Private Military Contractor Business Plan Template

Capital Stack & SBA Pathway For PMSC Founders

Most private military contractor founders walk into a lender meeting expecting their special-operations résumé to do the talking. It almost never does. The questions a credit officer actually asks are: which NAICS code does the loan sit under, what does your day-rate look like once Defense Base Act insurance is loaded, and who pays you on net-30 once a contract closes. This page leads with the funding picture because that is where 80% of PMSC plans collapse.

Domestic protective services and investigation businesses sit under NAICS 561612 (security guards and patrol services) or 561621 (security systems services). According to SBA 7(a) lending data published via the agency's open-data portal, NAICS 561612 has averaged a ~63% approval rate over the last three reporting years with an average loan size of $485,000 and a maximum ceiling of $5M with terms up to 25 years on real estate or 10 years on working capital (SBA, 2025). The headline rate at time of writing tracks the WSJ Prime + 2.75% to 4.75% spread, fixed or variable.

An export-active overseas-deployable PMC will usually file under NAICS 561990 (other support services) or 928110 (national security). The 928110 cluster will not be funded by a vanilla community bank because the SBA Standard Operating Procedure (SOP 50-10) excludes businesses that derive more than a third of revenue from a single foreign government. This is one of the most expensive lessons first-time founders learn: classify the entity wrong on Form 1919 and the package gets bounced before it ever reaches underwriting.

The funding mix for a PMSC therefore rarely looks like a clean SBA 7(a). It is usually a stack: a smaller 7(a) covering the domestic-trainable element, founder equity covering kit and licensing, and an instalment facility from a defense-focused private lender (Capitol Federal, Live Oak Bank's Government Contracting vertical, or specialist boutiques like Federal Capital Partners) covering working-capital gaps during the classic government net-30 to net-90 payment lag. A bespoke plan should map this stack explicitly: who funds what, in which order, with which collateral.

Investors and SBA underwriters are looking for the same three signals: a documented contracting pipeline (preferably with at least one signed task order or LOI), a vetted compliance posture (ITAR, DBA, ICoCA, FCPA training), and a founding team where at least one principal has held a Department of Defense Secret clearance or higher. The narrative section of your plan has to address these explicitly. Vague claims about "industry connections" don't move a credit memo.

PMSC Market: The 2025 Numbers That Actually Matter

Aggregate market sizing is where most generic business plan templates fall flat. They quote a single hero number ("$200B industry") with no source. Lenders catch this in five seconds. The honest position: depending on whether you include physical guarding, technology services, training, and intelligence advisory, the global private military and security services market in 2025 sits between roughly $236B and $263B, with the most widely cited 2024 baseline at $262.8B (Vantage Market Research, 2025) and a 2025 reading of $254.15B (Custom Market Insights, 2025). Compound annual growth between now and 2031 is forecast at 4.9% (QY Research, 2025), with the longer 2035 outlook at 5.62% CAGR taking the segment past $578B by mid-decade.

North America is the dominant region with roughly 38.2% of global revenue (~$112.9B in 2025) thanks to sustained Department of State and Department of Defense contracting around embassy security, training mission support, and base operations (Cognitive Market Research, 2025). Europe and the Middle East together represent about 41% of spend, with Sub-Saharan Africa and South-East Asia growing fastest off small bases.

For a startup PMC, the macro chart is less useful than the procurement-pipeline chart. SAM.gov listed over 4,800 active solicitations tagged under NAICS 561612 and 561990 in fiscal year 2025, ranging from $35,000 single-site guard contracts to multi-billion-dollar Worldwide Protective Services (WPS) IDIQ task orders. The companies that win those orders are not necessarily the largest; they're the ones whose plans demonstrate that they can mobilise a vetted team within the 30-to-45-day post-award window.

The UK market is meaningfully smaller in unit terms but punches above its weight on rate. SIA-licensed close-protection officers in London routinely command £350–£700 per day, and the UK is the headquarters jurisdiction for several of the world's most profitable advisory and risk-management brands (Control Risks, GardaWorld's UK arm, Aegis legacy entities now within larger groups). Membership of the Security Industry Authority's Approved Contractor Scheme (ACS) is the de-facto credibility floor for tendering with FTSE 100 corporates and the Foreign, Commonwealth & Development Office.

One macro point worth pricing into your forecast: the centre of gravity for new contracts is migrating from classic protective services to cyber-enabled physical security (drone-counter-UAS, signals intelligence support, executive cyber protection) and training mission support in friendly- partner nations. Plans that treat this as a separate revenue line, rather than a footnote, score better with both impact-sensitive private investors and government RFP evaluators.

