CMMC Compliance Costs: A Practical Guide for Small Defense Contractors

---

Transcript

Daniel: Hello everybody, and welcome to the CMMC show. We’re back with a surprising guest, one my small business friends and my primes are going to love. We’re talking to a bank today. You might ask, why in the world are we talking to a bank? This bank is special. It offers cybersecurity loans with some incredible incentives to help you meet your contractual requirements so you can make even more revenue. Don’t tune out because I said “bank.” You might be thinking this should be about technical stuff, CMMC, or regulations, but you’ll want to hear what my friend Sean has to say.

If you’re a small business, pay attention. If you’re a prime with a struggling supply chain, pay attention. We’ve got something for both of you. Sean, I just learned how to pronounce your last name, so thank you for helping me with that. I’ll let you introduce yourself, and then we’ll jump right in.

Meet Sean Penchoff from LISC

Sean: Thanks, Daniel. I’m Sean Penchoff, a senior business development officer with LISC Innovative Investments. We’re a nonprofit community development financial institution, or CDFI, and we’ve been around since the late 70s. We’re one of the oldest and largest CDFIs in the country, with a broad focus on housing, real estate development, and community facilities. We also focus on small businesses and how they build and bolster our communities. I’m excited to talk about our Corporate Alliance for Supplier Capital initiative.

A bit about me: I’ve been at LISC for going on two and a half years. I bring a background in finance and small business lending, and I’ve also had my own small brick-and-mortar business, so I understand what many of these folks are going through, bootstrapping, ramping up, and then needing capital to grow. It’s a joy to work with small business owners every day and learn from everybody. I’m coming to you from beautiful upstate New York and the Catskill Mountains, where we’re at peak leaf season, so a shout-out to my hometown.

What Is a CDFI?

Daniel: Awesome. I’ve put together some slides, because this is a lot of content and we want to make it as simple as possible. We’re talking about small business loans for cybersecurity requirements. It’s literally that simple. Pay close attention, because it’s going to whiz by and you’ll be shocked at what LISC is able to do. You mentioned the other day that you’re a nonprofit, which I thought was amazing. You’re a nonprofit bank out of the gate, so you’re not here to make a buck off my struggling business. You’re here to help me succeed.

Sean: That’s absolutely right. We’re a community development financial institution. Say that five times fast. We support communities across the US through lending, grants, technical assistance, equity investments, and the like. We have a nationwide footprint, with locations in 36 cities and a rural team that covers the rural parts of the country. We’re headquartered in New York City and were founded in 1979 to help redevelop downtrodden, underserved communities. What we’re looking at now is how to bolster supply chains and small businesses and create opportunities for people to start, grow, and expand businesses, hire people, and build their ability to support themselves and their communities.

The Corporate Alliance for Supplier Capital

Daniel: Which brings us to the program. I met you at a roundtable, and when I shook your hand I thought, thousands of companies have asked me for your name, and I didn’t even know who you were. This is the initiative you run: the Corporate Alliance for Supplier Capital. Corporate partners contribute to a large capital fund. If you’re a prime, we’ll get to you in a second, but you have a way to invest in and grow this philanthropic capital. Small businesses apply through a process we’ll walk through, and when they repay their loans, the money goes back into the pool to help other small businesses in similar situations. I love that model. I wish I’d known about it ten years ago.

Sean: The beautiful thing is that we’re upfront with businesses. We’re making an investment in you with the expectation that you’ll pay it back so we can keep doing this for other businesses. We want buy-in from our investees as well. It’s a unique and very valuable program.

Why Cybersecurity Is Blocking Small Businesses From Winning Work

Daniel: For the people watching, cybersecurity is a hated term. Everybody wants to protect their data, but it’s become a blocker to winning new federal work. The most common example is the Department of Defense, or Department of War, requiring CMMC. But the Department of State has export control requirements with technology elements, NIH is requiring NIST 800-171, and FAR CUI, which covers protection of this data across all federal agencies and their contractors, is expected by the end of 2026. The federal regulations aren’t stopping. You have to get in line and show proof and evidence, sometimes by signing a contract and sometimes by entering your cybersecurity score into different systems. Primes want to see it from their subcontractors and supply chain, and the federal government wants to know whether it’s giving you data and whether you’re actually protecting it or it’s just sitting on a server in a closet somewhere. I’ve shared enough of those horror stories on this podcast. One of the amazing uses of your fund is enabling cybersecurity and technology upgrades and certifications like CMMC so businesses can win new work.

