractors strategically. Multiples: 8-11x EBITDA depending on strategic fit. Best for IT services, professional services, and engineering services contractors. Less applicable to manufacturing-focused defense contractors.

Buyer type	Cash at close	Rollover equity	Exclusivity	Best fit for
Strategic acquirer	High (40–60%+)	Low (0–10%)	60–90 days	Sellers who want a clean exit; competitor or upstream consolidator
PE platform	Medium (60–80%)	Medium (15–25%)	60–120 days	Sellers willing to hold rollover for the second sale; bigger deals
PE add-on	Higher (70–85%)	Low–Medium (10–20%)	45–90 days	Sellers folding into existing platform; faster process
Search fund / ETA	Medium (50–70%)	High (20–40%)	90–180 days	Legacy-conscious sellers wanting an owner-operator successor
Independent sponsor	Medium (55–75%)	Medium (15–30%)	60–120 days	Sellers OK with deal-by-deal capital and longer financing closes

ITAR registration and DDTC compliance

ITAR (International Traffic in Arms Regulations) governs export-controlled defense technology and services. Defense contractors handling ITAR-controlled technical data, manufacturing controlled defense articles, or providing defense services must register with the U.S. State Department’s Directorate of Defense Trade Controls (DDTC). ITAR registration is gating for many defense programs and a key valuation driver.

ITAR registration mechanics. Annual registration with DDTC ($2,250 base fee plus per-event fees). Registration covers manufacturing, exporting, brokering, or temporary import of defense articles or services on the U.S. Munitions List (USML). Categories I-XXI of USML cover firearms, ammunition, missiles, aircraft, surface vessels, ground vehicles, military electronics, etc. Most defense contractors operate under multiple USML categories.

Technical Assistance Agreements (TAA) and Manufacturing License Agreements (MLA). Cross-border defense work requires TAA or MLA approval from DDTC, often taking 6-12 months for approval. Foreign person disclosure controls govern ITAR-cleared facility access. Foreign-owned, foreign-controlled, or foreign-influenced (FOCI) entities face heightened scrutiny. Buyer-side ITAR compliance review during diligence verifies registration status, USML categories, technical data protection, and FOCI status.

Buyer-side concerns at acquisition. When a non-cleared buyer acquires an ITAR-registered contractor, DDTC notification is required. Foreign-owned acquirers face FOCI mitigation requirements (Special Security Agreement, Voting Trust Agreement, Proxy Agreement) that can take 6-18 months to negotiate with DCSA (Defense Counterintelligence and Security Agency). Most defense PE platforms are U.S.-controlled to avoid FOCI complications. Assess buyer FOCI status during outreach to avoid wasted process time.

CMMC 2.0 certification and cybersecurity requirements

CMMC 2.0 (Cybersecurity Maturity Model Certification) is the DoD’s framework for cybersecurity requirements across the Defense Industrial Base. CMMC 2.0 has three certification levels with increasing requirements. CMMC 2.0 certification is required to bid on or perform DoD contracts handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). Implementation timeline: phased rollout through 2027-2028 across DoD contracts.

CMMC 2.0 certification levels. Level 1 (Foundational): self-assessment, 17 basic cybersecurity practices, required for all contracts handling FCI. Level 2 (Advanced): 110 controls aligned with NIST SP 800-171, required for contracts handling CUI, third-party assessment by C3PAO (Certified Third-Party Assessment Organization). Level 3 (Expert): subset of NIST SP 800-172 enhanced security requirements, required for highest-priority programs, government-led assessment.

CMMC 2.0 readiness as valuation driver. Level 2 CMMC 2.0 certification: 0.25-0.5x EBITDA premium relative to non-certified competitors. Level 3 certification: 0.5-1x premium for the limited businesses qualifying. Level 1 self-assessment: table stakes for any defense work involving FCI. Investment to achieve Level 2 certification: typically $250K-$1.5M depending on starting cybersecurity maturity. ROI horizon: 18-36 months through expanded program eligibility.

DFARS 252.204-7012 and NIST SP 800-171 implementation. DFARS 252.204-7012 has been mandatory since 2017 for contracts handling CUI. Requires implementation of all 110 NIST SP 800-171 controls, incident reporting within 72 hours of cyber incident, and flow-down to subcontractors. CMMC 2.0 Level 2 essentially formalizes third-party verification of NIST SP 800-171 implementation. Documentation: System Security Plan (SSP), Plan of Action and Milestones (POA&M), incident response plans.

