The call from the Department of Defense (DoD) in late 2025 felt like a lifeline for Apex Cyber Solutions, a veteran-owned small business specializing in secure network architecture. John Chen, CEO and a former Army signals intelligence officer, had been wrestling with the complexities of the Cybersecurity Maturity Model Certification (CMMC) framework for months. The DoD’s new CMMC RFI (Request for Information) on small business and veteran business feedback offered a rare chance to shape policy directly, but could his voice truly make a difference?
Key Takeaways
- The DoD’s CMMC RFI specifically sought feedback from small and veteran-owned businesses on implementation challenges, particularly concerning CMMC 2.0 Level 2 compliance.
- Veteran businesses identified high compliance costs, limited access to specialized cybersecurity talent, and the ambiguity of certain CMMC practices as significant hurdles.
- The RFI process allowed for direct input on potential DoD assistance programs, including grants for CMMC readiness and simplified compliance pathways for certain contract values.
- Successful engagement with the CMMC RFI required detailed, data-backed submissions outlining specific financial impacts and operational constraints.
The Initial Hurdle: Understanding CMMC 2.0 for Small Businesses
John founded Apex Cyber Solutions in Atlanta, Georgia, five years ago, building a reputation for careful security implementations for defense contractors. His team, largely composed of fellow veterans, understood the critical nature of safeguarding sensitive information. However, the rollout of CMMC 2.0, while intended to simplify the original framework, still presented formidable challenges for businesses like his.
“We’re talking about securing Controlled Unclassified Information, or CUI,” John explained during a team meeting, gesturing at a complex network diagram projected on the screen. “The intent is sound. We all agree on that. But the path to Level 2 certification, which is now mandatory for many of our contracts, demands a significant investment. We’re not Lockheed Martin.”
CMMC 2.0 introduced three levels: Foundational (Level 1), Advanced (Level 2), and Expert (Level 3). For most defense contractors handling CUI, Level 2 became the new baseline, requiring adherence to 110 practices derived from the National Institute of Standards and Technology (NIST) Special Publication 800-171 Rev. 2. According to the Office of the Under Secretary of Defense for Acquisition and Sustainment, this framework aims to ensure that defense contractors adequately protect sensitive government information.
The Cost of Compliance: A Veteran Business Perspective
The primary concern for Apex Cyber Solutions, and indeed for many small and veteran businesses, was financial. Achieving Level 2 compliance involved not just technical upgrades but also extensive documentation, policy development, and often, engaging third-party assessors. John had already received quotes ranging from $50,000 to $150,000 for assessment and remediation services, a substantial sum for a company of 20 employees. This figure didn’t even account for the internal labor hours his skilled technicians would divert from billable projects.
“We looked at upgrading our Security Information and Event Management system, implementing multi-factor authentication across the board, and tightening physical security protocols,” John recounted. “Each piece adds up. And then there’s the annual assessment cost. It’s not a one-and-done.”
A report by the Small Business Administration highlighted that cybersecurity costs are disproportionately high for small businesses, which often lack dedicated IT security departments. This reality creates a direct tension: the DoD needs secure supply chains, but small businesses, important to that chain, struggle to meet the financial demands.
The CMMC RFI: An Opportunity for Dialogue
When the DoD issued its CMMC RFI, it specifically requested input on the challenges faced by small businesses, including veteran-owned enterprises, in achieving CMMC compliance. The RFI document, published on SAM.gov, asked for feedback on areas such as the cost of compliance, availability of accredited assessors, and the clarity of CMMC requirements.
John saw this as his chance. He spent weeks compiling detailed financial projections, outlining the man-hours his team would need to dedicate, and even surveying other local veteran-owned businesses in the defense sector. He spoke with the Georgia Department of Veterans Service and the Atlanta chapter of the National Veteran Business Association, gathering anecdotal evidence to bolster his case.
