u/2021start

I’ve been spending time reading posts here and trying to understand CMMC from a small business point of view.

The more I read, the more it feels like a lot of companies won’t fail because cybersecurity is insanely advanced.

They’ll fail because of stuff like:

• not knowing what actually applies to them

• unclear scope

• missing documentation

• no evidence ready

• not knowing what to fix first

• waiting too long to start

That feels less like a security problem and more like a clarity problem.

For those who’ve gone through it, what actually made it hard for you?

The controls themselves, or everything around them?

I am trying to understand what steps everyone is taking to get themselves certified .