How Much Does CMMC Level 2 Cost?

By Shaheer Malik · Updated Oct 16, 2026

The Department of Defense estimates that supporting a CMMC Level 2 certification assessment costs a small business about $101,752, or $104,670 over three years including the annual affirmations.^[1] That figure covers the assessment itself. It assumes you have already implemented all the security requirements, so the work to get there is extra.

What the DoD estimate includes

In the final CMMC Program rule, DoD broke the small-entity Level 2 certification cost into stages: planning and preparing for the assessment, conducting it with a C3PAO, and reporting and affirming the results. The three-year figure adds two annual affirmations to the triennial assessment.^[1]

DoD states plainly that there are “no nonrecurring or recurring engineering costs” in that estimate, “since it is assumed the contractor or subcontractor has implemented the NIST SP 800-171 R2 security requirements.”^[1]

What it leaves out

The estimate excludes the cost of becoming compliant: closing gaps against the 110 requirements of NIST SP 800-171 Revision 2, new tools, policies and staff time.^[1] For many companies that is the larger bill, and it varies with how much of your environment handles Controlled Unclassified Information.

What drives your number

• Scope. The fewer systems and people that touch CUI, the less there is to secure and assess. Many companies limit scope with a separate enclave.
• Starting point. A company that already meets most of the 110 requirements needs far less remediation than one starting from scratch.
• Who does the work. Doing readiness in-house costs staff time; hiring a Registered Provider Organization (RPO) costs fees. Only a C3PAO can perform the certification assessment itself.
• Passing on the first try. You can receive a Conditional status with a minimum score of 80 percent and certain open items on a Plan of Action and Milestones, which you must then close out.^[1]

Getting quotes

Prices vary by firm and scope, and most firms quote case by case. Compare at least two RPOs for readiness work and two C3PAOs for the assessment, and confirm each firm's current status on the Cyber AB Marketplace.^[2]

FAQ

Does the DoD estimate include fixing security gaps?

No. DoD’s Level 2 certification estimate assumes the NIST SP 800-171 requirements are already implemented, so remediation costs are not included.

How often is a Level 2 certification assessment needed?

Every three years, with an affirmation of compliance each year in between, according to the CMMC Program rule.

Sources

1. Cybersecurity Maturity Model Certification (CMMC) Program, 32 CFR part 170, 89 FR 83092 (Oct 15, 2024) (checked Oct 16, 2026)
2. Cyber AB Marketplace (checked Oct 16, 2026)