How Much Does CMMC Cost? DoD Estimates by Level
By Shaheer Malik · Updated Oct 28, 2026
DoD estimates that for a small business a CMMC Level 1 self-assessment and affirmation costs about $5,977 a year, a Level 2 self-assessment about $37,196 over three years, and a Level 2 C3PAO certification about $104,670 over three years. All three figures assume you have already implemented the security requirements, so the cost of getting compliant comes on top.[1]
DoD estimates, small business
| Status | First assessment + affirmation | Over the cycle |
|---|---|---|
| Level 1 (Self) | $5,977 | Every year |
| Level 2 (Self) | $34,277 | $37,196 over 3 years |
| Level 2 (C3PAO) | $101,752 | $104,670 over 3 years |
The three-year figures add two annual affirmations at $1,459 each to the triennial assessment.[1] For larger companies DoD estimates $4,042 a year for Level 1.[1]
What the estimates leave out
DoD states there are “no nonrecurring or recurring engineering costs” in the Level 1 and Level 2 estimates because it assumes the requirements are already implemented.[1] The real bill usually includes:
- Closing gaps: tools, configuration, policies and staff time.
- Cloud services that can hold CUI, which must meet FedRAMP Moderate or equivalent (see GCC High).[2]
- Consultant fees for scoping, gap assessment and the System Security Plan.
- Ongoing monitoring between assessments.
How to bring the number down
- Shrink the scope. Fewer systems and people touching CUI means less to secure and assess; see CMMC enclaves.
- Self-assess where the contract allows. Since September 3, 2026, contracts may require Level 2 (Self) instead of C3PAO certification.[3]
- Compare quotes on the same scope. Prices vary by firm; most quote per project.
The Level 2 breakdown is in CMMC Level 2 cost. To price your own scope, get up to 3 quotes.
FAQ
How much does CMMC Level 1 cost?
DoD estimates about $5,977 a year for a small business’s Level 1 self-assessment and affirmation, assuming the 15 requirements are already in place.
How much does a CMMC Level 2 assessment cost?
DoD estimates about $101,752 for a small business’s C3PAO certification assessment and affirmation, $104,670 over three years, excluding remediation.
How much does CMMC consulting cost?
It depends on scope and starting point; consultants usually quote per project after a scoping call. Get at least two written quotes for the same scope.
Sources
- Cybersecurity Maturity Model Certification (CMMC) Program, 32 CFR part 170, 89 FR 83092 (Oct 15, 2024) (checked Oct 16, 2026)
- DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (checked Oct 28, 2026)
- Class Deviation 2026-O0025, Revision 3: FAR Overhaul Part 40, DFARS Part 240 (Sep 3, 2026) (checked Oct 28, 2026)
More on getting certified
- CMMC Certification Cost: What Level 2 Costs in 2026
- CMMC Level 2 Assessment: How a C3PAO Certifies You
- How to Get CMMC Certified: 9 Steps for 2026
- How Long Does CMMC Certification Take?
- What Defines the Scope of a CMMC Assessment?
- CMMC POA&M Rules and Conditional Status Explained
Get quotes from matching firms
Describe what you need once. It goes to up to 3 matching firms, never published or sold.
Request quotesIndependent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.