https://www.pivotpointsecurity.com/can-smbs-afford-cmmc-level-2-certification/