Fee structure	Math	Fee on $5M	% of deal
Standard Lehman	5/4/3/2/1 on first $1M / next $1M / etc.	$150K	3.0%
Modified Lehman (Double)	10/8/6/4/2	$300K	6.0%
Flat 8% commission	Common Main Street broker rate	$400K	8.0%
Flat 10% (sub-$2M deals)	Some brokers on smaller deals	$500K	10.0%
Buy-side partner	Buyer pays the partner; seller pays nothing	$0	0.0%

DCAA compliance and government contract accounting

Defense contractors with cost-reimbursement contracts must maintain DCAA-compliant accounting systems. DCAA (Defense Contract Audit Agency) audits contractor accounting systems for compliance with FAR Part 31 cost principles, Cost Accounting Standards (CAS), and contract-specific cost allowability requirements. DCAA-compliant accounting is required for cost-plus-fixed-fee, cost-plus-incentive-fee, and time-and-materials contracts.

DCAA-acceptable accounting system requirements. Job cost accounting capability (revenue and costs tracked by contract). Indirect cost rate calculation (overhead, fringe, G&A pools and allocation bases). Timekeeping systems with daily entries and supervisory approval. Cost allowability review processes. Documented accounting policies and procedures. Most defense contractors use Deltek Costpoint, Unanet, JAMIS Prime, or similar government contract accounting systems — QuickBooks alone is generally insufficient for cost-plus contract DCAA compliance.

Cost Accounting Standards (CAS) coverage. CAS coverage applies to contractors with $50M+ in CAS-covered contracts (full coverage) or $7.5M+ (modified coverage). CAS imposes 19 standards governing cost accounting practices. CAS-covered contractors face higher DCAA scrutiny and more complex cost accounting requirements. CAS coverage status during diligence affects buyer’s integration cost estimates.

DCAA audit history as valuation factor. Recent DCAA audits with no material findings: 0.1-0.25x EBITDA premium (signals operational maturity). Recent DCAA findings of significant deficiencies or material weaknesses: 0.25-1x discount until remediated. Disallowed costs from prior audits: dollar-for-dollar reduction to net deal value. Open DCAA audits: deal-stalling diligence issue, may require escrow holdbacks for resolution.

Security clearances: facility and personnel clearance moats

Security clearances at the facility level (FCL) and personnel level represent significant valuation moats for defense contractors. Facility Clearance (FCL) at Confidential, Secret, or Top Secret levels takes 12-24 months to obtain through DCSA. Personnel clearances at Secret or Top Secret typically take 6-18 months per individual. Sensitive Compartmented Information (SCI) access takes additional time. Cleared workforce represents irreplaceable invested capital.

Clearance documentation as valuation driver. FCL level (Confidential / Secret / Top Secret / TS-SCI): each level adds incremental valuation premium. Cleared employee count by level: Secret-cleared headcount, Top Secret-cleared headcount, TS-SCI-cleared headcount. Active program work requiring clearance access: documents the operational use of clearances. Cleared facility square footage and capabilities (SCIF — Sensitive Compartmented Information Facility — if applicable).

FOCI mitigation in M&A transactions. Foreign-owned, foreign-controlled, or foreign-influenced acquirers must implement FOCI mitigation per DCSA requirements. Common structures: Special Security Agreement (SSA, board-level government oversight), Voting Trust Agreement (VTA, voting rights held by U.S. trustees), Proxy Agreement (shareholder rights exercised by U.S. proxy holders). FOCI mitigation can take 6-18 months and significantly affects deal economics. Most defense PE platforms are U.S.-controlled to avoid FOCI.

Clearance retention through transaction. Cleared employees may face clearance review or transfer requirements when ownership changes. Continuous clearance maintenance during transition is critical for program continuity. Buyers often require key cleared personnel retention agreements (12-24 months) at close. Plan clearance continuity carefully through diligence and close.

Customer concentration and program portfolio analysis

Customer concentration in defense contracting is treated differently than general industrial concentration. Single-customer concentration with DoD on multi-year programs is often less concerning than single-customer concentration in general industrial because the customer (DoD) has high credit quality, multi-year visibility, and program-level revenue stickiness. But single-program concentration on a single platform raises program risk, which is a different concern.

Program concentration thresholds. Single program below 30% of revenue: clean. 30-50%: moderate discount (0.25-0.5x EBITDA), often with program-retention earnout. 50-70%: 0.5-1x discount plus structural protections. Above 70%: 1-1.5x discount plus program-specific protections. Program risk drivers: program lifecycle stage (early development higher risk than production stage), congressional funding stability, technology obsolescence risk, prime contractor health.

