CMMC for small businesses: cost and what drives it

What CMMC for small businesses costs and who pays for what

If your prime or contracting officer requires CMMC, the DoD's 2024 final rule estimated a Level 1 self-assessment plus affirmation at $5,977 per year for a small entity, on the assumption that a small firm would use an external service provider. For Level 2, the same rule estimated a self-assessment plus initial affirmation at $34,277 per assessment for a small entity, or $37,196 over three years. A Level 2 certification assessment by a C3PAO was estimated at $101,752 per assessment, or $104,670 over three years. These are Government estimates, not quotes, and your real spend depends on how much of your environment must be brought into scope and how much work you hand to others. Level 2 is identical to NIST SP 800-171 Rev. 2 and its 110 requirements, and the Department of War has said it will enforce Rev. 2 in the interim even though NIST withdrew it in May 2024.

Divide the cost between the parts only you can own and the parts a partner can prepare. Your organization owns its controls, its policies and the decisions about what counts as acceptable risk, and it signs the affirmation. An implementation partner, such as DeployOpen, can plan, configure and document systems and assemble evidence, and that work is usually the largest variable line in a quote. The independent assessor or C3PAO is the only party that issues a Level 2 certification result. Ask any partner to put in writing which deliverables are included, which evidence you must collect yourself, and whether ongoing monitoring and re-assessment are priced separately. Recurring costs include annual affirmations, staff time and the software and hosting that keep the environment running, so the first-year number is rarely the whole picture.

Timing changes what you need to buy and when. The Department of War suspended CMMC Phase II on 13 July 2026, which had been scheduled to start 10 November 2026 and would have required C3PAO certification for applicable contracts, and it opened a 60-day review by a CMMC Reform Task Force. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in force. Confirm with your contracting officer which level and assessment type applies to each solicitation, and check the current status on the DoW CIO's About CMMC page before committing budget to a certification assessment. Plan the self-assessment work now, since it is needed under every scenario.

Cost components for a small contractor's CMMC work

This table separates the parties a small defense contractor may pay for CMMC work, from the government-published assessment estimates to internal staff time and tooling. Read it as a list of cost buckets to ask about in a quote, noting which items recur each year and which are one-time. The main takeaway is that the assessment fee is only one line, and preparation effort often drives the total.

Cost component	Who is paid	One-time or recurring
Level 2 self-assessment plus initial affirmation	The firm's own staff time or an outside provider; DoD's 2024 final rule estimated $34,277 for a small entity per assessment	One assessment cycle, then repeated on the certification schedule
Level 2 C3PAO certification assessment	An authorized or accredited C3PAO; DoD's 2024 final rule estimated $101,752 for a small entity per assessment	Per assessment cycle; confirm current timing, since Phase II is suspended
Annual affirmation	The Affirming Official's time; included in the DoD per-assessment estimates	Recurring each year
Labor to implement SP 800-171 Rev. 2	Internal staff or an implementation partner; the FAR CUI proposed rule of January 2025 estimated about $148,200 in year one (1,560 hours at $95)	Largely one-time in year one, then about $98,800 a year (1,040 hours) per the same rule
Tooling, licenses and cloud enclave	Software vendors and cloud providers; confirm current pricing directly with each vendor	Usually recurring subscriptions, plus setup in year one
Outside consultant or implementation partner	Consultant, partner or Registered Practitioner Organization, under a written scope	Mostly one-time for setup, with optional retainer for upkeep
Internal staff time for evidence and monitoring	The firm's own payroll, since small firms often lack full-time security staff	Recurring; scales with system size and change volume
Outside provider the firm already uses (IT or MSP)	The provider, under its contract; confirm its CMMC scope and responsibilities	Recurring under the existing service agreement

What makes CMMC more or less expensive for a small firm

For a small firm, the cost of CMMC Level 2 depends less on the framework itself than on how much of the business touches CUI and how many outside parties touch that data. The cards below cover the decisions that widen or narrow the environment an assessor must review, and the checks to run before getting a quote.

Number of systems holding CUI

Every system that stores, processes or transmits CUI falls inside the assessment boundary, and each one needs its own controls and evidence. A firm that keeps CUI on one dedicated, documented enclave pays to secure one environment. A firm that lets CUI spread across laptops, file servers and a web portal pays to secure all of them. Before requesting a quote, list every system where CUI could appear and ask the provider to price the enclave you intend to build, not the whole company.

Engineering data in email and shared drives

Drawings and specifications sent by email or synced to shared drives are the most common way CUI spreads beyond its intended home. Once engineering files sit in general mailboxes or unmanaged folders, the assessment scope grows to cover those accounts and their access rules. Ask your team to identify where technical data actually travels, then decide whether to move that flow into a controlled repository or restrict it to named users. Narrowing the flow usually costs less than securing every mailbox.

Number of external providers

Each outside provider that stores, processes or can administer CUI systems adds to the review. Managed IT firms, cloud services and email hosts all need to be checked for how they handle CUI and whether their own environment is suitable. The DoD's 2024 final rule assumed that small entities rely on external service providers, so this cost is common. Reducing it means choosing providers already scoped for CUI, such as those with suitable government cloud authorization, and asking each one to show its responsibility matrix.