What It Actually Costs To Stand Up A Small PMSC

The capital floor for a credible US-domiciled private military contractor sits between $250,000 and $1.5 million in committed capital before the first task order can deliver, depending on whether the founders need to acquire armored vehicles, how many operators are on the rotation at month one, and how aggressive the initial geographic footprint is. The UK equivalent for a SIA-ACS compliant close-protection and risk-advisory shop is roughly £180,000 to £1.1 million. Anyone telling you it can be done for $50,000 is describing a sole-trader bodyguard operation, not a PMSC.

Where The Money Goes

• Legal entity, ITAR/DDTC registration, federal compliance counsel: $8,000–$25,000 (£6K–£18K). Includes Tier 1 DDTC fee of $2,250, Delaware C-Corp formation, and 30–40 hours of specialist counsel time.
• Defense Base Act + general liability + E&O insurance (Year 1): $25,000–$120,000 (£18K–£90K). DBA alone is 1–8% of payroll loaded against contract bill rates.
• Operator equipment for an 8-person team: $60,000–$180,000 (£48K–£140K). Body armor (Level IIIA / IV plates), comms (Motorola APX, Iridium 9575), optics, medical kit, plate carriers, and consumables.
• Vehicles — 2 up-armored or armored SUVs: $120,000–$360,000 (£95K–£280K). New-build B6 conversions on a Toyota Land Cruiser 76 or Chevrolet Suburban now sit at $180K–$220K each.
• Training, certifications and pre-deployment medicals: $15,000–$45,000 (£12K–£35K). Includes high-threat protective security course (Crucible, Mitchell & Sinclair, Trojan), HEFAT, and TCCC refreshers.
• Office, secure storage and armory, communications backbone: $20,000–$60,000 (£16K–£48K). Add an FFL Type 7 if a US armory will hold any controlled inventory.
• Working capital for 6 months of payroll: $200,000–$700,000 (£160K–£550K). The single biggest line. Government primes typically pay net-30 from invoice; sub-primes often delay further.

The number that scares most founders is the working-capital line, not the kit line. You will be paying operators every two weeks while waiting 30–90 days for invoices to clear. A bespoke plan should detail this lag explicitly, model the worst-case quarter, and identify a working-capital facility (line of credit, factoring agreement, or government-contract receivables financing through a specialist like FactorPlus or LiquidX) before the first contract starts.

Funding Routes That Actually Work

SBA 7(a) for the domestic element. A 7(a) tranche between $250K and $750K to cover entity formation, training infrastructure, and US-based program management. Not appropriate for funding kit destined for export.

UK Start Up Loans + British Business Bank. The Start Up Loans Company offers up to £25,000 per founder at 6% fixed with mentoring. Stack two co-founders to £50K. The Recovery Loan Scheme and growth-stage Innovate UK debt facilities can stretch this further once revenue is booked.

Defense-aware angel and VC. A small but active set of operators-turned-investors fund early PMSCs — including Shield Capital, NightDragon (cyber-physical), and several anchored by former clearance-holders. Plan on 18–25% dilution for a $500K–$1.5M angel round at seed, with board observer rights and information-rights covenants.

Performance-bond credit. Many federal contracts require a performance bond of 10–100% of contract value. Surety markets (Liberty Mutual, Travelers, Westfield) will issue these against a clean personal financial statement plus a documented business plan. Without the plan, the bond does not get written. This is the most underrated reason to invest in a proper bespoke document.

Day Rates, Bill Rates & Rotation Economics

Revenue in a PMSC is a function of three variables: bill rate per operator-day, fill rate (how much of the authorised headcount is actually deployed and billing), and rotation overhead (the unbilled days between deployments where you still pay the operator). Get any one of these wrong and the margin disappears.

Day-Rate Bands By Service Tier

Static security & access control (low-threat): $200–$350 per operator per day in the US, £180–£280 in the UK. Margin lives at 8–12%. This is the volume tier and typically how new PMCs win their first contracts.

Mobile security and convoy escort (medium-threat): $400–$650 per day. Higher kit and DBA load mean margin sits between 10% and 16%.

Close protection / executive PSD (high-threat): $500–$1,200 per day, with high-threat former-SOF principals at the top of the band. Day rates of $800–$1,200 are well documented across industry pay surveys (Guardist, 2025). Margin range is 12–22% but volatility is higher.

Training, advisory and intelligence services: $1,500–$3,500 per student-day for tier-1 instruction; $2,500–$8,000 per analyst-day for senior advisory. This is the highest-margin tier (often 25–40%) but the contract cycles are longer and require deeper industry credentials.