Prime contractor concentration. Subcontractors with concentration to single prime (50%+ from Lockheed, Raytheon, GD, Northrop, BAE) face concentration analysis. Multi-prime subcontractors (qualified at multiple primes) get less discount. Prime relationship tenure matters: 10+ year relationships get less discount than 3-year relationships. Prime contract follow-on history (extensions, recompete wins) demonstrates relationship resilience.

IDIQ ceiling capacity vs revenue analysis. IDIQ contractors’ ceiling capacity (theoretical maximum revenue under IDIQ contracts) and historical task order issuance rate matter for revenue forecasting. Buyers analyze IDIQ utilization rate (TTM revenue / ceiling capacity) and task order issuance trends. High utilization with growing task orders signals strong program health; low utilization signals contract underuse risk.

Sale process timeline and defense-specific diligence

A well-prepared defense contractor sale runs 9-14 months from market launch to close at typical LMM size. Longer than general manufacturing because of compliance documentation depth (ITAR, CMMC, DCAA, security clearances), customer reference complexity (cleared programs, classified work confidentiality), and FOCI considerations on buyer side. Add 18-36 months on the front for proper preparation if compliance status, program documentation, and financial reporting aren’t buyer-ready.

Months 1-2: positioning and outreach. Build CIM (35-60 pages with program detail and compliance documentation summary). Position around right buyer archetype (defense PE, industrial PE with defense experience, prime, government services). Outreach to 25-50 potential buyers across categories. Sign defense-grade NDAs (typically more restrictive than general industrial). Narrow to 8-15 management meetings.

Months 2-4: management meetings and IOIs. In-person facility tours (always require physical visits given security requirements and capability demonstration). Customer reference calls late-stage with carefully managed program information disclosure. Receive 4-8 indications of interest. Negotiate exclusivity. Sign LOI.

Months 4-9: diligence. Quality of Earnings ($100-200K, 8-12 weeks). Customer-level revenue and program verification. ITAR compliance review with specialized export controls counsel. CMMC 2.0 / NIST SP 800-171 cybersecurity assessment. DCAA audit history review. DFARS compliance review. Security clearance documentation review. FOCI assessment if buyer is foreign-influenced. Technology and IP diligence. Customer reference calls with continuing-relationship preservation.

Months 9-14: documentation and close. Purchase agreement negotiation. Reps and warranties insurance procurement (typical for $10M+ deals). DDTC notification preparation. DCSA notification for ownership change. FOCI mitigation negotiation if applicable. Employee notification 24-72 hours pre-close. Customer notification per DoD program-specific requirements. Security clearance continuity planning. Facility clearance transfer if structural change.

Earnout type	How it’s measured	Seller risk	When sellers should accept
Revenue-based	Top-line revenue over 12-24 months	Lower	Default seller preference; harder for buyer to manipulate than EBITDA
EBITDA-based	Adjusted EBITDA over the earnout period	High	Avoid if possible; buyer can manipulate via overhead allocations
Customer retention	% of named customers still buying at month 12, 24	Medium	Reasonable for sellers staying on through transition
Milestone-based	Specific deliverables (license transfer, geographic expansion, etc.)	Lower	Seller has control over the deliverable

Common mistakes defense contractor owners make in sale preparation

Mistake 1: under-investing in CMMC 2.0 readiness. Going to market without CMMC 2.0 Level 2 certification when customer mix would qualify. CMMC 2.0 Level 2 certification adds 0.25-0.5x EBITDA premium and unlocks expanded program eligibility. The 12-18 month investment ($250K-$1.5M depending on starting maturity) typically returns 3-5x at exit.

Mistake 2: weak DCAA accounting system. Operating cost-plus contracts without DCAA-acceptable accounting system (Deltek Costpoint, Unanet, JAMIS Prime). Buyer’s diligence finds material weaknesses, multiple compresses 0.25-1x. The 12-24 month investment in proper government contract accounting system typically returns 5-10x at exit.

Mistake 3: ignoring program portfolio concentration. Single-program concentration above 50% without diversification effort. 24-36 months pre-market: pursue program diversification through additional task order proposals, IDIQ contract bids, additional prime relationships. Reduce single-program concentration to below 30% if possible.

Mistake 4: hiring a generalist business broker. Generalist brokers don’t have relationships with AE Industrial Partners, Liberty Hall Capital Partners, Arlington Capital, Veritas Capital, or prime contractor M&A teams. They run a generic auction and the named defense buyers never participate. Sub-optimal: 6-7x EBITDA from generalist bidders when 9-10x was available from defense-savvy buyers.

