Scope And Cost: A Cybersecurity Guide For Small Defense Suppliers

Small defense suppliers often assume cybersecurity costs begin with selecting a tool or vendor. They don't. The costs start the moment a company fails to define where controlled unclassified information, or CUI, lives.

Defining where it lives also shapes a supplier’s path through the Defense Department’s Cybersecurity Maturity Model Certification (CMMC) program, which verifies that suppliers protect CUI to the required standard.

“The essence of any CMMC program starts with building your system security plan, and that plan is based on the scope of the system the assessors will review,” said Kevin Hancock, senior director, solutions consulting and customer success at Exostar. “The larger that scope, the more complex it gets, and the more things the assessors are going to look at.”

That scoping decision is one of the first and most consequential cost decisions a supplier will make. Draw a clear, defensible boundary, and fewer systems, users and processes may need to meet the applicable security requirements. Skip it, or leave the boundary undefined, and every laptop, server and cloud subscription in the business risks landing in scope, and in the system security plan.

Avoiding that outcome starts with the information itself, not the technology. The following four steps help suppliers define scope and plan their approach.

1. Follow the information. Start by tracing where CUI enters the organization, who can access it, how it moves and how it gets destroyed. Hancock said this isn’t solely an IT exercise. HR functions such as employee screening and offboarding count, too. So do contractors and outside vendors. Cloud services deserve scrutiny: confirm each appears in the FedRAMP Marketplace. Managed service providers (MSP) are another potential blind spot. If an MSP administers systems that touch CUI, that relationship also belongs in the scope.
2. Choose the operating model. Once a company understands its data flow, it can decide whether to fold CUI into its existing environment or isolate it inside an enclave, a segmented environment such as Microsoft GCC High or a third-party managed solution. Hancock said the right call often comes down to how much of the business supports DOD contracts. A supplier fully engaged in government work may need enterprise-wide compliance. One with, say, 20% or 40% of revenue tied to defense work may find it cheaper to fence off a smaller enclave — in the cloud, on the shop floor or in a secure file room — rather than remediate the whole company.
3. Understand shared responsibility. Using a cloud provider or MSP does not transfer every security obligation to that provider. Cloud providers with FedRAMP authorization should supply a shared responsibility matrix spelling out which controls they meet, which they share and which remain the supplier’s responsibility. Exostar’s enclave, for example, meets 80% of NIST 800-171’s technical requirements, provided the CUI stays inside the protected environment. Its Secure Exchange feature also supports encrypted one-to-one email and file sharing within that environment, while preventing downloads to unmanaged devices and reducing reliance on unsecured email.
4. Build for ongoing execution. Compliance isn’t a one-time checklist. Businesses change, technology environments expand and security standards evolve. NIST 800-171 Revision 3 has already been published, although current CMMC Level 2 requirements remain aligned with Revision 2.

The DOD’s recent suspension of CMMC Phase 2 third-party assessment requirements changes the near-term assessment path. It doesn’t remove suppliers’ underlying responsibility to protect CUI or the continued use of Level 1 and Level 2 self-assessments.

“Don’t take this suspension as a chance to procrastinate,” Hancock said. “Take it as a chance to make sure your house is in order.”

For CMMC Level 2, the 110 NIST 800-171 Revision 2 security requirements are evaluated through 320 objectives. Suppliers need more than deployed technology. They need documented evidence, clearly assigned responsibilities and trained teams ready to demonstrate compliance.

Choosing the right technology or operating model can be a critical part of readiness.

Weigh five questions before investing. Hancock recommends suppliers ask:

1. How much of my business touches DOD work?
2. Where does my CUI enter, move through and leave my organization?
3. Can I outsource part of this to a cloud provider?
4. Do I need outside help to get there?
5. Which option balances price against security and ease of use?

Exostar’s Scope Map Tool, available on the company’s website, can help suppliers map that CUI boundary and identify where unnecessary complexity may be increasing their cybersecurity burden.

Ultimately, the goal is to control cost by limiting unnecessary scope while maintaining a boundary the organization can understand, protect and confidently stand behind.

As Hancock said, it comes down to one test: “How comfortable am I, as a company official, signing off that we do these things?”