Updated October 2026

DIBCAC Assessment Cost: Free Fee, Real Cost

The Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) performs Level 3 CMMC assessments at no fee. The real cost is internal preparation labour, operational downtime, and the opportunity cost of the scheduling backlog.

Direct vs indirect cost

Direct fee

DIBCAC does not invoice for the assessment. There is no per-day rate, no engagement-letter fee, no travel reimbursement billed to the contractor.

Indirect cost

$80K - $300K+

Internal staff time, operational downtime, and opportunity cost during scheduling backlog. Significant for Level 3 because the NIST SP 800-172 control set is materially deeper than Level 2.

Where the indirect cost comes from

Internal preparation labour

800-3,000 hours of internal staff time (security, IT, compliance, programme management) preparing the SSP, evidence package, and on-site logistics. Loaded at BLS OEWS 15-1212 wage anchors plus 1.3x burden, this lands at $80K-$300K of internal cost.

Operational downtime

Some Level 3 controls (advanced monitoring, segmentation, controlled-environment access) require operational adjustments during the on-site phase. Production pauses and access constraints translate to lost productivity.

Scheduling backlog opportunity cost

DIBCAC capacity is the binding constraint. Contractors awaiting Level 3 assessment during the scheduling queue may defer option exercises or contract awards that require Level 3 certification.

Remediation re-work

If the assessment surfaces gaps, remediation re-work plus a re-assessment cycle adds further internal cost and schedule.

Continuous monitoring overhead

Level 3 expects ongoing operational evidence (continuous monitoring, threat hunting). The SOC stack to support this typically runs $500K-$2M annually independent of the assessment itself.

Programme-management time

A Level 3 contractor typically dedicates a programme manager full-time across the preparation and assessment window. That headcount is often pre-existing security leadership but is materially diverted from other priorities.

DIBCAC vs C3PAO at a glance

	DIBCAC (Level 3)	C3PAO (Level 2)
Assessor	US government (DCMA)	Cyber AB authorised third party
Fee	$0	$30K - $200K+
Control set	NIST SP 800-172 + 800-171	NIST SP 800-171 Rev 2 (110)
Phase	Phase 3 onward (was 2027; under review)	Phase 2 (suspended; was Nov 2026)
Indirect cost	$80K - $300K+ internal	$25K - $100K internal

References: DCMA DIBCAC, NIST SP 800-172, Cyber AB.

Frequently asked questions

Does DIBCAC charge a fee?

No. The Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) does not charge a fee for Level 3 CMMC assessments. The cost the contractor bears is internal preparation labour, asset downtime during the on-site assessment, and the opportunity cost of the scheduling backlog before the assessment can occur.

Why is DIBCAC the assessor for Level 3?

CMMC Level 3 applies to the most sensitive DoD programmes (CUI requiring NIST SP 800-172 enhanced security requirements). The Level 3 assessment is government-led rather than third-party because DoD retains direct ownership of the assessor function for these programmes. DIBCAC, under the Defense Contract Management Agency, holds the assessor mandate.

What is the indirect cost of a DIBCAC assessment?

Three components: internal preparation labour (typically 800-3,000 hours of contractor staff time across IT, security, and compliance, translating to $80K-$300K of loaded internal cost at BLS OEWS 15-1212 wage anchors); operational downtime during the on-site phase (assessor access often requires controlled environments and pauses on certain workflows); and opportunity cost during the scheduling backlog (current Level 3 backlog is significant given DIBCAC capacity).

How long is the DIBCAC backlog?

DIBCAC publishes no queue length, so treat any specific wait figure with suspicion. What is structurally true is that DIBCAC is a single government organisation assessing the whole Level 3 population, so its capacity rather than your readiness is the binding constraint on timing. For Phase 3 (2027) Level 3 requirements, contractors should be in the DIBCAC queue well in advance of any contract option exercise that triggers Level 3.

How does DIBCAC differ from a C3PAO?

C3PAO assessments cover Level 2 (NIST SP 800-171 Rev 2, 110 controls) and are performed by Cyber AB authorised third-party assessor organisations who charge fees (unpublished; DoD models $31,234 for a small entity and $52,056 above that). DIBCAC assessments cover Level 3 (NIST SP 800-172 enhanced controls plus Level 2 baseline) and are performed by the US government's DCMA cybersecurity assessment arm at no fee. Both are formal certification assessments; both produce certification outcomes recorded against the contractor.

Level 3 cost overview C3PAO cost (Level 2)Phase 3 timeline