Do I Need CMMC?
Cybersecurity Security Model Certification (CMMC) will soon be required for all Department of Defense contractors. Whether you are a major corporation or a small manufacturer, you’ll require some level of CMMC. This has many companies asking: how much will this cost?
That answer will look different for every business. But in this article, we’ll pull back the curtain and show you what drives the costs of CMMC. Then we’ll explore ways that you can save time and money on the path to certification.
Is it Cost-Effective to Work with the DoD?
Cybersecurity requirements have long existed in the DFARS. So, from the DoD’s perspective, their contractors already carry a level of cybersecurity compliance. However, many contractors are just now starting the cybersecurity process. Because of this, the DoD’s official cost estimates tend to be lower than the reality.
Which leads to the big question:
With all these costs flowing down to suppliers, does it still make sense to work with the DoD? Is CMMC just too costly for small contractors?
That’s a legitimate question. However, we believe that with the right knowledge and the right help, any business can make CMMC cost-efficient and effective.
What is the Difference Between CMMC 1 and CMMC 2.0?
One of the most significant changes has to do with costs. The DOD would like to make it more affordable for small businesses.
From: Chief Information Officer, U.S. Department of Defense, https://dodcio.defense.gov/CMMC/FAQ/:
“Why did the Department make these changes?
The Department values feedback from industry, Congress, and other stakeholders and received over 850 public comments in response to the interim rule establishing CMMC 1.0. These comments focused on the need to enhance CMMC by (1) reducing costs, particularly for small businesses; (2) increasing trust in the CMMC assessment ecosystem; and (3) clarifying and aligning cybersecurity requirements to other federal requirements and commonly accepted standards. CMMC 2.0 was designed to meet these goals, which also contribute to enhancing the cybersecurity of the defense industrial base.”
How much will the Assessment Cost be for CMMC 2.0?
We don’t have the answer to that yet because the rulemaking is still in progress at the time of this writing however, CMMC 2.0 assessment costs are expected to be lower compared to CMMC 1.0 due to the Department’s intentions to:
- Streamline requirements at all levels, eliminating CMMC-unique practices and maturity processes.
- Enable companies involved in the new Level 1 and select Level 2 acquisition programs to conduct self-assessments instead of third-party assessments.
- Enhance oversight of the third-party assessment ecosystem.
What is CMMC Compliance?
Consulting Support for CMMC Compliance
At Core, we offer a modular approach to certification. We break the requirements down into two broad categories: organizational and technical. We provide NIST/CMMC training for your employees, your management, and your IT Team or MSP (if you outsource your IT needs).
We also help you with your guided self-assessment.
We will help you develop your System Security Plan (SSP), Plan of Action and Milestones (POAM), Roadmap, and budget. Core Business Solutions is a NIST/CMMC registered practitioner organization (RPO). Click to view CBS CMMC Consulting Offering Sheet Link.
How Does the Department of Defense Plan on Lowering the Cost of CMMC 2.0?
The Department will publish a comprehensive cost analysis associated with each level of CMMC 2.0 as part of rulemaking.
However, remember that CMMC is a program to assess the degree to which the underlying security requirements have been met. These costs are separate from the costs to implement cybersecurity controls incurred due to the need to comply with contract requirements for safeguarding information, as defined in FAR 52.204-21, and DFARS 252.204-7012.
What are the Different Costs Related to CMMC 2.0 Certification?
Let’s take a moment to demystify the costs of CMMC. What major costs can you expect throughout this process?
Soft Costs
The first major area of cost is what we call “soft costs.” This includes assessments, planning, budgeting, training, documentation, and audit preparation.
These costs come from your internal resources or external consulting. Consulting might sound more costly, but if you don’t have your own IT support—or if your current IT support doesn’t have cybersecurity expertise—then consulting could save money in the long run. Consider the time cost of gaining this expertise on your own, as well as the cost of potential mistakes.
Remediation Costs
The second area of cost to consider is remediation: upgrading your actual IT systems, facilities, and related technologies.
For many companies, this will be the largest area of cost. Here, you look at the gaps in your compliance and close them with the technologies you need for certification. This includes hardware upgrades, like computers and servers, as well as software upgrades, like firewalls and email security programs.
The Cost of Time
The third major cost area is time. It will take time for management, IT support, and employees to prepare for CMMC. With the help of expert consultants, you can drastically cut back on this time. But this process still requires involvement from management and IT every step of the way.
Assessment Costs
The fourth major cost area is assessment. This will be required for many Level 2 (formerly Level 3) companies. If this applies to you, a third-party assessor, called a C3PAO, will conduct your formal CMMC assessment. The official assessment costs aren’t out yet, but estimates range from $3,000 to $5,000.
