Short answer: In the final CMMC Program rule (32 CFR Part 170), the Department of Defense estimated the three-year cost for a small business at about $5,977 per year for Level 1 (an annual self-assessment), $37,196 for a Level 2 self-assessment, and $104,670 for a Level 2 certification assessment by a C3PAO. Those figures cover assessment and affirmation only. DoD assumed you had already implemented the security requirements, so the cost of closing gaps, often the largest part of the bill, comes on top.
What are DoD’s official CMMC cost estimates?
DoD published per-company estimates in the regulatory impact analysis of the final rule (89 FR 83092, October 15, 2024). The three-year figures include the assessment, the initial affirmation, and the annual affirmations that follow.
| CMMC requirement | Small entity | Other than small | How often |
|---|---|---|---|
| Level 1 self-assessment + affirmation | $5,977 per assessment | $4,042 per assessment | Every year |
| Level 2 self-assessment + affirmations | $34,277 per assessment; $37,196 over three years | $43,403 per assessment; $48,827 over three years | Every three years, with annual affirmations |
| Level 2 certification assessment (C3PAO) + affirmations | $101,752 per assessment; $104,670 over three years | $112,345 per assessment; $117,768 over three years | Every three years, with annual affirmations |
For the small-business Level 2 certification estimate, DoD broke the cost into internal and outside time:
| Cost element (small entity, Level 2 certification) | DoD estimate |
|---|---|
| Planning and preparing for the assessment | $20,699 |
| Supporting the assessment | $45,509 |
| Reporting results | $2,851 |
| C3PAO assessment team (3 people, 120 hours) | $31,234 |
| Initial affirmation | $1,459 |
| Two annual reaffirmations | $1,459 each |
DoD’s small-entity estimates assume you’ll pay an outside service provider to help you prepare, which is why they’re higher than the in-house estimates for larger companies on Level 1.
What do DoD’s estimates leave out?
The biggest caveat is written into the rule itself: DoD assumed no nonrecurring or recurring engineering costs for Levels 1 and 2, because contractors were already required to implement these safeguards under existing clauses. Level 1’s 15 requirements come from FAR 52.204-21. Level 2’s 110 requirements come from NIST SP 800-171, required by DFARS 252.204-7012.
So the published figures don’t include:
- Remediation. Multi-factor authentication, logging and monitoring, encryption, endpoint protection, and physical security upgrades.
- Documentation. A System Security Plan, policies, procedures, and evidence an assessor will accept. The rule says drafts and unapproved policies don’t count as evidence.
- Technology changes. Moving CUI into a FedRAMP Moderate (or equivalent) cloud environment, or building a separate environment for it.
- Ongoing operations. Staff or managed-service time to keep controls running between assessments.
If you’re starting with significant gaps, remediation and documentation can cost more than the assessment itself.
What drives your actual CMMC cost?
| Cost driver | Why it matters |
|---|---|
| Your starting point | An accurate SPRS score near 110 means little remediation. A low or negative score means real work before any assessment. |
| Scope size | Every system, user, and location that touches CUI is in scope. A smaller, well-defined scope (sometimes an enclave) means fewer assets to secure and assess. |
| Level required | Level 1 is an annual self-assessment of 15 requirements. Level 2 is 110 requirements, and may require a C3PAO. See Level 1 vs. Level 2. |
| Self-assessment vs. C3PAO | Your contract determines which Level 2 assessment applies. A C3PAO assessment adds the assessor’s fee and more preparation time. |
| Cloud and service providers | Providers that handle CUI or security data are part of your scope. Good provider documentation (a customer responsibility matrix) reduces effort. |
| Internal capacity | Whether your team or IT provider can implement and maintain the controls, or whether you need outside help. |
How do you keep CMMC costs down?
- Confirm which level you actually need. Your contract, and the information you receive, sets the requirement. Not every contractor needs Level 2. Start with what counts as CUI.
- Shrink your scope. Keep CUI in as few systems, and with as few people, as possible.
- Get an honest baseline first. A gap assessment against the 110 requirements tells you what remediation will really involve before you commit to a budget.
- Fix the high-value requirements first. Apart from one narrow encryption exception, requirements worth 3 or 5 points can’t be left on a POA&M, so they have to be met before a conditional status is possible.
- Reuse your evidence. The same SSP, policies, and records support SPRS, CMMC, and customer security questionnaires.
Does the CMMC Phase II suspension change the cost?
It changes the timing of mandatory C3PAO certification, not your current obligations. Phase II, which would have required C3PAO certification in many contracts starting November 10, 2026, was suspended in July 2026 while the program is reviewed. DFARS 252.204-7012, your SPRS score, and Phase I self-assessments and affirmations still apply. See what the Phase II suspension means. The remediation work, usually the largest cost, is required either way.
Frequently Asked Questions
How much does a CMMC Level 2 certification cost for a small business?
DoD estimated $104,670 over three years for a small entity, covering a C3PAO assessment, preparation, and three affirmations. That figure assumes the 110 NIST SP 800-171 requirements are already implemented. Remediation and documentation costs are extra.
How much does CMMC Level 1 cost?
DoD estimated $5,977 per year for a small entity using outside help, and $4,042 for a larger company doing it in-house. Level 1 is an annual self-assessment and affirmation. There’s no third-party assessment and no POA&M allowed.
Is a CMMC self-assessment cheaper than a C3PAO assessment?
Yes. DoD’s three-year estimate for a small-entity Level 2 self-assessment is $37,196, compared with $104,670 for a C3PAO certification assessment. You don’t get to choose, though: the contract specifies which one is required.
Are CMMC costs allowable on government contracts?
Treatment of compliance costs depends on your contract type and accounting practices. Talk to your contracting officer or a government contracts accountant. This is outside the scope of a cybersecurity assessment.
How USCIBER can help
USCIBER’s CMMC Readiness Review (from $7,500) gives you the honest baseline that makes the rest of the budget predictable: your real SPRS score, your scope, the gaps that matter most, and a prioritized remediation plan. If you need the documentation itself, our Compliance Documentation Project produces your SSP, POA&M, and policies. USCIBER is a readiness consultant. We are not a C3PAO and do not issue certifications. Learn more on our CMMC consulting page.
Sources
- Federal Register — Cybersecurity Maturity Model Certification (CMMC) Program, final rule, 89 FR 83092 (October 15, 2024): regulatory impact analysis, per-entity cost estimates
- eCFR — 32 CFR Part 170, CMMC Program: §§ 170.15–170.17 (assessments), § 170.21 (POA&M), § 170.24 (scoring)
- DoD CIO — CMMC
This article is general information, not legal advice.