ConMon Site User Guide

The CMMC Continuous Monitoring Workload Calculator helps you estimate the real staff hours, FTE, and cost required to continuously monitor all 320 NIST 800-171 assessment objectives for CMMC Level 2 compliance.

The page is organized top-to-bottom:

• Summary Cards — high-level totals (objectives, hours, FTE, cost)
• Bar Charts — visual breakdown by frequency, family, and role cost
• Vendor Shared Responsibility — upload a vendor SRM to shift objectives
• Configure Estimated Staff Wages — set per-role rates for cost calculations
• All Objectives Table — the full 320-row table with filters, overrides, and pagination

All changes you make (overrides, rates, vendor settings) are saved automatically in your browser's local storage and will be restored on your next visit.

Select how many employees access your CUI environment. Larger teams have more systems, users, and documentation to review, so each assessment objective takes longer.

Employee Brackets

Click the bracket that matches your organization size. The default time per review adjusts automatically:

Summary Cards

Four cards at the top of the page give you an at-a-glance view:

• Total Objectives — the number of objectives in the current filtered view
• Annual Hours — total staff hours per year based on frequencies and time-per-review
• FTE Estimate — annual hours divided by 2,080 (standard work year)
• Total Annual Cost — hours multiplied by each objective's assigned role hourly rate

Bar Charts

Three charts sit below the summary cards:

• Hours by Frequency — how annual hours break down across Weekly, Monthly, Quarterly, etc.
• Hours by Family (Top 10) — which NIST control families consume the most monitoring time
• Cost by Role — annual cost split across IT Admin, Supervisor, HR, and CXO

Six dropdown filters sit above the objectives table. Use them to narrow down the 320 objectives to exactly what you need:

• Family — 14 NIST control families (AC, AT, AU, CA, CM, IA, IR, MA, MP, PE, PS, RA, SC, SI)
• Monitoring Check — 17 assessment categories (e.g., Config, Logs & Test; Document Review/Approve; Records & Test)
• Frequency — Weekly, Monthly, Quarterly, Bi-Annually, Annually, or Event-Driven
• Level — Level 1 or Level 2
• Responsibility — Contractor, ESP/CSP/MSP, Shared, or Contractor/Shared (combined)
• Role — IT Admin, Supervisor, HR, or CXO

Filters stack: selecting a Family and a Frequency shows only objectives matching both. The results counter and summary cards update to reflect the filtered view.

Every row in the objectives table can be customized. Overrides let you model your organization's actual workload instead of relying on defaults.

Time/Review

Click the time value (default 20 minutes) to edit it. Enter any value from 1 to 480 minutes. When changed, a red ring and pencil icon appears, along with a reset button to revert to the default.

Frequency

Click the chevron next to the frequency badge to open a dropdown. Select a different frequency (Weekly, Monthly, Quarterly, etc.). Overridden values show an amber ring and pencil icon. Choose “Reset to original” to revert.

Responsibility

When a vendor SRM is applied, click the chevron next to the responsibility value to toggle between Contractor and Shared. This lets you fine-tune which objectives your staff still owns.

Role

Click the chevron next to the role assignment to open a dropdown with four options: IT Admin, Supervisor, HR, or CXO. The same override pattern applies — amber ring, pencil icon, and “Reset to original” to revert.

If you use an ESP, CSP, or MSP that covers some CMMC objectives, you can upload their Shared Responsibility Matrix (SRM) to reflect that in the calculator.

• Select a vendor from the dropdown or upload a custom SRM JSON file.
• When applied, qualifying objectives shift from “Contractor” to “ESP/CSP/MSP” or “Shared”.
• Vendor-covered objectives are excluded from your workload calculations (hours, FTE, cost).

Shared SRM AOs Percentages

After applying a vendor, click “Shared SRM AOs Percentages” to open the Vendor Responsibility Modal. This lets you adjust the split between your team and the vendor on a per-control-family basis.

Restoring Previous Settings

If you previously applied a vendor SRM, the calculator will detect your saved settings and offer a “Previous Settings Found” prompt. Click restore to pick up where you left off.

The “Configure Estimated Staff Wages” collapsible panel lets you set the loaded labor rate for each of the four staff roles:

Edit any rate by clicking the input field and typing a new value. Changes take effect immediately — the Total Annual Cost card and Cost by Role chart update live. Rates are saved to local storage.

Click the “Download Report” banner to open the report modal.

• Business email required — personal email providers (Gmail, Yahoo, Outlook.com, etc.) are not accepted. Use your company email address.
• Format selector — choose PDF, CSV, or Both.
• PDF includes summary cards, charts, and a full objectives breakdown — ideal for executive presentations.
• CSV contains the raw data for all 320 objectives with your overrides applied — ideal for spreadsheet analysis.

After submission, the report is emailed to the address you provided. A lead notification is also sent to the BomberJacket Networks team so we can follow up with additional guidance if needed.