Updated November 12, 2021
Cybersecurity Security Model Certification (CMMC) will soon be required for all Department of Defense contractors. Whether you’re major corporation or a small manufacturer, you’ll require some level of CMMC. This has many companies asking: how much will this thing cost?
That answer will look different for every business. But in this article, we’ll pull back the curtain and show you what drives the costs of CMMC. Then we’ll explore ways that you can save time and money on the path to certification.
The Big Question
Cybersecurity requirements have long existed in the DFARS. So from the DoD’s perspective, their contractors already carry a level of cybersecurity compliance. But in reality, many contractors are just now starting the cybersecurity process. Because of this, the DoD’s official cost estimates tend to be lower than the reality.
Which leads to the big question:
With all these costs flowing down to suppliers, does it still make sense to work with the DoD? Is CMMC just too costly for small contractors?
That’s a legitimate question. But we believe that with the right knowledge and the right help, any business make CMMC cost-efficient and effective.
Costs to Expect
Let’s take a moment to demystify the costs of CMMC. What major costs can you expect throughout this process?
The first major area of cost is what we call “soft costs.” This includes assessments, planning, budgeting, training, documentation, and audit preparation.
These costs come from your internal resources or from external consulting. Consulting might sound more costly, but if you don’t have your own IT support—or if your current IT support doesn’t have cybersecurity expertise—then consulting could save money in the long run. Consider the time-cost of gaining this expertise on your own, as well as the cost of potential mistakes.
Getting the Right Help
Core Business Solutions is one of several Registered Provider Organizations with the CMMC Accreditation Board (CMMC-AB). These organization are officially recognized by the CMMC-AB and trained to help businesses like yours achieve certification. We also have several CMMC Registered Practitioners on our staff.
The second area of cost to consider is remediation: upgrading your actual IT systems, facilities, and related technologies.
For many companies, this will be the largest area of cost. Here, you look at the gaps in your compliance, and close them with the technologies you need for certification. This includes hardware upgrades, like computers and servers, as well as software upgrades, like firewalls and email security programs.
The third major cost area is time. It will take time for management, IT support, and employees to prepare for CMMC. With the help of expert consultants, you can drastically cut back on this time. But this process still requires involvement from management and IT every step of the way.
The fourth major cost area is assessment. This will be required for many Level 2 (formerly Level 3) companies. If this applies to you, a third-party assessor, called a C3PAO, will conduct your formal CMMC assessment. Official assessment costs have yet to be published, but best estimates put it between $3000 and $5000.
The final cost area is maintenance. All of the above must be maintained, which involves more money and time.
What drives the cost of CMMC?
Within those areas, what specific factors drive the costs of CMMC? What should you focus on to help reduce the overall cost of this process? The following factors can significantly impact the cost of CMMC for your business:
Which level of CMMC do you require? Most businesses will require Level 1 or Level 2 (formerly Level 3). Level 1 contains just 17 practices, some of which you may already have in place. Level 2, however, contains 110 practices. Level 1 requires much less time and cost than Level 2. Not sure which level is right for your business? Read our article on which level is right for you.
How much CUI does your company handle, and how many people must handle it?
CUI stands for Controlled Unclassified Information. While not technically classified, this information still must be kept private. In the wrong hands, it could give America’s adversaries a tactical advantage. If you handle CUI, you will require CMMC Level 2. Learn more about CUI.
The amount of CUI you handle is a major indicator of cost. It’s much easier—and cheaper—to secure CUI if you can limit access to select people and places. Pay attention to where CUI lives in your business.
What IT support resources do you have? The capacity and training of your current IT support will affect your CMMC costs. If your internal IT capacity would require massive improvements to handle CMMC, it might make sense to hire outside support.
How big and complex is your network? The less complex your network, the less it costs to secure. Network size and complexity increases with the number of devices and users you have. If you can limit your network size—or at least the portion used for CUI—you can limit your costs.
How old is the equipment you use? Older equipment is more difficult to secure and maintain, which can quickly drive up costs.
How capable is your network equipment? Generally, it’s more costly to secure consumer-grade equipment than enterprise-grade equipment.
How many facilities do you have? Multiple facilities can also add complexity and drive up costs.
Do you use cloud-based apps? This can be tricky. Cloud-based apps don’t necessarily make the process more expensive, but they can sometimes lull companies into a “set it and forget it” security mindset. Remember: You’re still responsible for securing CUI and FCI stored in the cloud.
Scope: The Biggest Way to Save
Overhauling your entire network probably seems like a daunting task. But here’s the thing: you might not have to secure your entire network.
Determine the scope of your CMMC project. Is CUI such a big part of your company’s work that the entire network must be secured? Or could you instead store CUI in a separate enclave that only select employees can access?
If you can store CUI in a separate, secure enclave, you can save the time and cost of securing your existing systems. For many companies, this is as simple as installing a secure storage solution like the Core LockBox.
When you limit your scope, you save money.
Your scope expands with every employee and every device that accesses government information. Think strategically about who can access this information and where. Work with your IT support to determine this scope before remediation begins—you don’t want to start upgrading your entire system if you only need one new server.
The simpler to secure, the lower the cost. If you can separate CUI from the rest of your workflow, you can save time and money.
How Core Can Help
At Core Business Solutions, we specialize in helping small businesses achieve cybersecurity. We offer consulting help, software, and security solutions to make CMMC possible for companies like yours.
We perform gap assessments to help you discover your current level of CMMC compliance. We also provide solutions like the Core LockBox, creating secure storage separate from your existing network so you can lessen the scope—and cost—of certification.
Here’s a look at how Core Business Solutions can help your organization:
- Our Registered Practitioner consultants help you learn the requirements of CMMC and apply them to your specific context.
- We provide online training for your leadership, staff, and IT professionals.
- We deliver the technical security solutions required for certification, such as vulnerability scanning and management. We’re in the process of rolling out even more solutions, including email security and penetration testing.
- We assist your company in preparation for the third-party certification audit.
We also host regular CMMC webinars to explain the requirements and answer your questions.
Ready to make CMMC work for your business? Contact us and get a free quote today.
