Valor Cybersecurity’s recommendation to the CMMC Reform Task Force targets the single biggest barrier keeping small and mid-size defense contractors out of the industrial base: the cost of getting assessed.

When Valor Cybersecurity CEO Greg Tomchick submitted the company’s response to the CMMC Reform Task Force’s Request for Information last month, one recommendation stood out as both the most urgent and the most immediately achievable: authorize C3PAOs to conduct pooled, or “cohort,” assessments for groups of small businesses.

It’s a simple idea with an outsized potential impact. Here’s the reasoning behind it, and why it deserves a place at the top of the Task Force’s 60-day action list.

The Problem Isn’t the Standard. It’s the Fixed Cost of Proving You Meet It.

Valor works daily with shipyards and defense manufacturers across Hampton Roads and the broader Defense Industrial Base, and the same story comes up in nearly every engagement. According to SBA data cited in Valor’s submission, a single small business pursuing CMMC Level 2 (C3PAO) certification can face costs approaching $600,000. That number doesn’t scale down for a company with a small CUI footprint or a lean IT environment. Whether a contractor handles a trickle of controlled unclassified information or manages it at scale, the assessment carries roughly the same fixed overhead: scoping, travel, evidence review infrastructure, and assessor time.

That fixed-cost structure is the root of the problem. A six-figure assessment bill isn’t a rounding error for a 15-person machine shop the way it might be for a prime contractor. For many small and non-traditional businesses, it’s simply a wall, one that pushes companies to walk away from defense work altogether rather than invest in a compliance process priced for a much larger balance sheet.

Compounding the cost problem is capacity. Valor’s submission notes that roughly 100 authorized C3PAOs currently exist to assess more than 100,000 companies. That imbalance doesn’t just create scheduling delays. It drives up market prices for the scarce assessment slots that do exist, since assessors can charge a premium in a market with far more demand than supply.

The Fix: Spread the Fixed Cost, Not the Standard

Cohort assessment addresses the cost driver directly, without touching the security bar itself.

The model works by coordinating groups of ten or twenty similarly sized companies, often through structures that already exist, such as Procurement Technical Assistance Centers (PTACs), state manufacturing associations, or regional defense industry alliances, and having a single C3PAO conduct assessments across that cohort in a coordinated engagement. Because most of the cost of an assessment sits in overhead that doesn’t change much based on how many companies are being assessed in a given trip or engagement window, spreading that overhead across ten or twenty companies instead of one moves the per-company cost from six figures toward something proportionate to actual revenue.

Two details matter here, and they’re the reason this model works as reform rather than as a shortcut:

Every company is still individually assessed. Cohort coordination shares the fixed cost of scheduling, travel, and scoping infrastructure. It does not mean a group passes or fails together, and it does not mean any company’s environment goes unexamined. Each business in the cohort still undergoes its own assessment against the same standard as a company assessed on its own.

Every company still individually attests. The compliance obligation, and the accountability that comes with it, stays with each business. Nothing about pooling logistics changes who is responsible for the accuracy of what gets submitted.

This is the detail that keeps the reform credible rather than becoming a loophole. As Valor’s submission notes directly, a cohort model does carry a coordination risk if member companies aren’t held to individual attestation, so preserving that individual accountability is what allows the Department to reduce cost without reducing rigor. The goal isn’t a lighter-touch standard. It’s a lighter-touch price tag for meeting the same standard.

Why This Reform, and Why Now

Of the recommendations in Valor’s submission, cohort assessment stands out for a practical reason: it requires no new infrastructure. It doesn’t wait on a new government-owned network, a rulemaking process, or a multi-year training pipeline for new assessors. It uses C3PAOs and regional industry associations that already exist today. That’s why Valor identified it, alongside standardized self-assessment templates, as a reform that could be piloted within the current 60-day review window.

Other structural reforms in Valor’s submission, like an accelerated assessor training pipeline or a centralized, government-managed DIB network, address the same underlying capacity and cost problems, but on a longer timeline of months or years. Cohort assessment is the near-term lever the Task Force can pull now, while those larger structural changes are still being designed.

The Stakes

None of this is an argument for lowering the bar. It’s an argument for making the bar reachable. A defense industrial base that only companies with six-figure compliance budgets can afford to join is a smaller, less resilient industrial base, not a more secure one. Cohort assessment offers a way to bring down the cost of proving security without changing what “secure” means.

Valor Cybersecurity will continue advocating for this and the other reforms outlined in our full submission to the CMMC Reform Task Force, and we remain available to provide further detail on any recommendation.

Valor Cybersecurity is a CMMC compliance and cybersecurity readiness company based in Norfolk, Virginia, serving defense manufacturers and shipyards across the Defense Industrial Base.