What drives CMMC certification cost?
If you're a small IT or cyber firm bidding on DoD work, your CMMC cost depends on three things: which level your contracts require, how close your systems already are to the required controls, and who performs the assessment. The most reliable public numbers come from the Department's own regulatory impact analysis in the CMMC Program final rule (32 CFR Part 170, 89 FR 83092), published October 15, 2024 and effective December 16, 2024. Every dollar figure below is a DoD estimate in 2023 dollars, not a quote. Your actual costs will vary.
One caveat matters more than any other: for Levels 1 and 2, DoD's estimates cover assessment and affirmation work only. The rule says DoD "did not consider the cost of implementing the security requirements themselves" because FAR 52.204-21 and DFARS 252.204-7012 already required them. If you still have gaps to close, remediation comes on top of these numbers, and for many small firms it's the biggest line item.
2026 status check: Phase 2 is suspended
On July 13, 2026, the Department of War announced the immediate suspension of CMMC Phase II, which had been scheduled to start November 10, 2026. It also launched a 60-day reform review. According to the DoD CIO's CMMC page, the program "is paused in Phase 1 and may only require self-assessments at two levels": Level 1 (Self) and Level 2 (Self). DFARS 252.204-7012 obligations still apply. So for now, a third-party (C3PAO) assessment is a readiness investment rather than a contract requirement. Budget for it only if you expect it to come back or a prime asks for it.
Level 1: Annual self-assessment (FCI only)
Level 1 covers firms that handle Federal Contract Information. It requires an annual self-assessment and affirmation against the 15 security requirements in FAR 52.204-21, with results entered in SPRS. POA&Ms aren't allowed, so every requirement has to be met.
- DoD estimate, small entity: about $5,977 per year for the self-assessment and affirmation (final rule). That covers internal director time and outside service provider hours for planning, assessing, and reporting.
- Other-than-small entity: about $4,042 per year (final rule).
- Remediation: not estimated by DoD (see above).
Level 2: CUI and NIST SP 800-171 (the "CMMC Level 2 cost" question)
Level 2 applies when you process, store, or transmit Controlled Unclassified Information. It's built on the 110 requirements of NIST SP 800-171 Rev. 2. The rule defines two paths, and their costs are very different.
Level 2 (Self). DoD estimates $34,277 for a small entity's initial self-assessment and affirmation. The three-year estimate is $37,196, which includes two annual affirmations at $1,459 each (final rule). Under the current pause, this is the only Level 2 path that new solicitations can require.
Level 2 (C3PAO). DoD estimates $101,752 for a small entity's initial certification assessment and affirmation, and $104,670 over three years with two $1,459 annual affirmations (final rule). Of that total, the C3PAO engagement itself is modeled at about $31,234 (a three-person team for 120 hours). The rest is your own staff time and consultant support for preparation and the assessment. Treat the C3PAO number as a model, not a price list: the rule says "market forces of supply and demand will determine C3PAO pricing." You can find accredited assessors and Registered Practitioner Organizations in the Cyber AB Marketplace.
POA&M closeout. If you hit the minimum score of 80% and every open item is allowed on a POA&M, you receive Conditional status. Then you have 180 days to remediate and pass a POA&M closeout assessment. Build that remediation sprint into your budget.
Level 3: NIST SP 800-172 and DIBCAC
Level 3 applies to a small subset of contractors. It adds selected NIST SP 800-172 requirements and a government-led DCMA DIBCAC assessment. It's also the only level where DoD estimated implementation costs, because those requirements weren't previously mandated. Under the current pause, new contracts may only require Level 1 or Level 2 self-assessments, so Level 3 is on hold. DoD's small-entity estimates from the final rule:
- Nonrecurring engineering (one-time): about $2,700,000
- Recurring engineering: about $490,000
- Assessment and affirmations: $9,050 initially, and $12,802 over three years (including two $1,876 annual affirmations)
The rule also notes that the total cost of Level 3 includes the cost of a Level 2 C3PAO certification.
Ongoing and annual costs
At every level, CMMC is a recurring cost, not a one-time project. Level 1 repeats every year. Level 2 needs a new assessment every three years plus annual affirmations in SPRS, and status lapses if you miss one. On top of the assessment work, you'll keep paying for the tools, services, and staff time needed to stay compliant. DoD doesn't estimate those costs for Levels 1 and 2, so the calculator above asks you to enter them yourself.