CMMC Compliance Cost: By Level, Scope, and C3PAO Fees

CMMC compliance cost typically runs between about $6,000 and $120,000 per assessment cycle, with the Department of Defense estimating roughly $102,000 for a small business pursuing Level 2 third-party certification and about $120,000 for a large contractor.¹ Those figures only cover the formal assessment. The bigger checks most contractors write are for the infrastructure upgrades, consulting help, and cloud subscriptions needed to reach a passing score in the first place.

DoD Cost Estimates by Level

The CMMC final rule at 32 CFR Part 170 includes a regulatory impact analysis with per-level cost projections. These are averages per contractor information system, and they give you a benchmark for measuring vendor quotes.

Level 1 is a self-assessment covering basic safeguarding of Federal Contract Information. DoD projects roughly $6,000 for a small entity and $6,400 for a larger one. That covers labor to plan, run the self-assessment, enter results in the Supplier Performance Risk System, and complete the annual affirmation.¹

Level 2 splits into two tracks, and the gap is large. A Level 2 self-assessment runs about $30,000 for a small business and $32,000 for a large one. A Level 2 third-party certification jumps to roughly $102,000 for a small entity and $120,000 for a large entity.¹ Which track applies is specified in each solicitation, so the same company can face different requirements across different contracts.²

Level 3 flips the cost structure. The assessment itself, run by the government’s Defense Industrial Base Cybersecurity Assessment Center, is modest at roughly $9,000 to $12,000. The engineering work to meet Level 3’s additional security requirements is where the money goes: DoD estimates $2.7 million in nonrecurring costs for a small organization and $21.1 million for a large one, with annual recurring costs of $490,000 and $4.1 million respectively.¹ Level 3 applies only to contracts involving the most sensitive defense programs.

What You Actually Spend Money On Before the Assessment

The DoD figures assume a company that already has meaningful security in place. Most contractors do not. Getting there is where the majority of the real budget goes.

Level 2 is built on the 110 security requirements in NIST SP 800-171 Revision 2.³ Work starts with a gap analysis that maps existing controls against each of those requirements: hardware configurations, access controls, encryption, audit logging, and data handling. The findings almost always trigger infrastructure changes.

Common upgrades include deploying multi-factor authentication across every account, adding endpoint detection tools, and building centralized log management. Many contractors also find they need a cloud environment authorized to handle Controlled Unclassified Information. Microsoft 365 GCC High is a frequent choice and supports Level 2 and Level 3 when configured properly.⁴ Government cloud licenses cost meaningfully more per user than standard commercial ones, and that difference recurs every month.

Documentation is the other significant line item. You need a System Security Plan describing how each requirement is implemented, including system boundaries, operating environments, and external connections. Where a requirement is not fully met, you need a Plan of Action and Milestones showing when and how the gap closes.⁵ Staff training on secure data handling, MFA tools, and incident reporting fills out the internal preparation work.

Plan on six to eighteen months of remediation before you are assessment-ready. Contractors who wait for a solicitation to hit their desk before starting rarely finish in time.

The Biggest Cost Lever: Scope

The most effective way to control CMMC spending is to shrink what falls inside the assessment boundary. Every system, device, and user account that touches Controlled Unclassified Information is in scope, and every in-scope asset has to meet all 110 requirements. Cutting that footprint cuts both remediation and assessment costs directly.

DoD’s CMMC Scoping Guide describes using physical or logical separation to isolate CUI processing into a defined security domain. Logical separation uses firewalls, VLANs, or VPN tunnels to keep data from flowing between the CUI environment and the rest of the network. Physical separation means no wired or wireless connection at all, with data moved only through controlled means such as removable media.⁶

A company with 500 employees but only 30 who handle CUI can build an enclave around those 30 users. The enclave still has to meet every CMMC requirement, but the other 470 users and their systems are out of scope. That distinction can turn a six-figure remediation project into a five-figure one. Some controls, like enterprise antivirus managed centrally by IT, can be inherited from the broader organization, but the enclave must independently satisfy anything the enterprise implementation doesn’t fully cover.⁶ Every asset you can legitimately exclude saves remediation, documentation, and assessor time.

Consulting and Managed Service Fees

Most contractors bring in outside help somewhere in the process. Rates vary by region, firm, and complexity.

CMMC readiness consultants generally charge $150 to $400 per hour. Small businesses with a straightforward environment often spend $15,000 to $35,000 on gap analysis and documentation. Larger organizations with distributed networks, multiple facilities, or complex data flows can exceed $100,000 in consulting fees before the formal assessment starts. Consultants help interpret the requirements, build the System Security Plan, and run mock assessments that mirror the official process.

Managed Service Providers and Managed Security Service Providers cover ongoing technical controls for companies that cannot staff those functions in-house. Compliance-focused monthly retainers typically run from a few thousand dollars up to $15,000 or more per month for 24/7 monitoring, incident response, vulnerability scanning, and patch management. Picking a provider with specific CMMC experience matters, because generic IT support tends to miss requirements around audit log retention, media protection, and CUI marking.

C3PAO Assessment Fees

When a contract requires Level 2 certification rather than self-assessment, you hire a Certified Third-Party Assessment Organization accredited by the Cyber AB.⁷

DoD’s cost model assumes a three-person team working about 120 hours at roughly $260 per hour, which puts the direct C3PAO cost near $31,000. Market pricing varies. Industry reports from 2024 and 2025 show C3PAO fees of $30,000 to $60,000 for a single-site small business, with multi-site or complex environments running higher. DoD has said market forces of supply and demand will determine pricing, so costs may shift as more assessors enter the market or demand spikes near deadlines.¹

A typical Level 2 certification involves document review, interviews, and on-site inspection of technical controls. The team verifies implementation of all 110 requirements and scores the results. A passing score is entered into SPRS, and CMMC status stays valid for three years.² Some C3PAOs offer a pre-assessment engagement to catch remaining gaps before the formal review. It adds cost but cuts the risk of failing and paying for a second attempt.

Recurring Costs After Certification

CMMC is not a one-time spend. The ongoing bill is smaller than the initial push, but it never stops as long as you hold defense contracts.

Every level requires an annual affirmation. A senior official has to attest each year that the organization still meets all applicable requirements. Level 1 contractors run a new self-assessment and affirmation each year, submitting both to SPRS. Level 2 contractors on the self-assessment track redo the full self-assessment every three years and affirm annually in between. Level 2 contractors with C3PAO certification affirm annually and go through the full third-party assessment on a three-year cycle.⁸

Beyond assessments, budget for the operational cost of keeping controls in place. Subscriptions for endpoint detection, SIEM, and vulnerability scanning are permanent line items. Log reviews, penetration testing, and security awareness training recur on regular schedules. The System Security Plan has to be updated whenever the IT environment changes, whether that means a new server, a switched cloud provider, or a new subcontractor. Companies that treat compliance as a project with a finish line tend to drift out of compliance within a year or two, which puts both their CMMC status and their contract eligibility at risk.

The Cost of Getting It Wrong

The financial risk of misrepresenting CMMC compliance is far larger than the cost of achieving it. Since 2021, the Department of Justice has used its Civil Cyber-Fraud Initiative to pursue contractors under the False Claims Act for submitting false security assessment scores, claiming compliance with NIST SP 800-171 they hadn’t actually implemented, or failing to report known breaches.

The False Claims Act imposes civil penalties of $13,946 to $27,894 per false claim, plus three times the damages the government sustains.⁹¹⁰ The treble damages provision means a contract worth several million dollars can produce eight-figure liability. The government does not need to prove an actual breach or intent to defraud; reckless disregard for whether your score is accurate is enough.

In 2024, Penn State agreed to pay $1.25 million to settle allegations that it failed to implement required safeguards on fifteen defense contracts, misrepresented its compliance timelines, and used cloud services that did not meet FedRAMP requirements. In 2025, Georgia Tech’s research arm settled for $875,000 over allegations that it failed to install antivirus tools on a lab handling DARPA research and submitted a false assessment score to DoD. In both cases, whistleblowers triggered the investigations and shared in the settlements.

Lower-Cost Help for Small Contractors

Small defense contractors have a few resources that can take the edge off. Project Spectrum, a DoD-affiliated initiative recognized as a Cyber AB Registered Practitioner Organization, offers cybersecurity readiness tools, training, and access to cyber advisors at reduced or no cost.¹¹ It exists specifically to help smaller companies navigate CMMC without paying full consulting rates for basic guidance.

The NIST Manufacturing Extension Partnership operates centers in all 50 states and Puerto Rico that provide consulting and training to small and mid-sized manufacturers, including cybersecurity services.¹² MEP centers can support gap analysis and remediation planning, though depth and pricing vary by location.

On the tax side, CMMC spending on consulting, infrastructure, and assessments generally qualifies as an ordinary and necessary business expense. Work with your tax advisor on whether specific expenditures, especially any tied to software development, fall under Section 174 capitalization rules rather than immediate deduction. DoD has also confirmed that CMMC assessment costs are allowable contract costs under FAR 31.201-2, so contractors can factor these expenses into contract pricing.¹

1
Federal Register. Cybersecurity Maturity Model Certification (CMMC) Program
2
Department of Defense Chief Information Officer. About CMMC
3
Department of Defense Chief Information Officer. CMMC Model Overview
4
Microsoft. Microsoft and the Cybersecurity Maturity Model Certification (CMMC)
5
Department of Defense. NIST SP 800-171 DoD Assessment Methodology
6
Department of Defense Chief Information Officer. CMMC Scoping Guide – Level 2
7
Department of Defense Chief Information Officer. CMMC Assessment Guide – Level 2
8
eCFR. 32 CFR Part 170 – Cybersecurity Maturity Model Certification (CMMC) Program
9
Office of the Law Revision Counsel. 31 USC 3729 – False Claims
10
Federal Register. Civil Monetary Penalties Inflation Adjustments for 2024
11
Project Spectrum. Project Spectrum
12
National Institute of Standards and Technology. Manufacturing Extension Partnership (MEP)