https://www.fedscoop.com/cmmc-federal-standards-for-acqusition/
".....The vast majority of defense contractors will only need to meet CMMC level one, the lowest standard with only 17 required controls. Arrington estimates this level will cost $3,000 every three years for contractors to maintain.
On the other hand, only a fraction of a percent of the defense industrial base will need to certify at level five — a hugely expensive regime of cybersecurity standards, she said."
