What CMMC costs a small business, by DoD's own estimates

In the CMMC Program final rule of October 15, 2024, the Department of Defense estimated that a small entity pays $5,977 for a Level 1 self-assessment and affirmation each year, $34,277 for a Level 2 self-assessment and affirmation every three years plus $1,459 for each annual affirmation in between, and $101,752 for a Level 2 certification assessment by a C3PAO. Those are DoD's estimates of what it costs to assess and affirm. They do not include implementing the 110 NIST SP 800-171 requirements, which the rule assumes a contractor has already done.

This guide explains the rules as of October 21, 2026. It is not legal advice: the clauses in your contract decide what applies to you.

Where the numbers come from

The CMMC Program rule, 32 CFR part 170, was published in the Federal Register on October 15, 2024 at 89 FR 83092 as document 2024-22905 and took effect on December 16, 2024. Its preamble summarizes the regulatory impact analysis under the heading "Public Costs" (89 FR 83178 to 83189). Every figure below is from that part of the preamble, which gives the estimate for each level twice: once for "other than small entities" and once for "small entities".

In the Summary of Impact that precedes that heading (89 FR 83177), DoD describes the figures as estimates, not prices: "The estimates represent the best estimates at this time based on internal expertise and public feedback." For small entities it assumed that they "are likely to have a less complex, less expansive operating environment and IT/Cybersecurity infrastructure compared to larger defense contractors" and "are likely to outsource IT and cybersecurity to an External Service Provider (ESP)". The hourly rates used were $190.52 for a director (MGMT5), $260.28 for an external service provider (ESP) and $86.24 for a staff IT specialist (IT4-SB), each with "A factor estimate of 30 percent" added "to include but are not limited to company-sponsored benefits (fringe)".

How much does CMMC certification cost? DoD's estimate by level

Sources for each row: the sections "CMMC Level 1 Self-Assessment and Affirmation Costs" (89 FR 83181 to 83182), "CMMC Level 2 Self-Assessment and Affirmation Costs" (83182 to 83184), "CMMC Level 2 Certification Assessment and Affirmation Costs" (83185 to 83186) and "CMMC Level 3 Certification Assessment and Affirmation Costs" (83187 to 83189). The figures are in 2023 dollars and are per assessment of one contractor information system, "estimated at one per entity".

The Level 3 row is assessment and affirmation only. Level 3 is the one level where DoD also estimated implementation, because its NIST SP 800-172 requirements were "not required in prior rules": for a small entity the rule lists nonrecurring engineering costs of $2,700,000 and recurring engineering costs of $490,000. Level 3 applies, in the rule's words, "only to a small subset of defense contractors and subcontractors".

What is in the Level 2 self-assessment estimate

The $34,277 small-entity figure is built from hours. The rule breaks it into three phases plus the first affirmation:

That is 52 hours of a director's time and 88 hours of an outside provider's for one self-assessment. The annual reaffirmation of $1,459 assumes 4 director hours and 8.08 IT specialist hours. The three-year cost of $37,196 is the assessment and affirmation "plus two additional annual affirmations ($34,277 + $1,459 + $1,459)".

The estimate assumes a pass, conditional or final: "Assessment costs assume the OSA passes the assessment on the first attempt". A second attempt is not priced.

What a Level 2 C3PAO assessment adds

The $101,752 small-entity figure has the same shape with more hours, and one new line. The rule lists Phase 1 at $20,699 (director 54 hours, ESP 40 hours), Phase 2 at $45,509 (director 64 hours, ESP 128 hours), Phase 3 at $2,851, the initial affirmation at $1,459, and "C3PAO engagement inclusive of Phases 1, 2, and 3 (3-person team) for 120 hours ($260.28/hr × 120hrs = $31,234)". So in DoD's model the assessor's fee is under a third of the total; most of the cost is the company's own preparation and the consultant beside it.

Since July 13, 2026 a Department of War requiring activity "may not designate CMMC Level 2 (C3PAO) or Level 3 (DIBCAC) assessments" while CMMC Phase II is suspended, so the certification cost is deferred for new requirements and the self-assessment costs are the ones that apply now. The detail is in CMMC Phase II is suspended: what still applies.

What the estimates leave out

The rule is explicit that these are the costs of being assessed, not of becoming compliant:

• "Estimates do not include the cost to implement (Non-recurring Engineering Costs (NRE)) or maintenance costs (Recurring Engineering (RE)) associated with the security requirements prescribed in current regulations."
• "DoD did not consider the cost of implementing the security requirements themselves because implementation is already required by FAR clause 52.204-21, effective June 15, 2016, and by DFARS clause 252.204-7012, requiring implementation by Dec. 31, 2017".
• "cost estimates are not included for an entity to implement the CMMC Level 1 or 2 security requirements, maintain implementation of these existing security requirements, or remediate a plan of action for unimplemented requirements."

So the biggest cost for most small companies, putting the 110 requirements in place, is outside every figure above. NIST SP 800-171 states the requirements and gives no cost estimate for implementing them, and we have found no primary source that does. Any number you see for "the cost of CMMC compliance" that includes implementation is someone's estimate for someone's environment, not DoD's.

Two other things the figures do not cover:

1. A failed first attempt. The assumption is a pass, conditional or final. The 180-day POA&M closeout is priced only for Level 3 ("Phase 4: POA&M Closeout (for CMMC Level 3 only, if applicable and allowed)").
2. More than one system. The per-entity figures assume one contractor information system. A company with two assessment scopes assesses twice.

What a CMMC self-assessment costs if you do the work yourself

DoD's small-entity figures assume an outside provider at $260.28 an hour for 88 of the 140 hours of a Level 2 self-assessment. The assumption is a choice, not a rule: nothing in 32 CFR 170.16 requires a consultant for a Level 2 (Self) assessment. The hours still have to be spent by someone who knows the system, and the deliverables are fixed: a system security plan, which cannot be on a POA&M, an assessment of all 110 requirements against the objectives of NIST SP 800-171A, a score by the 32 CFR 170.24 method, and the score, status date and affirmation posted in SPRS. How to run one is in How to do a NIST SP 800-171 self-assessment; what can wait on a POA&M, and for how long, is in POA&M rules.

A score below 88 cannot hold a Conditional status, and a POA&M "is not a substitute for a completed requirement". The free SPRS score calculator works the score out the way the methodology does, so you can see where you stand before spending any of the hours above.

Where Tiermark fits

The SPRS score calculator is free, needs no account, and saves nothing: mark each of the 110 requirements met, partly met, not met or not applicable and read the score. With Supplier Pro, the self-assessment workspace keeps the same answers with a plan of action per open requirement, and Compliance dates works out the next self-assessment, the next affirmation and any POA&M closeout from the dates you enter. Tiermark is not an assessor, does not post anything to SPRS, and does not price your implementation.

Sources

• Cybersecurity Maturity Model Certification (CMMC) Program, final rule, 89 FR 83092, October 15, 2024, document 2024-22905; "Public Costs" at 89 FR 83178 to 83189
• 32 CFR 170.16, CMMC Level 2 self-assessment and affirmation requirements
• 32 CFR 170.21, Plan of Action and Milestones requirements
• 32 CFR 170.24, CMMC Scoring Methodology
• Implementing Department of War Chief Information Officer's Suspension of the Advancement to Cybersecurity Maturity Model Certification Phase 2 Requirements, July 13, 2026, Attachment 1
• NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations