How much does CMMC cost?

The short version

CMMC assessment cost depends on the level your contracts require and the assessment type that comes with it:

• Level 1 and Level 2 self-assessments: no assessor fee. The cost is internal time to assess, record the score in SPRS, and affirm annually.
• Level 2 C3PAO certification: DoD’s own cost model puts the C3PAO fee at roughly $31,000 to $52,000. Market pricing is set by supply and demand and quotes above the model are common. The certification is valid for three years.
• Level 3: the assessment is government-led by DCMA DIBCAC, so no C3PAO fee attaches to the Level 3 step itself, but a current Level 2 C3PAO certification is required first.

Those figures are assessor fees only. For most contractors the real cost of CMMC is remediation: closing gaps against NIST SP 800-171 before anyone shows up to assess.

What DoD’s own numbers say

The CMMC final rule includes DoD’s Regulatory Impact Analysis (89 FR 83185-88), the only official pricing in the program. Its modeled figures:

• Level 1 self-assessment plus affirmation: $5,977 per year for a small entity. Almost all of that is the entity’s own labor; there is no assessor.
• Level 2 self-assessment: $34,277 for a small entity on a three-year cycle, again internal labor.
• Level 2 C3PAO certification: $101,752 for a small entity and $112,345 for an other-than-small entity. Inside those totals, the C3PAO’s own fee is $31,234 and $52,056 respectively; the remainder is the organization’s own participation. DoD assumes a 3-person, 120-hour assessment team for a small entity and a 5-person, 200-hour team otherwise.
• Level 3: the government-led assessment is modeled at $9,050 and $39,021, but DoD prices the NIST SP 800-172 engineering separately at $2.7 million and $21.1 million nonrecurring, plus $490,000 and $4.12 million a year to sustain. Level 3 is the only level where DoD priced implementation at all.

Two caveats matter more than any figure. First, DoD says plainly that these are modeling assumptions, not market prices; C3PAO pricing is set by the marketplace. Second, the Level 1 and Level 2 estimates exclude implementation entirely, because DoD treats FAR 52.204-21 and NIST SP 800-171 as already required under existing contract clauses. Whatever your gap analysis finds is on top of every number above.

The cost that is not in the numbers: remediation

For an organization starting cold against NIST SP 800-171’s 110 requirements, remediation routinely exceeds every other line item: new tooling, architecture changes, monitoring, documentation, and staffing. Nobody has published a defensible market figure for it because it depends entirely on your starting gap.

The dominant cost decision is containment. Confining CUI to a well-built enclave keeps the assessment boundary, and therefore both the remediation bill and the assessor fee, small. Letting CUI spread through general email and file shares puts the whole environment in scope. If you are deciding between levels, the level sections on the CMMC page describe what each one involves.

Internal effort for a typical first Level 2 certification commonly runs 200 to 1,500 hours, excluding remediation engineering. A contained, self-assessed Level 1 environment is far lighter, commonly 20 to 120 hours.

What moves the number

• Which CMMC level your contracts require, and whether certification or self-assessment applies
• Where FCI and CUI live, and whether an enclave can contain them
• Your real starting gap against NIST SP 800-171, not the optimistic one
• Reliance on external service providers and cloud offerings that must meet FedRAMP expectations
• Recurring affirmation and evidence work between assessments

How we estimate these figures

Cost figures on this site follow one definition so that standards stay comparable: the range covers external validation fees only for the standard’s most common audited path, which for CMMC is a Level 2 C3PAO certification. Self-assessed levels involve no assessor and appear as scenarios instead. The bounds follow DoD’s modeled C3PAO fee; where market quotes exceed the model, the page says so rather than inventing a number. Ranges are directional, not quotes. The full definition is in How we estimate cost and effort.