How CMMC Paperwork Becomes a Costly Compliance Trap

Eric Marquette

Four hundred thousand dollars. That is, uh, that is what a machine shop in Ohio told me they spent on a binder. A five hundred page System Security Plan template package. And they, uh, they had not even implemented multi factor authentication on their main server yet.

Paul Netopski

Four hundred thousand on paper. See, this is, this is firsthand testimony, not commentary, Eric. What you are describing is the core, uh, the core collapse of risk management in the defense industrial base right now. That shop hit the exact problem targeted by Question 1 of the Department of War's July 20, 2026 Request for Information. The RFI explicitly asks defense suppliers to identify the top five most prohibitive cost drivers, administrative burdens, or operational challenges in complying with CMMC and NIST SP 800 171 Revision 2.

Roz the Rulemaker

And from a regulatory oversight perspective, Paul, that exact administrative burden is where the original baseline estimates completely fell apart. When the Office of Management and Budget evaluated this under Executive Order 12866, the Regulatory Impact Analysis treated writing a System Security Plan as a, as a one time administrative paperwork expense. Um, basically a fixed setup cost.

Eric Marquette

A one time expense? For a five hundred page document?

Roz the Rulemaker

Right! OMB assumed an internal compliance officer sits down, fills out a standard form over forty hours, and you are done. But the operational reality is that small business contractors do not have full time security attorneys or CMMC assessors on staff. So they go to third party consultants, pay hundreds of thousands of dollars for over engineered policy templates, and end up trapped in an ongoing, recurring maintenance loop that OIRA never factored into the initial cost benefit ratio.

Paul Netopski

And it creates a massive, split imbalance, Roz. We consistently see a seventy five twenty five compliance split in the field. Seventy five percent of a small business's cyber budget gets swallowed by paper documentation, policy authoring, and legal reviews. Only twenty five percent actually goes to core technical controls, the brilliant basics like patching, SIEM logging, and hardware backed multi factor authentication.

Eric Marquette

Seventy five percent on paper? Wait, so three quarters of their budget is spent explaining how they protect data, leaving only a quarter to actually, like, build the digital fence?

Paul Netopski

Precisely. And here is where the legal trap springs shut. These commercial boilerplate SSP packages sell contractors a false sense of security. They buy a five hundred page shelfware binder that says the company conducts weekly automated log reviews. But in practice, the company has two IT employees who do not even have a log consolidation tool running. If that shop signs a self assessment or a CMMC attestation based on that vendor template, they have just created a direct False Claims Act liability for themselves.

Roz the Rulemaker

Because under federal procurement law, signing an attestation for controls documented in an SSP that do not reflect actual operational reality is legally considered a knowingly false statement to the federal government.

Eric Marquette

So the template they bought to protect themselves from regulatory non compliance actually becomes the exact document that puts them in legal jeopardy.

Paul Netopski

It is a trap, plain and simple. Built to operate and designed to last requires real technical implementation, not paid template magic.

Paul Netopski

And the problem gets exponentially worse when you look at how the data scope is defined upstream. I, uh, I recently reviewed a tier three contractor, absolute minimum IT setup, making basic metal brackets. Unclassified components. But their prime contractor slapped a blanket CMMC Level 2 requirement into their pre award contract clause because of an automated email tag.

Eric Marquette

An automated tag? Wait, an automated tag on an email forced a small bracket manufacturer to meet Level 2 requirements?

Paul Netopski

Yes! Scope is being driven by the marking, not by the information. What happens is DoD enterprise systems or major tier one primes auto generate outbound emails with Controlled Unclassified Information headers appended to every single attachment, regardless of whether the content actually contains technical data. That single email hits a small machine shop, and boom, suddenly their entire commercial corporate network is pulled into CMMC assessment scope.

Eric Marquette

That bracket maker ended up spending fifty thousand dollars just to isolate and secure unclassified parts schedules because of a blanket email stamp.

Roz the Rulemaker

Fifty thousand dollars on unclassified schedules is a classic symptom of pre award flowdown panic, Eric. Major defense prime contractors do not want to take on the liability of sorting or filtering data streams. So to protect themselves, they pass CMMC Level 2 assessment requirements down to every vendor in their supply chain, pre award, regardless of tier or actual data exposure.

Paul Netopski

And that is an area with issues for sure! It completely paralyzes small business participation before a contract is even awarded.

Roz the Rulemaker

Well, this is why there is a growing push within administrative reform circles to shift formal compliance verification from pre award to post award, or to force DoD buying commands and prime contractors to bear direct financial responsibility for scoping discipline. If a prime wants to demand Level 2 controls on a tier three supplier, perhaps the prime should be required to reimburse the auditing and implementation costs if the information turns out to be improperly marked.

Paul Netopski

My interpretation of this is that until the Department enforces strict marking discipline at the source, prime contractors will continue to use flowdowns as a liability umbrella. If you fix the upstream marking, you eliminate half the scope overnight, and those small shops can finally get back to building hardware securely.

Eric Marquette

Fix the source marking, fix the scope. Simple as that. Good chatting, folks.

Roz the Rulemaker

Talk soon.