There is no single right path
Most small contractors end up with a mix: some work done in-house, some bought in. The right mix depends on three things:
- Your level. Level 1's 15 requirements are within reach of many small teams on their own. Level 2's 110 usually are not, without some help.
- Your scope. A small enclave is a much smaller project than a company-wide boundary. See Scoping and enclaves.
- Your people. Who in the company has the time and technical background to own this, both now and every year after?
The main options
Do it yourself
You work through the requirements using the official documents: NIST SP 800-171 and its assessment guide, 800-171A, for Level 2, or FAR 52.204-21 for Level 1.
- Good fit: Level 1, or Level 2 with a small scope and someone technical in-house.
- Watch for: the hours. The documentation (System Security Plan, policies, procedures) is a large share of the work, and it is easy to underestimate.
Hire a Registered Provider Organization (RPO)
An RPO is a consultancy registered with The Cyber AB to advise companies on CMMC. It can assess your gaps, help with scoping, write or review documentation, and plan remediation. It cannot perform your certification assessment. See Choosing an RPO.
- Good fit: when you need expert judgment on scope and interpretation.
- Watch for: the boundary between advice and doing the work. Clarify who writes what and who implements what.
Use a managed service provider (MSP or MSSP)
An IT provider runs some or all of the systems in scope for you, often including security tools and monitoring.
- Good fit: when you have no in-house IT, or want security operations run for you.
- Watch for: the provider becomes part of your assessment scope. Ask for a customer responsibility matrix showing which requirements they cover and which stay with you.
Use a compliance tool
Software that organizes requirements, documentation, evidence, and recurring tasks. Tools range from document templates to platforms that track evidence and deadlines over time.
- Good fit: keeping the work organized, especially across the years after your first assessment.
- Watch for: a tool organizes the work; it does not implement security controls or make an assessment decision. Check what it does and does not cover.
Free and low-cost help
- APEX Accelerators (funded by DoD) help small businesses with government contracting, and many can point you to CMMC resources and local help.
- Some state and regional programs, such as manufacturing extension partnerships, offer cybersecurity assistance to small manufacturers.
Where the costs come from
Whatever path you pick, the costs fall into the same buckets.
- Implementation: fixing the gaps. New or reconfigured technology (multi-factor authentication, logging, encryption, endpoint protection, possibly an enclave), plus staff time.
- Documentation: the System Security Plan, policies, procedures, and any plan of action for open items.
- Assessment: for a Level 2 certification, a C3PAO's fee; for a self-assessment, your own team's time. Either way, preparation time.
- Upkeep: annual affirmations, the recurring activities the requirements call for (reviews, training, scans, log monitoring), and reassessment every three years at Level 2, or every year at Level 1.
DoD published its own cost estimates for each level in the regulatory impact analysis of the CMMC Program final rule (linked below). They are a starting point; your scope and current state matter more than any average.
Questions to decide your mix
- Do we handle CUI, and how many people and systems touch it?
- Who inside the company will own CMMC after the first assessment?
- Do we have IT support today, and could they take on security operations?
- Do we need someone to tell us what to do, someone to do it, or both?
- How will we keep evidence current for the next three years, not just the next assessment?