GovCon Cybersecurity | July 21, 2026 | 20 min read

CMMC Certification Cost: What Assessments Actually Cost

Abstract network of nodes and connections representing the layered cost of CMMC certification for defense contractors — Photo by Igor Omilaev on Unsplash

Key Takeaways

CMMC certification cost is dominated by implementation and upkeep, not the assessment fee.

The Fee Is the Small Part

DoD estimated about $104,670 for a small entity Level 2 assessment, but that excludes the implementation and documentation that usually cost more than the assessment itself.

Path Sets the Price

Level 1 self assessment is inexpensive. Level 2 self assessment is moderate. Level 2 with a C3PAO is the costliest path, and most CUI contracts require it.

Scope Is the Biggest Lever

A tight CUI boundary cuts both implementation and assessment cost. A sprawling scope drags the whole environment into the bill. Scoping decisions move the total more than anything else.

Upkeep Never Stops

Certification lasts three years, but keeping controls running and evidence current is an annual cost. Budget for ownership, not a one time purchase.

Ask what CMMC certification costs and most answers name the assessment fee.

That is the wrong number. It is not even the biggest one.

The Cybersecurity Maturity Model Certification is now a condition of award on covered defense contracts, and contractors need a real budget for it. The problem is that the most visible price, the fee a third party assessor charges, is a small slice of what reaching and holding certification actually costs. Budget around that fee alone and you will be short by a wide margin, usually right when the work matters most.

This guide gives you the honest picture. What each assessment path costs, why the assessment is the small part, where the real money concentrates, how the spend falls across a three year certification cycle, and the specific decisions that move your total up or down.

Budget CMMC as a cost of ownership, not a fee.

GS Consulting helps defense contractors scope tightly, model the full cost, and sequence spend so the certification budget matches the work.

Request a CMMC Cost Review

The Real Cost Question

There is no single price for CMMC, because CMMC is not a single thing you buy. The cost depends on which level your contracts require, whether you self assess or use a certified third party, how much of your environment touches Controlled Unclassified Information, and how far your current security posture sits from the standard.

The right frame is cost of ownership. There is the cost to reach certification and the cost to hold it, and the second one never ends. A contractor who thinks in terms of a one time assessment fee will consistently underfund the two things that actually decide the outcome: getting the controls in place, and keeping the evidence alive between assessments. If you want the full compliance picture behind the numbers, our complete CMMC compliance guide covers the program, the levels, and the evidence in depth.

Cost by Assessment Path

The clearest way to anchor the assessment cost is by path, because the level and assessment type set very different price points. There are three common paths, and they are not close in cost.

Chart of CMMC assessment cost by path showing Level 1 self assessment near $5,000, Level 2 self assessment near $43,000, and Level 2 C3PAO certification near $111,500 — Assessment cost rises sharply from Level 1 self assessment to a Level 2 C3PAO certification. These are the assessment activity, before implementation.

Level 1 protects Federal Contract Information and is met through an annual self assessment. The out of pocket cost is low, largely internal time, often in the low thousands of dollars a year. Level 2 protects CUI and covers all 110 requirements in NIST SP 800-171. On the contracts that allow a Level 2 self assessment, DoD's own estimate for the assessment activity is roughly $43,000 over the three year cycle. On the contracts that require a third party assessment, the Level 2 C3PAO path is the costliest, with DoD estimating around $105,000 for a small entity and real world fees ranging higher depending on scope and complexity.

Which path applies is not your choice. It is set by the contract and the sensitivity of the information you handle. If you are still working out which level and path you fall under, our guide on CMMC 2.0 levels explained lays out the differences and the assessment type for each.

The Cost Gap DoD Does Not Count

Here is where budgets break. The published DoD figures cover the assessment: the assessor's time, the reporting, the affirmation. They do not cover the work that makes you pass. That work, the implementation, the tooling, the documentation, is where most of the money goes, and it happens before the assessor ever arrives.

Comparison of what the DoD cost model counts against the realistic first year CMMC spend, showing implementation, tooling, and documentation sitting outside the assessment estimate — The DoD estimate counts the assessment. The realistic first year spend includes implementation, tooling, and documentation the estimate leaves out.

When you add the full picture, published industry cost surveys put the first year total for a small business pursuing Level 2 in a broad range, commonly from just under $100,000 to north of $300,000, with a reported small business median near $116,000. Those numbers are not the assessment. They are the cost of becoming assessable: standing up multifactor authentication, logging, and a defensible boundary; buying and configuring the tools; and producing the documentation that shows each control operates. The assessment fee sits on top of that as a comparatively small final line.

Original Research: The Level 2 Cost Stack

To show where the money actually concentrates, GS Consulting built the CMMC Level 2 Cost Stack. We took the major cost components of a Level 2 program and, using published DoD estimates and industry cost surveys as anchors, assigned each a relative weight and a working dollar range drawn from our assessment practice. The weights are scaled so the largest component reads 100, which makes the proportions easy to see.

GS CMMC Level 2 Cost Stack ranking control implementation highest, followed by recurring annual upkeep, the C3PAO assessment, documentation, and gap assessment and scoping — Control implementation and recurring upkeep dominate the stack. The assessment sits in the middle, not at the top.

The ranking is the point. Control implementation and remediation sits at the top, with a working range of roughly $40,000 to $150,000, because closing 110 requirements often means new identity, logging, and boundary infrastructure. Recurring annual upkeep comes next at $35,000 to $70,000 a year, a permanent line that many contractors forget entirely. The C3PAO assessment lands in the middle at $37,000 to $118,000, meaningful but not dominant. Documentation, the system security plan and policies, runs $10,000 to $30,000, and gap assessment and scoping, though the cheapest line at $8,000 to $25,000, has outsized leverage on every line above it.

