CMMC Compliance CheckCMMC compliance cost: the DoD's own estimates
The only published, sourced cost figures for CMMC are the DoD's estimates in the regulatory impact analysis of the final rule (CMMC Program final rule, 89 FR 83092 (15 October 2024)). They cover preparing for and completing an assessment and the affirmations. They are estimates, not quotes.
Estimated cost per entity
| Assessment | Small entity | Other than small |
|---|---|---|
| Level 1 self-assessment and affirmation (each year) | $5,977 | $4,042 |
| Level 2 self-assessment and affirmation | $34,277 | $43,403 |
| Level 2 self-assessment, three years with two more affirmations | $37,196 | $48,827 |
| Level 2 certification assessment (C3PAO) and affirmation | $101,752 | $112,345 |
| Level 2 certification, three years with two more affirmations | $104,670 | $117,768 |
Source: CMMC Program final rule, 89 FR 83092, regulatory impact analysis (tables 9 and 10), read on 1 October 2026.
What the estimates leave out
The DoD assumed contractors had already implemented the requirements, because FAR 52.204-21 and DFARS 252.204-7012 required them before CMMC. So the figures don't include the cost of closing gaps: new tools, MFA, logging, FIPS-validated encryption, an enclave, or staff time to write policies. For many small contractors that is the larger cost. Get quotes for your own scope.
Ways to keep the cost down
- Shrink the scope: keep CUI in a smaller, well-defined enclave (32 CFR 170.19, CMMC scoping).
- Find your gaps before an assessor does: the free self-check scores your answers and lists gaps by points.
- Fix the 5-point gaps first; they can't go on a POA&M.