Maintenance Costs
The final cost area is maintenance. Maintaining the above requires more money and time.
Getting the Right Help
Core Business Solutions is one of several Registered Practitioner Organizations with the CMMC Accreditation Board (CMMC-AB). These organizations are officially recognized by the CMMC-AB and trained to help businesses like yours achieve certification. We also have several CMMC Registered Practitioners on our staff.
What Drives the Cost of CMMC?
Within the above areas, what specific factors drive the costs of CMMC? What should you focus on to help reduce the overall cost of this process? The following factors can significantly impact the cost of CMMC for your business:
Which Level of CMMC do you Require?
Most businesses will require Level 1 or Level 2 (formerly Level 3). Level 1 contains just 17 practices, some of which you may already have in place.
Level 2, however, contains 110 practices. Level 1 requires much less time and cost than Level 2. Not sure which level is right for your business? Read our article on which level is right for you.
The CMMC Level you Require Depends on the Answers to these Questions:
How Much CUI does your Company Handle, and How many People must Handle it?
CUI stands for Controlled Unclassified Information. While not technically classified, this information still must be kept private. In the wrong hands, it could give America’s adversaries a tactical advantage. If you handle CUI, you will require CMMC Level 2. Learn more about CUI.
The amount of CUI you handle is a major indicator of cost. Limiting access to specific people and locations makes securing CUI simpler and more cost-effective.
Pay attention to where CUI lives in your business.
What IT Support Resources do you Have?
The capacity and training of your current IT support will affect your CMMC costs. If your internal IT capacity requires massive improvements to handle CMMC, it might make sense to hire outside support.
How Extensive and Complex is Your Network?
The less complex your network, the less it costs to secure. Network size and complexity increase with the number of devices and users you have. If you can limit your network size—or at least the portion used for CUI—you can limit your costs.
How old is the Equipment you Use?
Older equipment is more difficult to secure and maintain, which can quickly drive costs up.
How Capable is your Network Equipment?
Generally, it’s more costly to secure consumer-grade equipment than enterprise-grade equipment.
How Many Facilities Do You Have?
Multiple facilities can also add complexity and drive costs up.
Do you use Cloud-Based Apps?
This can be tricky. Cloud-based apps aren’t always more expensive, but they can sometimes lead companies to adopt a “set it and forget it” approach to security.
Remember: You’re still responsible for securing CUI and FCI stored in the cloud.
How can I Save Money on CMMC Compliance?
Overhauling your entire network probably seems like a daunting task. However, it is important to note that securing your entire network may not be necessary.
Determine the Scope of your CMMC Project.
When you Limit your Scope, you Save Money.
Your scope expands with every employee and every device that accesses government information. Think strategically about who can access this information and where. Work with your IT support to determine this scope before remediation begins—you don’t want to start upgrading your entire system if you only need one new server.
The Easier it is to Secure, the Lower the Cost.
If you can separate CUI from the rest of your workflow, you can save time and money.
Webinar: How to Keep CMMC Affordable
In this webinar, we discuss the costs associated with CMMC certification and where the biggest savings can be found. Please join us as we discuss practical ways to save money on your CMMC certification investment.
For most small businesses, CMMC can become a significant cost in time and money. While it might be considered a cost of doing business with the DoD or prime defense contractors, the ROI can quickly dwindle unless the most affordable options are investigated. This includes various technology alternatives as well as the most efficient processes.
How Core Can Help
At Core Business Solutions, we specialize in helping small businesses achieve cybersecurity. We offer consulting help, software, and security solutions to make CMMC possible for companies like yours.
We perform gap assessments to help you discover your current level of CMMC compliance. We offer solutions like the Core LockBox, providing secure storage outside your network to reduce the scope and cost of certification.
Here’s a look at how Core Business Solutions can help your organization:
-
- Our Registered Practitioner consultants help you learn the requirements of CMMC and apply them to your specific context.
- We provide online training for your leadership, staff, and IT professionals.
- We deliver the technical security solutions required for certification, such as vulnerability scanning and management.
- We’re in the process of rolling out even more solutions, including email security and penetration testing.
- We assist your company in preparation for the third-party certification audit.
- We also host regular CMMC webinars to explain the requirements and answer your questions.
Ready to make CMMC work for your business? Contact us and get a free quote today.
Core Business Solutions, established in 2000, is a Registered Practitioner Organization through the Cyber AB and has been providing consulting and technical solutions for NIST/CMMC for over 5 years. Rick Krick is the Director of Security Solutions for Core Business Solutions and directs our Cybersecurity Services solutions including CMMC. Rick has over 25 years of experience in Management System implementations, software development, IT services, and certifications.