Read the stack top to bottom and the strategy is obvious. The assessment is not where you save money. You save money by scoping tightly so implementation shrinks, and by automating evidence so recurring upkeep does not compound year over year.

What Actually Moves the Bill

Two contractors with the same contract can pay very different amounts for CMMC. The difference is rarely the assessor. It is a handful of decisions that push cost up or pull it down.

Chart of CMMC cost drivers, with broad scope, on premises infrastructure, and manual evidence driving cost up, and tight scope, compliant enclaves, and automation driving cost down — Scope, architecture, and evidence approach decide the bill more than the assessor's rate does.

Cost goes up when scope is broad, when CUI sprawls across many systems and users, when the environment runs on unmanaged on premises infrastructure, and when evidence is assembled by hand at the last minute. Cost comes down when scope is tight, when CUI is concentrated in a compliant enclave or a FedRAMP authorized cloud, when the shared responsibility with providers is clear, and when evidence collection is automated so it does not have to be rebuilt every year. The single largest driver is scope, which is why a CUI data flow map is worth building before you spend on tools or assessors. Our walkthrough on building a CUI data flow map for CMMC is the place to start.

Cost Across the Three Year Cycle

Level 2 certification lasts three years, and the spend is not spread evenly across them. Understanding the shape of the cycle prevents the nasty surprise of assuming year two and year three are free.

Timeline of CMMC cost across the three year certification cycle, with a large first year spend for implementation and assessment, followed by lower recurring upkeep and affirmation costs in years two and three — Year one carries implementation and the assessment. Years two and three carry upkeep and affirmation, lower but never zero.

Year one is the heavy one. It carries the implementation, the tooling, the documentation, and the assessment itself, which is why the first year total is the number that shocks people. Years two and three are lighter but not free: they carry the recurring upkeep, the annual affirmation by a company official, and the cost of keeping evidence current as your environment changes. Contractors who automate evidence in year one flatten this curve, turning what would be a scramble before each affirmation into a routine that runs in the background. That is exactly the case we make in automating NIST 800-171 compliance evidence.

How to Keep the Cost Down

Cost control for CMMC is not a negotiation with your assessor. It is a set of choices you make early, mostly about scope and preparation, that shrink every line in the stack.

CMMC cost control path with five steps: scope before you spend, concentrate CUI in an enclave, fix high value gaps first, automate evidence, and reuse the NIST 800-171 work — Scope first, concentrate CUI, fix high value gaps, automate evidence, and reuse the 800-171 work you already owe.

The path is short and it works in order. Scope before you spend, because a tight boundary is the cheapest way to cut every downstream cost. Concentrate CUI in a compliant enclave or authorized cloud so you are not hardening your entire company. Fix the highest value control gaps first, since they carry the most SPRS weight and the most assessment risk. Automate evidence so upkeep does not balloon in later years. And reuse the NIST SP 800-171 work you already owe under DFARS, because Level 2 is built on the same 110 requirements, so nothing there is wasted. Our NIST SP 800-171 explainer shows how those requirements map directly to the CMMC work.

Done in that order, CMMC becomes a planned investment with a predictable curve rather than an open ended bill. That is the standard: scope the work, sequence the spend, and pay for a capability you keep, not a certificate you chase.

Research Sources and Caveats

The GS CMMC Level 2 Cost Stack and the cost ranges in this guide are GS Consulting derived planning tools based on cited public sources and documented assumptions. They are not official DoD, CMMC, C3PAO, legal, audit, or accounting determinations, and they are not price quotes. The DoD assessment estimates and the rule are drawn from the sources below. The component weights, working dollar ranges, and the three year curve are GS planning assumptions and will vary with your scope, environment, and assessor.

Your actual CMMC cost depends on your contracts, the data you handle, your scope decisions, your current posture, and the assessor you select. Use these figures to build a budget range and a plan, not to predict an exact invoice.

Frequently Asked Questions About CMMC Certification Cost

How much does CMMC certification cost?

It depends on the level and path. A Level 1 self assessment is inexpensive, often a few thousand dollars a year in internal effort. DoD estimated roughly $104,670 for a small entity Level 2 certification assessment with a third party assessor, plus reporting and affirmation. But that figure only covers the assessment. The full cost of reaching Level 2, including implementation and documentation, commonly runs well into six figures for the first year.

Why is CMMC so much more expensive than the assessment fee?

Because the assessment only checks work you already did. The expensive parts happen before the assessor arrives: implementing and remediating controls, buying and configuring tools, writing the system security plan, and building evidence. Those costs dwarf the assessment fee. Treating the C3PAO invoice as the price of CMMC is the single most common budgeting mistake.

What does a C3PAO assessment cost for CMMC Level 2?

Third party assessment fees for Level 2 commonly fall in a range of roughly $37,000 to $118,000 depending on scope, complexity, and the assessor, with DoD's small entity estimate near $105,000 for the assessment activity itself. A tightly scoped environment costs far less to assess than a sprawling one, which is why scoping decisions drive the assessment bill more than any other single factor.

How often do you pay for CMMC certification?

Level 1 self assessment is annual. Level 2 certification lasts three years, with an annual affirmation by a company official in between. But the cost is not only at renewal. Keeping controls running and evidence current is a recurring cost every year, whether or not an assessment is due, so budget for ongoing upkeep rather than a one time event every three years.

How can a small business reduce CMMC certification cost?

The biggest lever is scope. A tight, defensible boundary that keeps CUI in a small number of systems cuts both implementation and assessment cost. After that, using a compliant enclave or a FedRAMP authorized cloud, automating evidence collection, and fixing high value control gaps before the assessment all reduce the total. Cost control is mostly a scoping and preparation problem, not a negotiation with the assessor.