Estimated read time: 8 minutes
With insights from Eric Vollbrecht and Nathan Austin, from their recent appearance on FRSecure‘s Unsecurity podcast
Strategic IT planning connects technology decisions to the future of the business. It gives leaders a practical way to align risk, growth, productivity, budgeting, artificial intelligence, and cybersecurity without turning the conversation into a parade of technical specifications. You do not need to know every detail. You do need to give the people building the plan enough business direction to make sound recommendations.
Once an organization learns that Cybersecurity Maturity Model Certification (CMMC) applies to its contracts, the first question is usually a simple one: what exactly are we required to do?
Eric Vollbrecht and Nathan Austin of Mytech Partners took on that question with hosts Brad Nigh and Megan Larkins on FRSecure’s Unsecurity podcast, recorded the day after the Department of Defense announced it was pausing the next phase of CMMC. The timing made the conversation a useful reality check on what changed and what didn’t.
The answer depends on the information the organization handles, how far that information travels through the business, and what its contracts say. Even with part of the rollout on hold, the requirements themselves are more stable than the headlines suggest, and the cost of getting them wrong has gone up, not down.
Key Takeaways
- CMMC requirements are set by the type of information an organization handles, and the cost depends on how far that information travels through the business.
- Organizations that handle only basic contract information face a short list of safeguards. Organizations that handle Controlled Unclassified Information (CUI) must meet 110 security requirements.
- The pause on third-party certification did not pause the requirements, and prime contractors can still hold subcontractors to them.
- Every year, a senior leader signs a statement that the organization meets its requirements, and an inaccurate statement can create False Claims Act liability.
- Preparing for the assessment usually costs about twice as much as the assessment itself, so start with an honest score and a realistic timeline.
What Does CMMC Require?
CMMC requires defense suppliers to protect government information using a defined set of security practices, and to prove they are doing it.
The program exists because the Department of Defense shares information across a long supply chain, and every link in that chain is a possible way in for an adversary. CMMC turns long-standing security expectations into a condition of winning and keeping contracts. The practices cover familiar ground: who can access what, how logins are protected, how activity is monitored, and how the organization responds when something goes wrong.
What sets CMMC apart from a typical security project is the proof. Most organizations that come to us have policies and good intentions in place. Far fewer can show, consistently and over time, that those policies are followed. A safeguard nobody can document is, for CMMC purposes, a very expensive rumor.
“People think they’re at a certain score, but then when you say, ‘Well, prove it. Show me the evidence,’ that’s what we’re finding with our clients really takes a long time.”
Eric Vollbrecht, Senior Security Consultant, Mytech Partners
That gap between believing and proving is where most of the work lives. Evidence has to be collected before the assessment and kept current afterward, because certification lasts three years and the record-keeping doesn’t stop when the assessor leaves.
Which CMMC Level Applies, and How Much of the Business Is in Scope?
The level depends on the type of information the organization handles. The scope depends on how far that information travels.
Organizations that handle only basic contract information, such as pricing or delivery schedules, generally fall under Level 1. That level covers 15 basic safeguards and an annual self-assessment. Organizations that receive, create, or store Controlled Unclassified Information (CUI), such as engineering drawings and technical specifications, fall under Level 2, which covers 110 security requirements from a federal standard. A third level exists for the most sensitive programs and applies to a small number of suppliers.
Scope is where leadership teams get surprised. One common strategy is to keep CUI in a separate, tightly controlled environment, often called an enclave, so only part of the business has to meet the full standard. That works well on paper. In manufacturing, the drawing still has to reach the shop floor, and the same machines usually make defense and commercial parts side by side.
Scope isn’t only digital, either. Physical access to the spaces where CUI lives is part of the requirements, and it can decide how much of a facility ends up in scope.
“There are a number of manufacturers that haven’t thought about the physical security needs mandated also by the CMMC requirements.”
Megan Larkins, Co-host of the Unsecurity podcast, FRSecure
We worked with one client whose defense work was only 15 to 20 percent of the business. Limiting scope looked like the obvious move, but separating that work cleanly would have been more disruptive than bringing the whole company up to the standard, so they chose the whole company. The right answer starts with mapping where sensitive information goes: the people, places, processes, and technology it touches. Reduce scope where it is practical, and stop when the effort to separate costs more than it saves.
What Is Still Required While Phase 2 Is Paused?
The Department paused the start of required third-party certification, but the underlying requirements remain in effect.
In July 2026, the Department of Defense suspended the next phase of the rollout and announced a 60-day review. That phase would have required most suppliers handling CUI to be certified by an outside assessor starting in November 2026. As of mid-October, no new date has been announced. For the full story behind the pause, read “CMMC Is Paused“.
What didn’t pause is the work itself. Contracts that include CMMC can still require a self-assessment at Level 1 or Level 2, and prime contractors can still require their subcontractors to meet every Level 2 requirement. Nobody outside the Department knows exactly what the review will change, but a full reversal would be surprising after years of planning and scrutiny.
