Updated October 2026

CMMC Certification Cost in 2026:
$5,000 to $500,000+

Vendor-neutral cost estimates for defense contractors pursuing CMMC 2.0 Level 1, 2, and 3 certification. No product to sell, no vendor bias.

Get Your Estimate View Timeline

Phase 2 Update

Phase 2 (mandatory C3PAO certification for Level 2) was suspended by DoD on July 13, 2026. It had been scheduled for November 10, 2026 and is now under a Reform Task Force review. Phase 1 self-assessments remain live since November 2025.See the full rollout timeline.

Cost by CMMC Level

Level 1Self-Assessment

$5,000 - $15,000

15 requirements from FAR 52.204-21. Annual self-assessment with SPRS submission. No C3PAO required.

Maintenance: $5K - $15K/yr

Timeline: 2 - 5 months

Most Common

Level 2C3PAO Required

$50,000 - $500,000

110 practices from NIST SP 800-171. Triennial C3PAO certification assessment (Phase 2 mandate suspended July 2026; was Nov 2026).

Maintenance: $30K - $120K/yr

Timeline: 9 - 20 months

Level 3DIBCAC Assessment

$500,000 - $3M+

NIST SP 800-172 advanced controls. Government-led DIBCAC assessment. Only for critical DoD programs.

Maintenance: $150K - $500K/yr

Timeline: 24 - 48 months

Cost by Company Size

First-year total cost estimates including gap assessment, remediation, tooling, documentation, and assessment fees.

Employees	Level 1 First Year	Level 2 First Year	Level 2 Annual	Per Employee (L2)
< 25	$5,000 - $10,000	$50,000 - $120,000	$30,000 - $60,000	$3,200 - $4,600
25 - 50	$6,000 - $12,000	$80,000 - $180,000	$40,000 - $80,000	$2,400 - $3,600
50 - 100	$8,000 - $14,000	$120,000 - $250,000	$50,000 - $100,000	$1,800 - $2,800
100 - 250	$10,000 - $15,000	$180,000 - $350,000	$70,000 - $120,000	$1,200 - $2,000
250 - 500	$12,000 - $15,000	$250,000 - $450,000	$90,000 - $120,000	$850 - $1,400
500+	$12,000 - $15,000	$350,000 - $500,000+	$100,000 - $120,000+	$700 - $1,000

Per-employee costs decrease with scale. Larger organizations spread fixed costs (C3PAO fees, SIEM, GRC platforms) across more staff.

Cost Breakdown by Phase

Every CMMC certification follows six phases. Here are the cost ranges for Level 2 (the most common requirement).

1. Gap Assessment

$3,500 - $60,000

Document review, vulnerability scanning, CUI flow mapping, SPRS scoring, and gap report.

2. SSP Development

$5,000 - $25,000

System Security Plan documenting system boundaries, data flows, inherited controls, and all 110 practice implementations.

3. Remediation

$25,000 - $300,000

Closing gaps identified in the assessment: MFA, EDR, SIEM, network segmentation, encryption, backup, and policy creation.

4. Internal Validation

$5,000 - $15,000

Mock assessment, evidence collection, and POA&M documentation before the formal C3PAO engagement.

5. C3PAO Assessment

$31,234 - $52,056

Formal third-party certification assessment. DoD's published model: 120 to 200 assessor hours at $260.28/hr. No C3PAO publishes a rate card; hours scale with scope.

6. Ongoing Maintenance

$30,000 - $120,000/yr

Software renewals, monitoring, training, policy updates, vulnerability scanning, and annual SPRS affirmations.

Get a Personalized Cost Estimate

Enter your company size, target level, and current security maturity. Our calculator provides an itemized budget breakdown in under 60 seconds.

Open the CMMC Cost Calculator

Three-Year Total Cost of Ownership

Certification is not a one-time expense. Budget for ongoing maintenance and triennial re-assessment.

	Year 1 (Initial)	Year 2 (Maintain)	Year 3 (Maintain + Prep)	3-Year Total
Level 1	$5,000 - $15,000	$5,000 - $15,000	$5,000 - $15,000	$15,000 - $45,000
Level 2	$50,000 - $500,000	$30,000 - $120,000	$40,000 - $140,000	$120,000 - $760,000
Level 3	$500,000 - $3,000,000+	$150,000 - $500,000	$200,000 - $600,000	$850,000 - $4,100,000+

Year 3 includes preparation costs for triennial re-assessment (Level 2) or continuous monitoring requirements (Level 3).