“The RFI wasn’t just a suggestion box,” John stated. “It was a formal request for data. They wanted to know specific pain points, not just general complaints. How many hours are you spending? What’s the average cost of a technical control implementation? Which practices are the most ambiguous to interpret?”
He focused his feedback on three key areas:
Veteran homeowners. Want to lower your monthly payments?
See if a VA Cash Out Loan or VA Home Loan can put cash in your pocket or help you buy with $0 down. A specialist will review your options, free.
- VA Cash Out Loan: use up to 100% of your home’s equity
- VA Home Loan: buy a home with $0 down payment
- No cost, no obligation eligibility check
You’re all set.
A VA loan specialist will reach out shortly to review your Home Loan and Cash Out options.
- Financial Burden: Proposing a tiered grant program or tax credits specifically for veteran-owned small businesses pursuing CMMC Level 2.
- Talent Gap: Suggesting DoD-sponsored training programs or partnerships with educational institutions to certify veterans as CMMC practitioners or internal auditors.
- Clarity and Resources: Advocating for more detailed implementation guides and publicly available templates for CMMC documentation, especially for smaller entities.
Crafting a Compelling Response
John knew a generic response wouldn’t suffice. He included a case study of Apex Cyber Solutions, detailing their current cybersecurity posture, the specific gaps identified for Level 2 compliance, and the estimated costs to close those gaps. He cited specific NIST 800-171 controls, like 3.1.5 (implement least privilege) and 3.1.13 (employ cryptographic mechanisms to protect the confidentiality of CUI), explaining the practical and financial implications for a small business.
One of his more pointed suggestions centered on the assessment process itself. “The current model relies heavily on external C3PAOs (CMMC Third-Party Assessment Organizations),” John wrote in his submission. “While necessary for objectivity, their availability and cost are significant barriers. Could the DoD explore a hybrid model for certain low-risk contracts, perhaps allowing for self-attestation with periodic DoD audits for Level 2, similar to Level 1?” This was a bold suggestion, pushing for greater trust in established veteran businesses.
He also highlighted the unique position of veteran businesses. “We inherently understand the mission,” his submission read. “Many of us have held clearances and operated in secure environments. Our ethos is built on service and security. The CMMC framework should recognize and perhaps even capitalize on this inherent understanding, rather than treating us as just another small business with a steep learning curve.”
The Outcome: A Glimmer of Hope for Veteran Businesses
Months after submitting the RFI, John received an invitation to a virtual roundtable discussion with DoD officials and representatives from other small businesses. The discussion confirmed that the DoD was indeed listening. While no immediate policy changes were announced, the conversations focused directly on the feedback provided in the RFI.
By early 2026, the DoD announced several initiatives that directly addressed concerns raised in the CMMC RFI. One significant development was the establishment of the Cybersecurity Assistance Program for Small Businesses, which included pilot programs for CMMC readiness grants. These grants, administered through various Small Business Development Centers, aimed to offset a portion of the assessment and remediation costs for eligible small businesses, with a specific carve-out for veteran-owned enterprises.
Also, the DoD signaled its intent to develop more accessible training materials and a standardized toolkit for CMMC Level 2 implementation. They also acknowledged the need for more C3PAOs and began exploring incentives for cybersecurity professionals to become accredited assessors, aiming to increase competition and potentially lower costs.
“It wasn’t a complete overhaul, but it was a substantial step,” John reflected. “The grants alone can make a tangible difference for businesses like ours. It shows that engaging with these RFIs, providing specific, actionable feedback, truly influences policy.” Apex Cyber Solutions applied for one of the pilot grants, which, if approved, would cover 30% of their projected CMMC Level 2 assessment costs, allowing them to allocate more resources to their core projects.
The experience underscored a critical lesson: direct engagement with government RFIs provides a powerful, often overlooked, avenue for small and veteran businesses to shape the regulatory field that directly impacts their operations. John’s careful approach to the CMMC RFI not only benefited Apex Cyber Solutions but also contributed to broader improvements for the entire ecosystem of veteran business defense contractors.
