The CMMC price tag May hurt Smaller Vendors
We’ve already highlighted the Department of Defense’s (DoD) upcoming Cyber Security Certification Model and what it entails. However, what about the incurring costs and concern of small businesses? The DoD encouraged its readers to leave comments and/or suggestions regarding the upcoming CMMC draft, initially released in September 2019. Well, they got an earful.
Commenters representing the smaller defense contracting base made their concerns clear by voicing serious and legitimate worries regarding the pending costs of being CMMC-ready. As previously reported, a “no-go” decision will be handed down by the government for those who fail to achieve CMMC compliance, which can prove to be hurtful for a business. For a small business, it could be devastating. Some early publications spread the fear, with titles such as the 16 September 2019 article “Will DOD's new cyber rules crush small business?”
Small businesses can breathe a sigh of relief as the DoD has responded to these concerns with several measures. Small businesses competing for DoD work will be forced to comply with a tiered rating structure. For example, a janitorial or food vendor may only need to comply with CMMC level one. Other firms bidding on higher level work or contracts pertaining to classified information will be required to meet the level four threshold. Potential tax breaks have also been put forth as a possible incentive. However, the greatest incentive will be the “allowable cost” set for contractors. The allowable cost incentive translated: “We can bill the government for our upgraded expenses!!” Ok, fine. But how does this play out when you have a contracting base in excess of 300,000? That’s not a misprint – the DoD has over 300,000 contracted entities requiring CMMC certification.
In final, it’s a bit premature for us to make any brash predictions on the CMMC and its potential for headaches. Then again, check back with us in a few months as the reality starts to chip away at those 300,000+ contractors.