Hopefully this question isn't too vague or silly, but as an MSP working with a CMMC consulting partner, I am planning ahead and there are costs I know of (we've already decided on a platform that provides GRC, SIEM, MDR and VMS (all correlated) and we know that we might also go with an enclave system (GCC, Preveil, or Virtru) but I wanted to put a short list together of potential other costs, so I was looking for a Top 10 or Top 5 type of list; Like "top 10 CMMC compliance costs" that might include some of the less obvious things that consultant find lacking or missing at the average SMB DIB. I know about the Top 10 OTS lists from DIBCAC which is helpful but not from a budgeting standpoint.

Has anyone run across anything like that or does anyone reading this have enough consulting/assessing experience to write one up on the spot?

​