With the creation of the Cybersecurity Maturity Model Certification (CMMC), more than 300,000 contractors who provide goods and services for the Department of Defense (DoD) must obtain the appropriate level of CMMC certification specific to their business. However, the preparation and audit costs can be prohibitive for some small and medium-sized businesses.
What determines the cost of CMMC Certification?
The cost to become CMMC certified depends on where a company currently stands in its security posture. If they have significant gaps in compliance, they can expect to pay more to remediate them. A gap analysis is needed to understand where opportunities lie and to determine the steps needed to close those gaps.
While the cost will vary based on the situation and current level of adherence, common factors that will contribute to the expected costs include:
- The CMMC maturity level your company needs to achieve.
- The complexity and size of your organization.
- Personnel training costs for new technology and security practices.
- The hardware and technology costs to update your security measures.
- The scope and volume of CUI your company handles.
In a nutshell, if a company's security hygiene is lacking, it will cost more to bring them up to speed. However, if they have a long way to go financially, all is not lost. There are ways to pay for the certification.
How To Pay For the CMMC Certification
Companies must maintain a certain level of security to ensure sensitive data protection, and the DoD does not want to dissuade contractors from getting the Cybersecurity Maturity Model Certification. For businesses without the budget, below are five sources to help:
1. Federal Grants
- The government is considering bipartisan legislation to allow the DoD to provide grants for small manufacturers in specific industries to achieve the CMMC. The bill would issue funds to the Hollings Manufacturing Extension Partnership (MEP) to allow them to help small businesses in all 50 states.
- Even though the certification cost itself can be billed, the cost to hire a consulting service to bring the environment up to speed is not.
2. State and Local Economic Development Funds
- The DoD is partnering with the University of Michigan, Ohio State and Purdue to provide CMMC compliance assistance to companies.
- To qualify for help, companies must have:
- Operations in Michigan, Ohio or Indiana.
- At least 10% of annual business revenues from DoD contracts or must prove a critical need to address an issue in the defense supply chain.
- Less than 500 employees.
- To qualify for help, companies must have:
- The state of Florida was awarded $1 million to provide training to small Florida-based businesses through their MEP.
- Training takes place through education and engagement events as well as modules for those in Florida's defense industry.
3. DoD Contracts and Task Orders
- Soon, DoD contracts and task orders may include the cost of the Cybersecurity Maturity Model Certification in a contractor's billable rate. The DoD needs to continue business with certain contractors, so it is likely they will reimburse some costs to bring them to the appropriate certification level.
4. Public/Private Industry Partnerships
- Many public/private partnerships are developing networks that will provide education, mentoring and other opportunities to help organizations achieve CMMC in a cost-effective manner.
- The Information Technology Acquisition Advisory Council (IT-AAC) announced the establishment of a new CMMC Center of Excellence (COE). The CMMC COE is intended to bring the different cyber communities together to reduce complexity and increase efforts to develop whitepapers, tutorials, recorded webcasts and presentations.
5. Business Partners (Market Development Funds)
- Business partners that rely on smaller contractors have a vested interest in those contractors becoming certified, and they may also be willing to assist them in attaining CMMC certification.
The DoD and many public and private agencies are working to strengthen the supply chain, so they want their contractors to be equipped with the best knowledge and preparation. While these five sources do not all provide direct funding methods, they offer ways in which companies can educate and train themselves on CMMC certification requirements. Armed with knowledge, they can seek out a consultant that can support their unique needs.
Start the Certification Process Now
National security is at risk if the country has vulnerabilities in the DoD supply chain. Balance is crucial here. Anyone in a DoD partnership must have a secure environment, but the process cannot be so convoluted that companies cannot become CMMC certified.
Contractors that bid on DoD contracts must achieve certification to stay in business, however most companies don’t have the resources or knowledge to get there on their own. Indeed, consulting and remediation costs alone may exceed $100,000.
To overcome this obstacle, the DoD has empowered many local and state agencies to provide funding and education to help with CMMC preparation costs. While the Department of Defense may not pay for or reimburse professional consulting services, the audit cost may be covered and valuable training material is available.
Understanding what CMMC maturity level you need to achieve (and how close you are to achieving it) is your first step in achieving the required level of CMMC compliance. InfoDefense's no-cost CMMC Level-3 self-assessment tool can evaluate your organization's compliance with CMMC Level 3 and track your compliance status. For a free consultation, schedule a call with a CMMC expert today.