Sean: Absolutely. We see this all the time: a business is trying to win bigger or more contracts and runs into roadblocks. Maybe they need CMMC compliance and don’t have the money for the audit, the implementation, staff training, or upgrades to their IT infrastructure and software. It can be $200,000, $300,000, or $400,000 for a small business, and that’s a meaningful roadblock. So what do they do? They don’t go after those contracts, which limits them, or they get approved for a loan at 12, 13, 14, 15, or 16 percent interest. That’s never fun. What we can do is say, “You have these specific needs. We can finance those.” It’s a one-off. We’re not providing working capital or covering overhead. We’re helping you clear the roadblock so you can take your business to the next level, win more contracts, and execute on the ones you have.

Who Qualifies?

Daniel: The application requirements made me think this was too good to be true. There’s no way they’re just going to give this money to small businesses. You and I sat at the table, and I said, okay, tell me exactly what the application is. I have to be a business, check, doing government contracts or B2B. I need a contract or some mechanism I’m pursuing. I need only about a million dollars in top-line revenue and three years in business, to show I can run a business for some duration. I need a pipeline and a specific need. Maybe Lockheed or Boeing is knocking on my door to work with me, but I don’t have the cybersecurity in place. Or maybe it’s the DoD, the Department of State, or the Department of Energy. There are so many avenues, and the bar to apply is insanely low. You’re actually giving money to real small businesses.

Sean: We are. I get the “too good to be true” question all the time. It’s designed to be available to almost anyone, so it’s a low bar to qualify. But we do have a robust underwriting process.

The Underwriting Process and Why It Builds Trust With Primes

Sean: Even though it’s a 0% interest product, we don’t want to put a burden on a small business. We want to make sure they can support the debt service over the life of the term, that they have the capacity to service the debt, and that they’ll put the funds into something that helps them grow their top and bottom lines. So we do rigorous underwriting. It’s not a guarantee that if you apply you get money, but we work with applicants to understand their need, their business, and where they’re going, so it’s a collaborative process. We do this so we can say to primes and corporates looking to partner with and hire these businesses: they’ve been vetted. They have capital, they’ve been in existence for three years, they have a baseline of revenue, they can do the work, and they’re financially sustainable enough to work with you. We think there’s inherent value in that.

Daniel: That level of validation and trust matters. You can tell a prime, “I’m working with LISC, and they know your rigorous process.” It gives the prime, or maybe even the federal government, peace of mind that more due diligence is happening.

Sean: Absolutely.

Daniel: Now, this is what shocked me, and you stole a little of my thunder with the 0% interest. I saw that and thought it seemed crazy. Then I looked at the loan amounts: $25,000 to $500,000, at 0% interest, with no collateral or credit check. I assumed the peak would be a couple thousand dollars and good luck. Your bottom number is $25,000 and your top is half a million. The process takes about three months, which we’ll walk through. No collateral, no personal guarantee, flexible repayment, sometimes no payments for 12 months after the loan is issued, no credit check, and my favorite, which I put in a big red box: 0% interest. You’re not a for-profit bank trying to make a buck off my small business.

Sean: You’re correct.

Daniel: You’re trying to enrich the community and the supply chain.

Sean: Absolutely. People see this and think it’s a hoax.

How JPMorgan Chase and Corporate Sponsors Make It Possible

Sean: This is where I mention the primes and corporate sponsors. We can’t do this without them. JPMorgan Chase is the anchor sponsor of this program. They’ve been incredibly generous financially and with thought leadership, and they brought us together.

Daniel: They did.

Sean: We appreciate their support. We have about 20 other corporate sponsors who have contributed, and we’re always looking to bring more on. Because we’re a nonprofit and receive financial support from the corporates, we can do this. There’s nothing else like it in the market. The idea behind skipping the collateral, personal guarantee, and credit check is that most small business owners, especially in service businesses, don’t have collateral to back a sizable loan, so that’s a non-starter. The same goes for a personal guarantee. We work with many people from underserved backgrounds and communities, and some have struggled with their credit. We’re not trying to punish them for that. You can be a very successful business owner and still have struggled with credit. We’re trying to level the playing field and create an opportunity for people who may not have other ways to get this capital.

The Real Cost of CMMC for Small Businesses

Daniel: I talk to businesses with 25, 50, 100 employees all the time. They want to do the right thing. They just don’t have access to the capital. The people who reach out to Summit 7 know they have to meet these requirements to save their existing business or grow it. They say, “We see the opportunity, but we keep getting roadblocked because nobody will give us a dollar to do it.” And none of the solutions and products out there are cheap. An average CMMC assessment costs $40,000 to $50,000 every three years. To some people that’s a small amount of capital, but to a small business, $50,000 is a salary for a year. So I’m deciding whether to hire a person or pay for a certification and hope it grows my business. That’s the tension small businesses sit in. When I saw this, I thought, you can actually pay to become compliant with the amount of loan you can get from LISC. It’s incredible.

I also thought the catch would be that it takes two years to become eligible and there’s a forever line with a billion people ahead of you. But talking to you, it’s about a three-month cycle to funding, give or take a few days. Walk me through the process.