Mistake 5: revealing classified information improperly. Defense contracting often involves classified program information that cannot be disclosed in marketing materials, NDAs notwithstanding. Premature disclosure of classified information through standard CIM templates creates significant legal and security risks. Defense-experienced buy-side partners manage information staging carefully.

Mistake 6: ignoring FOCI considerations on buyer side. Marketing to foreign-influenced or foreign-owned buyers without addressing FOCI mitigation requirements upfront. FOCI mitigation can take 6-18 months and complicates deals. Pre-screen buyer FOCI status during outreach to avoid wasted process time. Most defense PE platforms are U.S.-controlled to avoid FOCI complications.

Maximizing valuation: the 24-36 month preparation playbook

Defense contractors benefit from longer preparation windows than general manufacturing because compliance certifications, security clearance build-up, and program portfolio diversification take time. Owners who prepare 24-36 months before going to market consistently see 30-50% better outcomes than reactive sellers.

Months 36-24: compliance foundation. ITAR registration current and properly categorized by USML. CMMC 2.0 Level 2 certification engagement with C3PAO assessor. DCAA-acceptable accounting system implementation (Deltek Costpoint, Unanet, etc.) if not in place. NIST SP 800-171 control implementation completion. DFARS 252.204-7012 compliance verification.

Months 24-12: program portfolio and customer relationships. Pursue program diversification: additional task order proposals, IDIQ contract bids, additional prime relationships. Document customer relationship history with specific program participation and tenure data. Strengthen relationship at second prime (e.g., already at Lockheed, build at Raytheon) to reduce concentration.

Months 12-6: workforce and security. Security clearance pipeline: identify candidates for clearance investigation, sponsor process. SCIF capability if customer mix would benefit. Cleared workforce documentation. Workforce capability matrix by program and skill area. DOL apprenticeship program for skilled trades if applicable.

Months 6-0: diligence package preparation. 36 months of tax returns, P&Ls, balance sheets. Government contract accounting reports (job cost, indirect rates, CAS compliance documentation if applicable). Customer revenue indexed by contract, program, prime customer. Backlog and pipeline documentation. ITAR registration documentation. CMMC 2.0 certification status. DCAA audit history. Security clearance documentation. Workforce roster with clearances and tenure.

Conclusion

Defense contractor M&A in 2026 is a different game than general industrial M&A. EBITDA multiples of 7-10x reflect 5-year DoD budget visibility, ITAR/CMMC 2.0 barriers to entry, security clearance moats, and program incumbency that PE buyers explicitly value. The owners who realize the top of that range are the ones who systematically built compliance infrastructure (ITAR registration, CMMC 2.0 certification, DCAA accounting systems, NIST SP 800-171 implementation), program portfolio diversification, security clearance pipelines, and went to market through buy-side partners with defense-specific buyer relationships. The owners who anchor on general industrial comps, rely on generalist brokers who don’t know AE Industrial Partners or Liberty Hall Capital Partners, and ignore CMMC 2.0 readiness typically realize 30-50% less than they could have. If you want to talk to someone who knows the defense buyers personally instead of running an auction, we’re a buy-side partner — the buyers pay us, not you, no contract required.

Frequently Asked Questions

What is a defense contractor business worth in 2026?

Defense contractors sell for 7-10x EBITDA in 2026. By sub-vertical: prime contract incumbents 9-10x; subcontractors to primes 7.5-9x; IDIQ contract holders 7-8.5x; commercial dual-use with defense exposure 6-7.5x. ITAR registration, CMMC 2.0 certification, DCAA compliance, and program incumbency are gating differentiators.

Why do defense contractors trade above general industrial?

Three structural advantages: 5-year DoD budget visibility ($895B FY2025 enacted, projected continued growth), ITAR/CMMC 2.0 regulatory barriers to entry that take 18-36 months to clear, and program incumbency moats with multi-year contracts and security clearance infrastructure that’s hard to replicate.

Who buys defense contractor businesses?

Four archetypes: defense-focused PE (AE Industrial Partners, Liberty Hall Capital Partners, Arlington Capital Partners, Veritas Capital, GTCR defense, Carlyle Group defense), industrial PE with defense experience (Audax Group, Atlas Holdings, Wynnchurch, Sterling), prime contractors (Lockheed, Raytheon, GD, Northrop, BAE, L3Harris, Boeing Defense), and government services consolidators (Booz Allen Hamilton, CACI, Leidos).

What is CMMC 2.0 and why does it matter for valuation?

