CMMC Certification Cost

CMMC certification cost: what DoD estimated

The only official CMMC cost figures come from DoD's regulatory impact analysis (RIA) for the program rule. For a small entity, the RIA estimated ¹:

• Level 1 (Self): $5,977 to support the self-assessment and affirmation, repeated every year.
• Level 2 (Self): $34,277 per assessment, or $37,196 over three years including annual affirmations.
• Level 2 (C3PAO): $101,752 per assessment, or $104,670 over three years including affirmations.
• Level 3 (DIBCAC): $9,050 to support the government assessment, or $12,802 over three years.

A note on the source: the figures here are from the RIA posted with the rulemaking docket in base-year 2023 dollars. Secondary sources report that the same figures appear in the final rule ², published October 15, 2024 ³. Either way they are DoD planning estimates, not market prices.

At the program level, GAO's report on the final rule says DoD estimated annualized total costs of about $4.0 billion at a 7 percent discount rate ⁴.

What DoD's estimates leave out

DoD's figures cover the cost of the assessment, not the cost of meeting the requirements. DoD treats the security controls as already required by FAR 52.204-21 and DFARS 252.204-7012, so it did not count implementation in the CMMC estimate, and the figures do not reflect actual C3PAO prices in the marketplace ²⁵⁶.

That gap matters most at Level 2 and Level 3:

• Level 2. If your company has never implemented NIST SP 800-171, the work to reach 110 of 110 (new tools, configuration, documentation and staff time) usually costs more than the assessment.
• Level 3. Cabrillo Club, citing the final rule, reports DoD estimated about $2.7 million in nonrecurring engineering and $490,000 in annual sustainment to implement Level 3 controls, far above the $9,050 assessment-support figure ².

Treat any single "CMMC cost" number with care. Ask what it includes: assessment only, preparation, remediation, or ongoing operation.

What drives your CMMC compliance cost

Scope, enclave choice, cloud licensing, your starting score and outside help decide most of the total.

1. Scope. Every system, person and site that touches CUI, plus the security tools protecting them, is in scope ⁷. More assets mean more to configure, document and assess.
2. Enclave or whole company. Keeping CUI in a separated enclave can take most of your network out of scope, because only out-of-scope assets need to be separated ⁷. An enclave costs money to build, but it can be cheaper than bringing every laptop and server up to Level 2. Our GCC High and enclave guide walks through the choice.
3. Cloud and licensing. If CUI lives in a cloud service, DFARS 7012 requires that service to meet security equivalent to the FedRAMP Moderate baseline ⁶. Many contractors move email and files to Microsoft 365 GCC High, which is sold only after Microsoft validates eligibility and has no trial ⁸. Get licensing quotes from a Microsoft partner; we do not publish GCC High prices because we have no published Microsoft list price to cite.
4. Your starting score. A company at 100 of 110 has a short list of 1-point items. A company with a negative score has months of work. The SPRS scoring method is explained in our CMMC Level 2 guide.
5. Outside help. Consultants, registered practitioner organizations (RPOs) and managed security providers charge for gap assessments, documentation and ongoing operation. One published 2026 guide puts external IT consultant labor at $150 to $250 per hour ⁹; CMMC specialists may charge differently, so get written quotes.

Remediation: where the money usually goes

Remediation is the work of closing gaps between your current setup and the requirements, and it is usually the largest line item at Level 2. Common areas:

• Identity and multifactor authentication. Missing MFA costs 3 to 5 points in SPRS scoring, depending on coverage ¹⁰.
• FIPS-validated encryption for CUI. Encryption that is not FIPS-validated costs 3 points; no encryption costs 5 ¹⁰.
• Logging and monitoring. The audit requirements usually mean a log collection tool and someone to review it, often through a SOC service or managed detection and response.
• Documentation. A system security plan, policies and a plan of action. The system security plan can never be deferred on a POA&M ¹¹.
• Physical security. Visitor escort, access logs and badge or key control, which also cannot be deferred ¹¹.

The POA&M rules shape the budget. You need a score of at least 88 to use one, only 1-point items qualify, and everything must close within 180 days ¹¹. That pushes most spending before the assessment rather than after.

Ongoing CMMC costs after the assessment

CMMC is a recurring cost, not a one-time project. The rule builds in a cycle you pay for every year and every three years:

• Annual affirmations. Every level requires a senior official to affirm compliance in SPRS at the time of assessment and every year after ¹². Each affirmation needs someone to confirm the controls are still working, which is staff or consultant time.
• Level 1 every year. The Level 1 self-assessment repeats annually ¹³, which is why DoD's estimate for it is a yearly figure ¹.
• Level 2 every three years. Self-assessments and C3PAO assessments both repeat on a three-year cycle ¹⁴¹⁵. DoD's three-year totals ($37,196 and $104,670) include the affirmations in between ¹.
• Running the controls. Patching, log review, vulnerability scanning, training and incident readiness continue all year. DFARS 252.204-7012 also requires reporting cyber incidents within 72 hours and keeping system images for 90 days, which means having a plan and the tools in place before anything happens ⁶.

The cheapest year is usually the second one, once the controls are built and documented. The most expensive surprise is a lapse: if a Conditional status expires because POA&M items were not closed within 180 days, the work restarts ¹¹.

How to budget for CMMC now

Budget for the level your contracts can require today, and keep the option to go further. During the Phase 2 suspension, contracting officers may designate only Level 1 (Self) or Level 2 (Self) ¹⁶, and DoD still enforces NIST SP 800-171 Rev 2 ¹⁷.

A practical budget sequence:

1. Gap assessment first. It turns an unknown into a priced list. See what one delivers in our CMMC compliance services guide.
2. Decide scope (enclave or whole company) before buying licenses.
3. Price remediation item by item, starting with 5-point requirements.
4. Add running costs: monitoring, patching, training and annual affirmations. Many small contractors fold these into a managed IT plan or managed security services.
5. Hold a line for a C3PAO assessment if your contracts or primes are likely to require one when Phase 2 resumes; see C3PAO assessments.

The schedule may change; check the DoD CIO CMMC page for current status before committing to a C3PAO date ¹⁷. For the program overview, see the CMMC guide.