Why can the same framework require different effort?
Readiness cost and timing depend on the distance between your current program and the agreed requirements. Scope, control gaps, evidence quality, available people and the review date all affect that distance.
The systems in scope and the responsibilities shared with IT and cloud providers matter across frameworks and customer reviews. Existing policies and traceable records can reduce discovery work, but still need review against the applicable requirements. For CMMC, that includes the system boundary and any existing system security plan. Separate readiness support, technical remediation and any required external assessment fees when comparing quotes. See compliance readiness support for the inputs to that conversation.
A credible estimate starts with discovery. A fixed number of weeks, a tool subscription or an endpoint count alone cannot describe all of the work.
The inputs that change the plan
- Scope: systems, products, entities, information, locations and vendors covered by the review.
- Control maturity: work already operating versus work that still needs to be designed, approved and implemented.
- Evidence: records that are complete, traceable and relevant to the required period, compared with records that are absent or need clarification.
- Ownership and commitment: a sponsor who can make decisions, fund changes and give control owners time to implement and maintain them.
- Tools and implementation: missing capabilities, license costs, configuration, integration, migration and training that may need additional implementation services.
- Ongoing program work: recurring activities and evidence collection, with named owners and an agreed review cadence.
- Target date: the customer deadline, external review availability and any required operating-evidence period.
Separate the phases and their dependencies
1. Requirements and baseline
Agree what is in scope, map existing controls to requirements and identify what evidence is available. Finish with an actionable gap register rather than a presumed completion date.
2. Remediation and evidence collection
Assign work to control owners. Track approvals, implementation and operating records separately. Some work can run in parallel; other work depends on a tool change, contract decision or consistent operation over time.
3. Readiness review
Check agreed acceptance criteria, unresolved gaps and the completeness of evidence. Coordinate outstanding issues before the external review. The independent assessor determines its examination or certification outcome and evidence expectations.
Two illustrative starting points
Established controls, scattered records: an organization already performs access reviews and recovery exercises, but its evidence has no consistent owner or index. Discovery may focus on traceability and whether the existing records meet the agreed requirements.
New processes, compressed deadline: another organization needs to create those processes, assign owners and show that they operate. It needs implementation time as well as documentation. Extra effort cannot recreate records of activity that never took place.
These examples are planning scenarios, not client outcomes or promised durations. Your baseline determines which work applies.
What belongs in the quote?
Ask for the systems and requirements covered, phase deliverables, client responsibilities, milestone dependencies and the treatment of scope changes. Separate readiness support from tools, implementation projects, ongoing program activities and external audit or certification fees. State which work the organization will perform and where additional services are needed.
If the requested date is unrealistic, discuss a narrower initial goal or a phased customer response. Any change in requirements should be agreed with the party requesting assurance.
Bring the inputs behind the deadline
Use the readiness starting-point guide and sample planning templates to organize your questions. Then discuss scope and pricing with Vectari. For formal SOC examinations, see the AICPA overview of SOC services.