Addressing Common CMMC Challenges
The journey of Apex Cyber Solutions highlighted several recurring issues that many small businesses face when working through CMMC. Beyond the direct financial costs, the complexity of interpreting technical controls and the administrative burden of documentation often overwhelm smaller teams.
For instance, the requirement for “security awareness training” (NIST 800-171 control 3.1.2) seems straightforward. However, for a small business, developing complete, engaging training modules that meet the CMMC specificity can be a drain on resources. Many end up purchasing off-the-shelf solutions, which adds another line item to the budget. Similarly, implementing “system and information integrity” controls, such as regular scanning for vulnerabilities (3.1.6), demands specialized tools and expertise that might not be readily available in-house.
Another significant challenge is the ongoing nature of compliance. CMMC is not a one-time achievement. It requires continuous monitoring, regular updates to policies, and annual re-assessments for Level 2. This creates a perpetual operational cost that many small businesses initially underestimate. The RFI responses made it clear to the DoD that this sustained effort needs to be factored into any support programs.
The Role of Community and Collaboration
John’s approach also demonstrated the power of community. His discussions with other veteran-owned businesses and local veteran associations provided a broader perspective and reinforced the commonality of their struggles. This collective feedback, channeled through individual RFI responses, carried more weight than isolated complaints.
“There’s strength in numbers, even when you’re responding individually,” John noted. “When the DoD sees consistent themes emerging from dozens, if not hundreds, of small business responses, it signals a systemic issue, not just an isolated problem. That’s how real change happens.” He specifically mentioned the insights gained from the Georgia Veterans Business Alliance, which provided templates and advice for structuring RFI responses. This sort of collaborative effort, while not directly mandated by the DoD, proved invaluable for many small businesses attempting to navigate the bureaucratic process.
The lessons learned from the CMMC RFI process extend beyond cybersecurity. They illustrate how active participation in government feedback mechanisms can directly influence policy outcomes. For any business, but especially for small and veteran-owned enterprises, engaging with these opportunities is not just about compliance. It’s about shaping a more equitable and functional contracting environment.
The journey of Apex Cyber Solutions from struggling with CMMC 2.0 to influencing DoD policy through the CMMC RFI highlights a critical truth: government requests for information are not bureaucratic formalities. They are direct invitations for stakeholders, particularly veteran business owners, to shape the future of contracting regulations. Your detailed input can directly translate into tangible support programs and clearer pathways for compliance.
What was the primary purpose of the DoD’s CMMC RFI for veteran businesses?
The primary purpose of the DoD’s CMMC RFI was to gather detailed feedback from small and veteran-owned businesses regarding the challenges and impacts of implementing CMMC 2.0, particularly Level 2 requirements, to inform potential policy adjustments and support programs.
What specific challenges did veteran businesses highlight in their CMMC RFI responses?
Veteran businesses frequently highlighted the high costs associated with achieving and maintaining CMMC Level 2 compliance, including assessment fees and technology upgrades, the scarcity of affordable accredited assessors, and the ambiguity in interpreting certain CMMC practices.
How did the DoD respond to the feedback received from the CMMC RFI?
Following the RFI, the DoD announced initiatives such as the Cybersecurity Assistance Program for Small Businesses, which included pilot CMMC readiness grants, and committed to developing more accessible training materials and tools to aid small businesses in compliance.
What specific CMMC level was the focus for most small and veteran businesses?
For most small and veteran businesses handling Controlled Unclassified Information (CUI) in defense contracts, CMMC 2.0 Level 2, which aligns with NIST SP 800-171 Rev. 2, became the primary focus and source of compliance challenges.
What advice would you give a veteran business considering responding to a future DoD RFI?
Provide specific, data-backed examples of costs, time commitments, and operational impacts. Collaborate with other businesses or associations to identify common issues. And clearly articulate proposed solutions or support mechanisms that would alleviate compliance burdens.