The Application Process: Intake to Funding in About 3 Months

Sean: Our process starts with a pretty straightforward intake form. We ask for basic information about your business, what you’re looking to get funded, whether you’ve talked to other funding sources, how long you’ve been in business, and so on. Then we set up an introductory call, and you’ll most likely talk to me. It’s a chance for us to get to know you, your business, and your need, and for you to understand who we are and what the process looks like. If we determine it’s a mutual fit, we start collecting documents: tax returns, financials, the typical things you’d provide when applying for a loan. Once we receive the documentation, our clock starts on that three months from documents in the folder to funds out the door. That’s fairly quick, all things considered. We have a robust underwriting process and will ask for a lot of information so we understand exactly how your business works and how these funds will help. Once you’re vetted, you’re good to go.

No-Payment Periods: Get Compliant Before You Repay

Sean: One of the cool things, which you mentioned, Daniel, is that we have a no-payment period at the beginning, typically ranging from 3 to 12 months. It’s geared toward giving businesses time to implement the project. If you’re borrowing from us to put together a CMMC compliance effort, and you need to get audited, build out infrastructure and systems, and train staff, you have time to do that before you start paying.

Daniel: So you almost get to wait until the money starts coming in. You spend the money to get compliant and win work, and then from the work you’re winning you pay it back and fund other small businesses getting compliant. It’s amazing.

Primes: How to Become a Sponsor and Strengthen Your Supply Chain

Daniel: This doesn’t happen by the grace of God. It happens through corporate sponsors and primes. If you’re a Lockheed, a Boeing, any size prime, top five, top 50, or top 500, and your supply chain has had trouble getting compliant, you can contribute to a nonprofit that gives loans to fix it. You get to give to a nonprofit, which I know primes love to do, and it’s a nice tax situation. You also fund a capital pool that goes out to small businesses to fix their cybersecurity posture, which you need in order to win more work, prime. It’s a beautiful circle of life. Sean, tell us a bit about becoming a sponsor, because this is for small businesses, but primes, it’s for you too.

Sean: Good point. This fund exists only because of our sponsors. We’re always looking for more partners to expand our pool of capital so we can make more loans, help more businesses, and keep it revolving. Why would a prime support this? First and foremost, it supports your supplier ecosystem. We get referrals from sponsors: “We work with these guys, or we’re trying to, but they have a need. Would you take a look at them?” We also have an advisory committee made up of our sponsors. We meet with them regularly to update them on who we’re investing in and what each business does, and to show how they could be a fit for your corporation, creating opportunities to pair up in a formal setting.

Having vetted businesses you can work with as partners in your supply chain is the significant value. We all know, especially in defense and manufacturing, there’s a gray tsunami of retirements as businesses change hands, or don’t, which may be an even bigger problem. We need to build resiliency in our supply chains, and primes can support that by supporting this program so we can keep businesses healthy and sustainable.

“CMMC Kills Small Business” and How to Fix the Money Problem

Daniel: We’ve got to save the small business. I hear all the time that CMMC kills small business, that their doors will shut because this is the majority of the work they do. And I keep thinking, they’re kind of right. We see a removal of small business in many places, because people don’t have the capital, the knowledge, or the access. There are many roadblocks, but this one is probably the largest in the ecosystem when it comes to cybersecurity: finding people, and dollars to do the work. You’re coming alongside and saying, “We can help you solve the money problem, which may help solve your hiring problem.” If you can win work, you can pay people to keep you compliant and keep your cybersecurity up to date. Then we’re doing our job, helping you support the national security agenda.

Sean: Absolutely.

How to Contact Sean and Apply

Daniel: One more slide, the classic one. Everyone wants to know how to talk to this amazing Sean.

Sean: I’m always happy to talk to small business owners. My email address is on the screen, and we’ll circulate a link to our intake form as well. Shoot me an email and we can set up a call, get to know one another, and get started. I speak with small business owners every day, and it’s the highlight of my job. We may get flooded with inquiries and it might take a minute to get back to some of you, but please reach out. I look forward to the conversations.

Daniel: And if you want to be a sponsor, whether you’re a prime or just want to help small businesses, Yavon’s information is down here too, for any kind of donation or giving. Is that right, Sean?

Sean: That’s correct. You can reach out to me as well, but Yavon has a direct line for any contributions to the program.

Resources and Wrap-Up

Daniel: We’ll put this and other materials from Sean and LISC on our website under Summit 7 resources. Sean, it’s been amazing. Thank you for joining, and thank you to JPMorgan Chase for introducing us. I didn’t know you existed without them. We love a good partner, and they brought us together to help small businesses succeed. Thanks, everyone, for watching. Sean, thanks for being on, and stay tuned for the next riveting episode. Who knows what it will be? Have a great rest of your day.

Sean: Take care, everyone.