When CMMC is presented as a list of security controls that need funding, it is easy to see it as “yet another IT expense.” That’s why it ends up getting underfunded. But CMMC is ultimately a business decision about protecting contract revenue and preserving the company’s ability to compete for future work.
So, the first question a leadership team needs to answer now is, “How much revenue depends on the company’s ability to meet these requirements?”
From there, establish where the company actually stands, what it will take to close the gaps, and how much time you have to do it. Those numbers give you a business case for deciding how much to invest, where to invest it, and when.
Key Takeaways
- You need to know how much revenue you are generating that’s tied to CMMC contracts.
- A gap assessment shows which requirements are satisfied today and where investment is still needed.
- Leadership needs the cost, timing, and business exposure to make an informed investment decision about funding.
- CMMC should be treated as a shared leadership responsibility.
Table of Contents
CMMC Needs to Be Owned Across the Leadership Team
CMMC becomes difficult to fund when responsibility for it sits primarily with IT or with an operations leader.
They can generally explain which controls are missing, but they cannot determine how much revenue those protect or how much the company should invest to preserve that business by themselves.
Those are leadership team decisions.
The CFO can help quantify revenue exposure and remediation budgets. Operations can determine how changes affect the business. Contract and business development teams know which existing and prospective agreements depend on CMMC. And your CMMC project manager can establish what needs to change.
You need to unite all of those pieces, starting with the revenue at stake.
How to Calculate Your Revenue Risk
Start by identifying the current and prospective revenue that depends on contracts involving federal contract information (FCI) or controlled unclassified information (CUI).
Look across these three areas.
- 1. Direct defense revenue.
Calculate what you currently bill under contracts held directly with military departments and defense agencies.
- 2. Revenue through primes.
Identify revenue earned as a subcontractor where cybersecurity requirements have been passed down to your company.
- 3. Near-term opportunities.
Add the value of proposals you expect to submit in the next 12 months, and flag prime contractors already asking about your security or CMMC readiness.
Once that’s done, add the relevant contract and option dates next to those revenue figures wherever you have them written down – so you’ll know whether you need to review and take action. Here’s why.
The Department of War has told contracting officers to modify existing contracts before the next option period or at the next scheduled administrative modification.
So, that implies that the language in your contracts can change at an option year – such as requirements like an assessment getting altered.
Putting those dates next to each dollar figure gives you visibility into when big changes can happen.
Required Security and Current Readiness
Once you know the dollars involved, determine what protecting that revenue requires.
You’ll need two pieces of information. The security obligations attached to the work and an accurate picture of the company’s ability to satisfy them today.
- Review the requirements in your contracts. Determine what security obligations apply based on the information your company handles and the work it performs.
- Get a gap assessment. Compare the environment against the applicable security requirements rather than relying on assumptions about readiness. This should be done by an outside consultant or CMMC managed services provider.
- Review the gaps. Explore how many requirements are satisfied today, where deficiencies remain, and what needs remediation.
With those two items in hand, you should quickly see where the company stands and how much work remains.
Turn Security Gaps into an Investment Plan
Knowing that gaps exist isn’t enough to make a funding decision. You need to know what closing them will cost, how long it will take, and which investments matter the most to the business.
Some gaps may require relatively inexpensive configuration or process changes. Others may require technology investments, outside expertise, changes to the operations, or ongoing support. Translate those findings into costs, priorities, accountable owners, and target dates.
Put those numbers next to the revenue exposure you calculated earlier.
From there, decide what the company is willing to invest in first to protect the contracts and opportunities that depend on it.
Build Your CMMC Business Case Before the Next Affirmation
A strong CMMC business case should give your leadership team a concise view of how much revenue you’re protecting – so you understand the level of risk you’re taking on or trying to mitigate.
Teal is CMMC Level 2 certified and we help defense contractors establish where they stand, identify what needs to change, and turn those findings into a remediation plan your team can fund and oversee. Learn more about our CMMC managed IT services.