CMMC 2.0 (Cybersecurity Maturity Model Certification) is DoD’s framework for cybersecurity requirements across the Defense Industrial Base. Three levels: Level 1 (foundational, self-assessment), Level 2 (advanced, NIST SP 800-171, third-party assessed), Level 3 (expert, NIST SP 800-172). Level 2 certification adds 0.25-0.5x EBITDA premium and unlocks expanded program eligibility.

What is ITAR and how does it affect a sale?

ITAR (International Traffic in Arms Regulations) governs export-controlled defense technology. Defense contractors handling ITAR-controlled work must register with DDTC. ITAR registration is gating for many defense programs. In M&A, DDTC notification is required at change of ownership. Foreign-owned acquirers face FOCI mitigation requirements that complicate deals.

What is DCAA compliance and why does it matter?

DCAA (Defense Contract Audit Agency) audits contractor accounting systems for compliance with FAR Part 31 cost principles, Cost Accounting Standards, and contract-specific requirements. DCAA-compliant accounting (typically Deltek Costpoint, Unanet, JAMIS Prime) is required for cost-plus contracts. QuickBooks alone is generally insufficient. DCAA audit history with no material findings adds value; findings trigger discounts.

How long does selling a defense contractor business take?

9-14 months from market launch to close at typical LMM size. Longer than general manufacturing because of compliance documentation depth (ITAR, CMMC, DCAA, security clearances), customer reference complexity (cleared programs), and FOCI considerations. Add 24-36 months on the front for proper preparation.

How does program concentration affect valuation?

Single program below 30% of revenue: clean. 30-50%: moderate discount (0.25-0.5x EBITDA), often with program-retention earnout. 50-70%: 0.5-1x discount plus structural protections. Above 70%: 1-1.5x discount plus program-specific protections. Program lifecycle stage and prime contractor health affect treatment.

What security clearances drive value?

Facility Clearance (FCL) at Confidential, Secret, or Top Secret levels. Personnel clearances at Secret, Top Secret, TS-SCI levels. SCIF (Sensitive Compartmented Information Facility) capability if applicable. Cleared workforce represents irreplaceable invested capital — clearances take 6-24 months per individual to obtain through DCSA.

What is FOCI and how does it affect deals?

FOCI (Foreign Ownership, Control, or Influence) governs cleared facility security when ownership changes. Foreign-owned, foreign-controlled, or foreign-influenced acquirers must implement FOCI mitigation per DCSA: Special Security Agreement, Voting Trust Agreement, or Proxy Agreement. FOCI mitigation can take 6-18 months. Most defense PE platforms are U.S.-controlled to avoid FOCI.

What add-backs survive QoE in defense contractor deals?

Standard add-backs (owner above-market comp, one-time legal, family member without operational role) plus defense-specific: bid and proposal (B&P) costs from unsuccessful proposals (sometimes), security clearance investigation costs, CMMC certification investment, DCAA audit response costs. Aggressive cost reclassification or program-specific cost shifting does not survive QoE.

Should I run a broker auction or use a buy-side partner?

For defense contractors, the named defense PE platforms (AE Industrial Partners, Liberty Hall Capital Partners, Arlington Capital, Veritas Capital) and prime contractor M&A teams drive top-of-range pricing. Generalist business brokers typically don’t have these relationships. Buy-side partners with defense-specific buyer networks consistently deliver 1-3x EBITDA better outcomes than generalist auctions.

How is CT Acquisitions different from a sell-side broker or M&A advisor?

We’re a buy-side partner, not a sell-side broker. Sell-side brokers represent you and charge 8-12% of the deal (often $300K-$1M+) plus monthly retainers, run a 9-14 month auction process, and require 12-month exclusivity. We work directly with 76+ buyers including 38 manufacturing-focused capital partners — defense PE, industrial PE, prime contractors, and government services consolidators — who pay us when a deal closes. You pay nothing. No retainer, no exclusivity, no contract until a buyer is at the closing table. We move faster (60-180 days from intro to close in defense; longer than general industrial due to FOCI/clearance considerations) because we already know who the right buyer is rather than running an auction to find one.

Sources & References

All claims and figures in this analysis are sourced from the publicly available references below.

1. https://www.pmddtc.state.gov/ddtc_public?id=ddtc_public_portal_itar_landing
2. https://dodcio.defense.gov/CMMC/
3. https://www.dcaa.mil/
4. https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final
5. https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0000936468&type=10-K
6. https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0000101829&type=10-K
7. https://www.aeroequity.com/
8. https://www.arlingtoncap.com/portfolio/