“Maybe there’s a degree or two shift, but it’s not going to be 180 degrees.”
Nathan Austin, Co-Owner/VP of Business Development, Mytech Partners
Some organizations are treating the pause as an opening rather than a reprieve.
Some organizations are choosing to move forward now, recognizing that suppliers who are ready first may be better positioned when opportunities arise.
What Does the Annual Affirmation Mean for Leadership?
The pause didn’t lower the risk. It moved it onto the signature line.
Every year, a senior leader signs a statement that the organization meets its CMMC requirements, and that signature is a formal claim to the federal government. With third-party certification on hold, the organization’s own assessment is often the only evidence behind that claim. If the claim is inaccurate, the organization can face liability under the False Claims Act, and the Department of Justice has been adding attorneys to pursue fraud cases.
This isn’t theoretical. In a recent case, an organization that had reported a top self-assessment score was later reviewed and found near the bottom of the scale, and it paid more than $500,000. We also regularly meet organizations whose score was filled out by someone in sales or in a general IT role, often because they were the ones holding the contract request. Their score is frequently higher than what an expert review supports once the scope is examined.
“I wouldn’t want to base a potential false claims problem, or believing that we’re secure, on someone that’s a generalist. You really want someone that is a specialist and understands the policy, the controls, and the evidence collection to help you get there.”
Nathan Austin, Senior Strategic Partner, Mytech Partners
The practical takeaway: the person signing should understand what they are affirming, and the assessment behind it should be honest rather than hopeful. An optimistic score feels great right up until someone asks for the evidence.
What Does It Cost to Get Ready?
Preparing for the assessment usually costs more than the assessment itself.
In our experience, the work breaks into three parts. An initial assessment to find out where the organization stands typically runs about $10,000 to $20,000. Readiness consulting, which covers policies, security program setup, and evidence collection, usually adds $20,000 to $60,000 depending on what already exists. Third-party certification assessments we have seen start around $40,000 and rise with company size, locations, and scope. Industry figures for the full first year commonly land between $100,000 and $200,000 once internal staff time and technology upgrades are included.
The biggest variables sit on the organization’s side: outdated systems that need replacing, new cloud environments or licensing, and the people who have to help make decisions along the way. That is also why offers to deliver certification in six weeks for $5,000 deserve a hard look. Boilerplate policies can be produced quickly. Controls and a trail of evidence that hold up under review cannot, and organizations that take the shortcut often end up redoing the work. Choose a partner who explains how you meet each requirement, not one who simply tells you that you’re good now.
Where Should Organizations Start?
Start by confirming what your contracts require and where sensitive information lives, then get an honest score.
Review contracts and subcontracts for CMMC and related cybersecurity clauses, and ask the prime contractor or contracting officer when the requirements are unclear. Map where CUI enters the organization, where it is stored, who can access it, and which partners receive it. Then run a gap analysis to see the distance between today’s environment and the standard.
Timing matters as much as budget. Getting ready in three months is very difficult. Six, twelve, or eighteen months gives leadership room to sequence the work and spread the cost instead of treating every gap as an emergency. The compliance work and the technical work can often run in parallel to save time. For a closer look at timelines and common delays, read “The Real Path to CMMC Certification“.
Frequently Asked Questions
What are the CMMC compliance requirements?
CMMC requires defense suppliers to protect government information using a defined set of security practices and to document that those practices are in place. The specific requirements depend on the level that applies to the organization.
Which CMMC level does my organization need?
The contract determines the level. Organizations handling only basic contract information generally need Level 1, while organizations handling Controlled Unclassified Information generally need Level 2.
Are CMMC requirements still in effect during the Phase 2 pause?
Yes. Only the start of required third-party certification is paused. Self-assessments, annual affirmations, and the underlying security requirements remain in effect for contracts that include them, and prime contractors can still require them of subcontractors.
What is the CMMC annual affirmation?
It is a yearly statement, signed by a senior leader, confirming that the organization meets its CMMC requirements. An inaccurate affirmation can create liability under the False Claims Act.
How much does it cost to prepare for CMMC?
Costs vary with company size, scope, and existing security. Preparation usually costs about twice as much as the third-party assessment, and first-year totals commonly range from $100,000 to $200,000 once staff time and technology upgrades are included.
Can a managed services provider make an organization CMMC compliant?
A provider can handle much of the technical and readiness work. Leadership decisions, documentation ownership, and the annual affirmation remain the organization’s responsibility.
Closing Thoughts
CMMC requirements are clearer than the headlines make them sound. Know your level, know where your sensitive information travels, and make sure the person signing the affirmation can stand behind it. For the business case behind the investment, read “Is CMMC Worth It?“. When you’re ready to see where your organization stands, our cybersecurity consulting team can help. Let’s talk, or call (612) 659-9800.
This article is general information and isn’t legal advice. Talk with your attorney about your specific contract obligations.
