CMMC Certification Costs by Level

Cybersecurity Maturity Model Certification (CMMC) costs vary based on the level your contracts require, the size of the IT environment, and the security controls already in place. A contractor protecting only Federal Contract Information (FCI) has a different investment than one handling controlled unclassified information (CUI), and two organizations at the same level can see different totals depending on the complexity of their environment.

Working with an independent CMMC compliance team to scope those variables before committing to a budget gives you a more accurate picture of what each level actually costs for your environment.

In This Article: CMMC certification costs by level, covering assessment fees, remediation expenses, scope factors, and the distinction between one-time and recurring compliance spending for Defense Industrial Base contractors.

What Goes Into CMMC Certification Costs

Cost estimates in the final rule for 32 CFR Part 170 assume contractors already meet NIST SP 800-171 requirements under DFARS 252.204-7012 (Department of Defense, 2024). When gaps exist in an organization’s security program, the actual investment includes gap analysis, remediation, technology implementation, documentation, and ongoing maintenance beyond the assessment itself.

Several variables affect the total, including how many users, locations, and devices handle CUI; how many applications process or store it; whether existing controls produce documented evidence; and how well the CUI boundary is defined. A contractor with 50 users at one site running a segmented CUI enclave has a different scope than one with 500 users across four locations on a flat network.

CMMC Level 1 Costs

Level 1 applies to contractors handling FCI and requires 17 practices drawn from Federal Acquisition Regulation (FAR) 52.204-21. Each contractor completes a self-assessment and submits results through the Supplier Performance Risk System (SPRS), with no third-party involvement.

Annual Level 1 costs run roughly $4,000 to $6,000, depending on entity size, and cover the self-assessment, SPRS submission, and annual affirmation (Department of Defense, 2024). When basic security practices are already in place, the additional work may be limited to documenting that the 17 practices are satisfied and producing the self-assessment record.

Outside support for the initial assessment and documentation may make sense for organizations without dedicated security or IT staff. The practices themselves aren’t complex, but confirming each one is met and recording the evidence takes longer than expected when an organization hasn’t been through the exercise before.

CMMC Level 2 Costs and Assessment Requirements

All 110 security requirements in NIST SP 800-171 Rev 2 apply at Level 2, spanning 14 control families and covering contractors that handle CUI. 

What Adds to Level 2 Costs

Many contractors handling CUI already have some controls in place from DFARS 252.204-7012 obligations, but the 320 assessment objectives underlying those 110 requirements frequently reveal areas that a general security posture doesn’t address. 

Common findings during gap analysis include CUI boundary definitions that are broader than necessary, incomplete System Security Plans (SSPs), missing or inconsistent evidence for controls that are technically in place, and gaps in multifactor authentication.

Assessment and Remediation Expenses

In the final rule, the Department of Defense estimates the total three-year cost of a Level 2 Certified Third Party Assessment Organization (C3PAO) certification cycle at roughly $102,000 for small entities and $112,000 for others, with the C3PAO fee component between $31,000 and $52,000 (Department of Defense, 2024). Those figures assume baseline compliance is already in place.

When gaps remain unresolved, remediation accounts for most spending. Technology implementations, including Security Information and Event Management (SIEM), endpoint detection, encrypted storage, and multifactor authentication, can represent the largest single cost category.

Documentation, including the SSP, Plan of Action and Milestones (POA&M), and supporting policies, also adds to the cost. Under 32 CFR 170.21, a conditional Level 2 status requires a minimum score of 88 out of 110, and all POA&M items must be closed within 180 days.

How Assessment Scope Affects Level 2 Costs

Systems, users, and network segments that touch CUI determine how many assets fall within the assessment boundary. A well-defined CUI enclave can limit what falls in scope and reduce the volume of controls applied across the broader network.

Organizations that haven’t defined their CUI boundary often find during gap analysis that more assets qualify as in scope than anticipated. Scoping that boundary before investing in remediation can prevent spending on controls for systems that don’t need to be in the assessment environment.

CMMC Level 3 Costs

CMMC Level 3 applies only to defense contractors supporting the most sensitive programs, and a completed Level 2 C3PAO certification is a prerequisite. Level 3 adds 24 requirements from NIST SP 800-172 to the 110 from Level 2.

The Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), a Government assessment entity, conducts Level 3 assessments rather than a commercial C3PAO. 

Nonrecurring engineering costs alone are estimated at $2.7 million for small entities and $21.1 million for larger organizations, with recurring annual costs of approximately $490,000 and $4.12 million, respectively (Department of Defense, 2024).

Before committing to Level 3 preparation, confirm that Level 3 actually applies to your contract requirements. The engineering investment is substantial, and the additional security controls may require technical expertise that doesn’t exist in-house.

CMMC Assessment Costs vs. Total Compliance Spending

Formal assessment costs represent only a portion of what contractors actually spend. Technology implementation, security services, documentation development, employee training, and remediation of identified gaps make up the larger investment categories.

Some of those expenses are one-time. Others recur annually or on a three-year cycle. Looking only at the assessor’s fee can leave you unprepared for the investment that comes before it and the maintenance costs that follow.

Vaultes is a Veteran-owned cybersecurity firm with accreditation as both a FedRAMP Third Party Assessment Organization (3PAO) and a CMMC C3PAO. We work with Government agencies and Defense Industrial Base contractors to identify where security and compliance programs stand and what the path forward involves. 

Request a consultation to discuss your CMMC level requirements and the costs associated with meeting them.