Unfortunately, it is a necessary evil. The self-certifying just hasn't been working and small businesses have been a prime target for hackers BECAUSE they often lack the cybersecurity necessary to keep their data safe. This is especially true of government contractors.
Also, the CMMC site states that the cost of an audit will be an "allowable" cost when negotiating a contract, so even though it will cost money up front (our best estimate, for the audit itself, is around $20,000 to $40,000), you should be made whole for that cost.
We understand that it's frustrating and nerve-wracking, but it is best for the US government and for your business. Also, you can contact us with any other detailed questions you might have, by calling us at 919-422-2607 or scheduling a free consultation with Craig online.