CMMC readiness: Level 1 and Level 2

Your contract has a DFARS clause. Who is meeting it?

So far, nobody — and until renewal that changed nothing. Now a bid without a confirmed level is not even taken up for review. The requirement sits in the terms of the solicitation, not in anyone's goodwill, and no talk with the buyer will lift it.

The narrower the system boundary, the cheaper

First we narrow the boundary: we look at which systems touch the customer's information at all, and cut out everything that does not. The fewer systems inside, the fewer requirements, and the cheaper the whole programme.

Level 1 follows the rule word for word: fifteen requirements, the paperwork written up, the self-assessment filed, and a signing officer whom we walk right up to the signature. The scope is the same for everyone, so the price is known up front, not after the work.

Level 2 means one hundred and ten requirements, a separate place for the customer's information, a plan of work and a score in the government register. At the assessment we sit beside you.

What the programme includes

included: System boundary: which systems touch the customer's information
included: What is missing against your level's requirements, and the plan
included: Written policies, procedures and finished paperwork
included: Working out your score and uploading it to the SPRS register
included: Preparing and filing the self-assessment, guiding the signing officer
included: Support at the assessment and answers to the assessor
included: The annual affirmation and an eye kept on the systems
paid to the vendor: The independent C3PAO assessor's fee and licences — billed at cost

Your price

Level 1

$3,360 one-off

Thirty hours: the fifteen requirements of the rule.

What the tier includes

included: The boundary, fifteen requirements, the self-assessment and the signing officer
included: Renewing the affirmation — $895 a year

Level 2

from $15,300 for the readiness work

One hundred and ten requirements and a score in the register.

What the tier includes

included: What is missing of the hundred and ten requirements, and a separate place
included: A plan of work, the SPRS score and support at the C3PAO assessment
included: An eye kept on the systems — $1,230 a month

Extras

not included: An external pen test for the assessor's requirementfrom $4,480
not included: We watch for attacks around the clock$18 per endpoint a month
not included: Fractional chief information security officerfrom $2,500 a month
not included: SOC 2 readiness and keeping Type 2from $2,250
not included: Questionnaires your client has sent$1,350 per questionnaire
not included: If you are breached, we investigate — monthly$670 a month
not included: Backups and a check that they actually restore$1,340 per site
not included: Preparing for a cyber policy renewal$2,250 one-off

Questions

Which level do we actually need?

Look at the contract: it names the clause and the kind of information. If it is only information about the contract itself — Level 1. If protected customer information appears — Level 2. We read the contract before we invoice.

Do you do Level 3?

We take it on, but we do not quote straight away. At the third level the assessment is run by a government body, not a commercial assessor, and the volume of work depends entirely on the system boundary. First we set the boundary, then we count.

How long until we are ready for the assessment?

Level 1 is a matter of weeks, because the rule spells out the requirements word for word. Level 2 is measured in quarters and hangs on one thing — how narrow we managed to make the system boundary at the first step.

Do we lose the contract if we are late?

Yes. A bid without a confirmed level is not taken up for review — that is a condition of the solicitation, not our opinion. So we plan the work backwards from the submission date, and you get the first plan of work before you pay, not after.

CMMC readiness