A Worked Example: 8-Operator Diplomatic Compound Rotation

Consider a six-month US Department of State diplomatic security taskforce in a Tier 2 conflict country. Eight operators on a 90-days-on / 30-days-off rotation, blended bill rate of $850 per operator per day. Total contract value: 8 × 180 days × $850 = $1,224,000.

Cost stack: operator pay at 60% of bill rate = $734,400. DBA insurance, kit refresh and rotation logistics at ~20% = $245,000. SG&A and program management at ~8% = $98,000. Net profit: $146,600 — a 12% margin. That number assumes everything goes right, the principal client pays on net-30, and no operator declines a rotation. A realistic Year 1 forecast should haircut this 15–20% to account for fill-rate slippage.

Two structural revenue lifts are worth pricing in. Hazard premia on actively-contested contracts can add 20–40% to the bill rate. Multi-year IDIQ task orders let a PMSC amortise its compliance and training capex across multiple rotations, which is what moves Year 2 margin from 12% to the 18–22% band that growth-stage investors expect.

Comparing The Three Viable PMC Service Models

A common founder mistake is to pitch all three of the dominant PMSC service models simultaneously. In practice, capital efficiency, hiring profile and sales cycle are radically different across them. The best plans pick one anchor model for Years 1–2, lay out the unit economics in detail, and indicate which adjacent model becomes the Year 3 expansion bet.

Most defensible Year 1 plans we see at Avvale anchor on training-and-advisory or on a tightly geographically scoped close-protection contract. Pure static security at startup scale rarely survives the first year because the volume game is captured by Allied Universal, Securitas and GardaWorld. If your team's edge is regional language capability or specialist vetting (ex-Tier 1 SOF, regional intelligence, female operators for cultural coverage), training-and-advisory monetises that edge fastest.

ITAR, DBA, SIA & Beyond: The Compliance Spine

Compliance for a PMSC is not a checklist; it is the spine of the business. The reason is that a single missed registration can void your insurance and bar you from federal contracts for years. The plan needs to detail the exact filings, expected timelines, and ownership for each item.

United States

• ITAR Registration with the Directorate of Defense Trade Controls (DDTC): required of any entity that manufactures, exports, or furnishes "defense services" as defined on the United States Munitions List. Tier 1 fee is $2,250 per year; expect 45–60 days from filing to receipt of the Registration Code (U.S. Department of State, DDTC).
• Defense Base Act (DBA) insurance: federal law requires every US government contractor and sub-contractor with overseas employees to maintain DBA cover. Carriers ACE-USA, AIG, CNA and Allied World dominate the market (U.S. Department of Labor, OWCP). Premiums load 1–8% on top of payroll.
• SAM.gov registration with a Unique Entity ID and CAGE Code: mandatory for any federal solicitation. Free, but takes 10–14 business days and forces the entity to declare its NAICS, ownership and small-business status.
• GSA Multiple Award Schedule (Schedule 84) for Security & Protection: the highest-value pre-qualification for repeat federal contracting. Allow 6–12 months from start to award.
• Federal Firearms License (FFL): ATF Type 7 (manufacturer / dealer) or Type 10 if any destructive devices are held. $30–$3,000 over three years; 60-day processing.
• State-level guard licensing: California's Bureau of Security and Investigative Services, Texas DPS, Virginia DCJS and similar agencies all require company plus individual licensing for any domestic delivery.
• Foreign Corrupt Practices Act (FCPA) program: not a licence per se, but DoJ enforcement actions against PMSC subsidiaries make a documented FCPA program essentially mandatory. Investors will ask for a written FCPA policy and training cadence.

United Kingdom

• SIA Approved Contractor Scheme (ACS): the company-level credential that gives you access to FCDO, FTSE-100 and HNW principal work. Application fee £800 plus annual maintenance; approval typically takes 16 weeks (Security Industry Authority, GOV.UK).
• SIA individual licences: Close Protection (£190 for three years), Door Supervision, Security Guarding. Every operator needs one. Renewals chase the expiring date by 16 weeks.
• Export Control Joint Unit licence: for any equipment, software or technical data export controlled under the UK Strategic Export Control Lists. SIELs typically clear in 20–60 days; OIELs in longer.
• Companies House and HMRC compliance: Persons of Significant Control register, beneficial-ownership disclosures, and corporation tax registration.

