The Cybersecurity Squeeze on NM’s Small Businesses

Over the next five years, New Mexico’s small businesses face an unprecedented challenge: meeting expanding cybersecurity requirements with far too few experts available to help.

While Department of Defense (DoD) and Department of Energy (DOE) contractors are the obvious first targets of regulations like CMMC and NIST 800-171, the ripple effect is reaching deep into secondary and tertiary vendors — from accountants and HR firms to logistics providers, SaaS integrators, and local fabricators. This expansion is not limited to a handful of firms. By 2030, between 7,000 and 11,000 small businesses across the state — nearly 4–6.5% of New Mexico’s 166,000 SMBs — are projected to face compliance demands tied to federal certifications.

In total, more than 50,000 small firms could be impacted once health, finance, PCI, and insurance-driven requirements are added. Yet the workforce pipeline is alarmingly thin. Even in the most optimistic scenario, only about 500 net new cybersecurity professionals will be available statewide by 2030. That equates to roughly one trained expert for every 100 businesses needing help.

More realistically, the gap could be closer to one per 240 or even one per 600. Those projections of availability compared to the needs of small businesses are not good. The optimal ratio based on current industry standards is one trained expert for every 25 businesses.

For small firms outside the defense supply chain, this shortage means higher costs, reliance on out-of-state providers, or adoption of pooled and automated services. Without aggressive workforce growth and creative service models, thousands of New Mexico’s SMBs — especially in healthcare, retail, finance, professional services, and trades — will struggle to secure affordable, compliant cyber expertise.