I'll be honest, it's getting ridiculous for me now many different compliance requirements are now affecting the company I work for. Don't get me wrong I'm all for good security controls and compliance but the issue I'm finding is that almost every different customer has their own cyber security control set we have to show compliance with. Now with the added CMMC requirements coming my way its becoming unmanageable the spreadsheet and word document way, but as a small business I don't have a huge budget at my disposal for spending on software tools to help with time-saving efficiencies.
Are any of you able to recommend a reasonable product that could be used for NIST 800-171 and CMMC pre-assessment preparation - risk assessments, controls gap analysis, preparing SSP's, POAMs, self assessment and recording evidence, scoring based on risk weightings etc.? So far all the products I've researched are after an exorbitant amount of money. CMMC as a buzzword seems to have joined a list of other terms like 'Risk' where vendors immediately add zeros to the end of the price, pricing based on the risk reduction rather than the value added and time saved compared to using conventional desktop office applications.
I'm looking forward to and interested to hear your thoughts on what solutions you use and what works well for you with regard to managing your cyber GRC.