International (host-country and supranational)

• The Montreux Document (2008): 61 supporting states reaffirm international legal obligations relating to PMSC activity in conflict environments. Best-practice baseline (Swiss FDFA).
• International Code of Conduct Association (ICoCA, Geneva, 2013): certifying body that audits PMSC compliance with the ICoC. ICoCA-certified status increasingly drives RFP scoring at the UN, World Bank and EU institutions (ICoCA).
• Host-country licensing: Iraq, Saudi Arabia, the UAE, Nigeria, Kenya and the Philippines all maintain their own PMSC registration regimes, with renewable annual fees ranging from $5,000 to $40,000 and host-national hiring quotas of 30–75%.

One non-obvious cost line: most overseas licences require an apostilled corporate document set translated into the local language. Budget $5,000–$15,000 per jurisdiction for the translation, notarisation and authentication chain, plus six to ten weeks of calendar time. Plans that omit this regularly miss their mobilisation deadlines and lose contracts.

Six Mistakes That Sink New Private Military Contractors

Across the dozens of PMSC plans we have reviewed, the same six errors show up again and again. Treat the list as a pre-flight check before you submit anywhere.

1. Bidding federal contracts before holding ITAR registration. Department of State solicitations under the Worldwide Protective Services IDIQ scrub for the DDTC Registration Code at intake. No code, no proposal review.
2. Not loading DBA into the bill rate. Founders quote a competitive day rate against international peers, then realise three weeks in that DBA insurance has eaten the margin. Always quote bill rate gross of insurance, never net.
3. 1099-ing operators to "save on payroll tax". The IRS reclassifies these as common-law employees with near-perfect regularity, the DoL voids the DBA cover, and any subsequent injury claim becomes a personal liability for the founders.
4. Treating ICoCA membership as optional. EU, UN and World Bank tenders now score it explicitly. So do mainstream insurance underwriters — an uncertified PMSC pays a 1–2% premium loading.
5. Sourcing kit through grey-market channels. A single export-control violation triggers a Bureau of Industry and Security (BIS) review that freezes the entire pipeline for 6–18 months while the audit runs.
6. Skipping FCPA training for staff who handle host-country procurement. The most common DoJ enforcement vector against small PMCs is a junior logistics manager paying a "facilitation fee" to clear a customs hold. A two-day annual training program prevents most of this.

Each of these is straightforward to fix on paper but expensive to fix once they have happened. Lender and investor due diligence increasingly probes for them by name. A bespoke plan should pre-empt every one of them with documented controls.

Quick Answers: People-Also-Ask

Sample Business Plan Preview

Here is an extract from a real PMSC plan written by our team — so you can see what investor-grade copy looks like in this niche:

What's In The Template

Every Avvale private military contractor business plan template includes these sections, structured for federal contracting and lender review:

• Executive Summary — One-page snapshot drafted to pass an SBA 7(a) credit screen and an angel investor read in 90 seconds.
• Company Overview — Legal entity, NAICS classification, ITAR/DDTC registration plan, ownership structure, and small-business set-aside eligibility.
• Service Lines — Static security, close protection, mobile security, training, advisory; capacity by tier; bill rate plan.
• Industry Analysis — PMSC market sizing with cited sources, regional breakdown, growth drivers, and competitive positioning against named primes.
• Customer Analysis — Federal (DoS RSO, DoD program offices), corporate (energy, mining, FTSE 100), NGO and HNW principal segments.
• Competitive Map — Local mapping vs. Constellis, GardaWorld, Triple Canopy and regional incumbents; differentiation strategy.
• Sales & BD Strategy — SAM.gov targeting, GSA Schedule 84 plan, prime sub-contracting routes, partnership strategy.
• Operations Plan — Mobilisation timelines, training cycles, vetting, rotation schedules and incident-management workflow.
• Compliance & Risk — ITAR, DBA, ICoCA, FCPA, host-country, ECJU and SIA plans; risk register; mitigation owners.
• Management Team — Founder bios, clearance history, advisory board, key hires planned.

The optional Financial Forecast add-on (included in our $300/£250 and $1,000/£800 packages) provides a 5-year Excel model with day-rate scenarios, DBA-loaded margin analysis, working-capital lag modelling, and break-even by service line.

Frequently Asked Questions

Related Avvale Resources

A PMSC is rarely the only line of business a security entrepreneur considers. If your operating model sits closer to corporate close-protection than overseas defense services, the bodyguard and executive protection business plan template and security consulting business plan template cover the adjacent unit economics in more depth. Domestic guarding founders should review the security guard company business plan template. For founders weighing whether to bundle bespoke advisory into the offering, the industry-specific template, research + content service and the full bespoke business plan cover three different commitment levels. The free business plan templates library is the right starting point if you want to draft something in-house first, and the business plan writer service handles the engagement when you need outside hands on the document.