For the last few years, CMMC, the Cybersecurity Maturity Model Certification, has been a huge topic of discussion among the U.S. Government and the Defense Industrial Base (DIB). What started as an Executive Order over a decade ago to protect CUI has had a slow, incremental rollout, and revisions. Now, with CMMC 2.0, defense contractors can finally expect CMMC requirements in their contracts as soon as May 2023.
CMMC’s complicated history, laundry list of requirements, and potentially large price tags from service providers and C3PAOs, have many defense contractors “waiting and seeing” as they weigh CMMC’s impact on their business. The wait is costing most more than they realize in ways that can be the difference between meeting your CMMC goals on time and on budget, or not.
Price Hikes & Rising Inflation
Inflation is on the rise. We’re seeing it everywhere and in September 2022, leaving only 8 months until the CMMC will be required, inflation increased by 8.2% compared to 2021 across all goods and services. Cybersecurity technology like Microsoft Government Cloud as well as cybersecurity services provided by managed service providers and C3PAOs are also expected to rise in cost, if they haven’t done so already. The longer businesses wait to get started, the farther into the inflation rabbit hole you’ll go and the more expensive the climb out will be.
Inflation isn’t the only budget killer you’ll have to worry about when it comes to slow timelines. Too many defense contractors are waiting and the impact this has on your business is going to come down to simple economics. You remember supply and demand, right? The greater the demand, the less the supply, and the higher the cost. When everyone who has been waiting to get started tries to start at the same time, the demand will skyrocket. The ability for service providers to ‘supply’ the influx of people with policies and procedures, acquire and implement technology, configure systems, etc., as well as the ability of C3PAOs to assess everyone in time, will plummet. What’s left is either a huge price tag for rushed service or a lottery to see if you can find a provider to help you get done in time.
Limited Availability & Scheduling Conflicts
The waiting game is a tricky one mainly because there are multiple timelines you need to consider but only one you really have visibility into. Your own. Service providers have timelines of their own. For example, Tesseract, Ardalyst’s compliance-focused, managed cybersecurity program, typically has a wait time of about a month between the contract sign date and the implementation start date. This is, of course, the average we’ve seen before the last-minute CMMC rush. As more and more people attempt to get on implementation schedules across all the CMMC Registered Provider Organizations (RPOs), (and you will want to make sure your provider is an official RPO (you can learn more about what that means here), the fuller implementation calendars will get and the farther back your start time will be. If your organization has a lot of work to be done to get compliant, late starts could mean not being compliant by the time CMMC appears in your next contract. If you’re not sure how much work you have to do, this is a crucial first step in determining your business’s ability to wait. Check out our free NIST 800-171 Self-Assessment tool to see how you measure up against CMMC Level 2 and get your SPRS score to meet the current DFARS 252.204-7019 clause.
Inability to Bid & Missed Contracts
CMMC was created to strengthen our nation’s supply chain and ensure that government information is protected. A cause I’m sure most defense contractors can get behind, but it’s no secret that the driving force behind businesses getting CMMC-compliant is the ability to bid and win DoD contracts and soon any government contract as more and more agencies make plans to roll out CMMC. The more businesses that wait and the longer they wait, the greater the risk to your ability to bid on contracts. Getting CMMC-compliant can take upwards of 12 months, not including the time for assessment. Working with a service provider can shorten the timeframe significantly, but with only 8 months left until CMMC goes into full effect, many businesses risk missing the deadline. That’s fewer contracts you’ll be able to bid on and less DoD work to support your business.
How to get started
Ardalyst has developed a five-step process to help you get started that doesn’t require an expensive initial assessment. Our team of CMMC-AB Registered Partitioners can also deliver a free Risk Assessment to meet the requirements of RA.L2-3.11.1 and give you a better idea of what your CMMC compliance timeline looks like. Contact us online at www.tesseract.ardalyst.com, email us at info@ardalyst.com, or call us at (833) 682-8270 to get started!