Frequently Asked Questions

How much does CMMC Level 2 certification cost?

CMMC Level 2 certification typically costs between $50,000 and $500,000 in the first year, depending on company size and current security maturity, with remediation, tooling, and documentation making up most of it. The assessment itself is the smaller part: DoD's own cost model in the 32 CFR Part 170 final rule puts the C3PAO engagement at $31,234 for a small entity and $52,056 for an other-than-small entity, and the full certification assessment including the contractor's own labour at $101,752 and $112,345. That model assumes NIST SP 800-171 Rev 2 is already implemented, which is why remediation dominates real budgets. Companies with fewer than 50 employees generally spend $50,000 to $150,000 all-in, while organizations with 200+ employees can exceed $300,000.

Can small businesses afford CMMC compliance?

Level 1 compliance costs $5,000 to $15,000 and is manageable for most small contractors. Level 2 is more challenging at $50,000 to $150,000 for companies under 50 employees, but strategies like scope reduction (minimizing systems that handle CUI), shared MSSP services, and cloud enclaves can significantly lower costs. Many small contractors find that Level 1 is sufficient for their contract requirements.

What are the biggest cost drivers for CMMC?

The three largest cost items are remediation (MFA, EDR, SIEM, network segmentation), the C3PAO assessment, and ongoing annual maintenance. For Level 2, SIEM implementation alone can cost $15,000 to $100,000. No C3PAO publishes a rate card, so for the assessment itself the only published anchor is DoD's own cost model in the 32 CFR Part 170 final rule: $31,234 of assessor time for a small entity and $52,056 for an other-than-small entity. Annual maintenance runs $30,000 to $120,000 for software renewals, monitoring, training, and annual affirmations.

How long does CMMC certification take?

Level 1 self-assessment typically takes 2 to 5 months from start to SPRS submission. Level 2 with C3PAO certification requires 9 to 20 months, including gap assessment, remediation, documentation, and the assessment itself. Level 3 DIBCAC certification can take 24 to 48 months. Current C3PAO backlogs add 6 to 12 months of scheduling delay.

Is CMMC required in 2026?

Partly. Phase 1 went live in November 2025, requiring Level 1 and Level 2 self-assessments in new solicitations, and DFARS 252.204-7012 safeguarding duties continue. Phase 2, which would have made third-party C3PAO certification mandatory for Level 2, was scheduled for November 10, 2026 but DoD suspended it on July 13, 2026 and launched a CMMC Reform Task Force review. That 60-day review period ended in September 2026; DoD has not published the findings, and no amendment to 32 CFR Part 170 or the DFARS CMMC rule has appeared in the Federal Register, so no new Phase 2 start date is set. Phases 3 and 4 (originally November 2027 and November 2028) are part of that pre-suspension schedule now under review; no new dates are set.

What is the difference between CMMC and NIST 800-171?

CMMC Level 2 requires the same 110 security controls as NIST SP 800-171, but adds mandatory third-party verification through a C3PAO assessment. Previously, NIST 800-171 compliance was self-attested. CMMC enforces it with audited certification, triennial reassessments, and a scoring methodology through the SPRS system.

What does a C3PAO assessment cost?

No C3PAO publishes a rate card, so there is no market rate to report. DoD's own cost model, published with the 32 CFR Part 170 final rule at 89 FR 83185-83186, treats the fee as assessor hours at $260.28 per hour: 120 hours for a small entity ($31,234) and 200 hours for an other-than-small entity ($52,056). Hours scale with asset count, site count, CUI complexity and SSP quality, so the way to move the fee is to cut the scope that generates hours. The only binding figure is the one in a signed Statement of Work.

How much does CMMC maintenance cost per year?

Annual maintenance costs after initial certification are: Level 1 at $5,000 to $15,000 per year, Level 2 at $30,000 to $120,000 per year, and Level 3 at $150,000 to $500,000 per year. These costs cover software license renewals, security monitoring, employee training, policy updates, vulnerability scanning, and annual affirmations to the SPRS system.

Related Compliance Cost Guides

Many defense contractors need multiple compliance frameworks. Explore our sister sites for detailed cost breakdowns.

SOC 2 Compliance Cost

Commercial trust framework. $50K - $150K initial.

FedRAMP Cost

Cloud service provider authorization. $250K - $3M.

PCI Compliance Cost

Payment card data security. $20K - $500K.

Penetration Testing Cost

Required for CMMC Level 3. $5K - $100K.

CMMC Certification Cost in 2026:$5,000 to $500,000+