Time and money spent working with cybersecurity professionals writing SOG/SOPs which map the business practices to the standard. Money spent buying and setting up some of the necessary equipment to handle CUI properly. Time (indirectly money) spent redoing decades old business processes to map to the new paradigm. Time (indirectly money) as the business spent time training their staff up on the components relevant to their business units.
I agree that building a culture is at the root of it, however, that culture alone isn't going to move the needle unless everything else is in place as well. Worse, you have to walk the company through the 5 phases of grief because in general people don't entirely understand what is actually going on and why it's important. "So you can get government prime contracts" is an easy answer, but doesn't erase the confusion behind all of the hand-wavy procedural work required to execute them.