Level required by the contract

The level named in the contract determines what must be demonstrated. Level 1 covers Federal contract information with 15 safeguarding requirements, while Level 2 covers CUI under NIST SP 800-171 Rev. 2 with 110 requirements. Asking a prime or contracting officer which level applies to each task order prevents a firm from building a Level 2 environment for work that needs only Level 1. Confirm the level in writing before scoping, because a wrong assumption can double the work.

Maturity of existing evidence

Assessors accept a requirement as met only when every applicable objective is satisfied with evidence in final form, not drafts. A firm with current policies, access reviews, logs and a system security plan spends far less time reconstructing its history than one that must create them from scratch. Before quoting, inventory what already exists, check whether it is dated and approved, and ask the provider how much of the work is gap closure versus new documentation. Mature evidence reduces both consulting hours and assessment surprises.

Who owns the controls day to day

Some costs recur every year because someone must operate the controls. If one owner handles patching, reviews, logging and user changes, the effort is predictable. If that duty is split across several part-time people or an outside provider on an informal basis, the firm pays in missed reviews and rework. Ask any provider to state which controls the firm must run itself, which they can run under a retainer, and which the firm should not outsource at all.

Why DoD assumed small firms rely on outside providers

The cost analysis in the CMMC final rule rests on a specific assumption about staffing: other-than-small entities are assumed to have full-time cybersecurity staff, while small entities are assumed not to, and are likely to rely on external service providers to carry out the work. If your firm is small, this assumption shapes the cost figures you will see in the rulemaking, and it should shape your own budget. The Level 1 estimate of $5,977 for a small entity and the Level 2 self-assessment estimate of $34,277 per assessment both reflect a firm that buys in help rather than hiring its own security team. Before you treat those numbers as your number, confirm with your advisers which tasks they cover in their quotes and which tasks remain with your own staff, such as keeping the system security plan current and signing the affirmation.

The rulemaking also records that the SBA Office of Advocacy raised concerns about the rule's effect on small businesses. Those concerns are part of the public record and are worth reading in the Federal Register text linked from this page, because they explain why DoD framed its small-entity estimates the way it did. The record does not give small firms a different standard. NIST states that there are no special provisions for small or mid-size organizations: the same level of protection for controlled unclassified information is expected regardless of an organization's size. Compliance under a contract is the responsibility of the federal agency that issued it, so the agency's contract terms, not a size exemption, define what your firm must show.

The practical consequence is that a small firm can outsource preparation and evidence work, but it cannot outsource accountability. Ask any provider to state in writing which of the 110 Level 2 requirements they will prepare, which evidence they will hand over, and which decisions remain with your leadership. Ask whether the provider's cost assumes the same staffing model that DoD assumed for small entities, and what happens to that cost if your environment is larger than the assumed baseline. An outside provider can help you meet the requirements, but the Affirming Official and the contracting agency will hold your firm to the result.

How a small contractor moves from Level 1 to a Level 2 assessment

The sequence runs from defining which systems handle CUI to a documented, affirmed Level 2 self-assessment, with an optional third-party assessment if a contract requires one. Each phase produces a record the next phase depends on.

Confirm which contracts require Level 2
Review the contract clauses, including DFARS 252.204-7012 and any CMMC requirement in the solicitation or contract, to determine whether the work involves controlled unclassified information (CUI). The output is a written list of contracts and the CUI they touch. Your contracts or contracting officer should confirm the applicable CMMC level for each requirement. Level 1 applies to Federal contract information only, and Level 2 applies to CUI.
Scope the systems that handle CUI
Map every system, user, location and external service that stores, processes or transmits CUI, including email, file shares, collaboration tools and laptops. Decide which assets are in scope and which are separated from the CUI environment. The output is a scoping boundary diagram and an asset inventory that your assessor can trace. Many small firms rely on an external service provider for part of this environment, so record which provider holds which data and how its services are assessed.
Close gaps against the 110 Level 2 requirements
Assess your current state against the 110 Level 2 requirements, which are identical to NIST SP 800-171 Rev. 2, and the assessment objectives in NIST SP 800-171A. Map each requirement to an existing control, a planned fix or a documented reason it does not apply. Your team or an implementation partner can prepare configurations, MFA, logging and encryption, but the organization owns the decisions and the results. The output is a gap register with an owner and a status for each requirement.
Write the system security plan and POA&M
Document how each requirement is implemented in a system security plan (SSP) that describes the boundary, the controls and the responsible roles. Record every requirement that is not fully met in a plan of action and milestones (POA&M), with the remediation step and the owner. The output is a current SSP and POA&M that match what the systems actually do. Ask your consultant to review whether the POA&M rules in the Level 2 framework permit each open item.
Gather evidence in final form
For each requirement, collect the artifacts that show the control operates, such as configuration exports, access reviews, log samples, training records and scan reports. A requirement counts as met only when every applicable assessment objective is satisfied with evidence in final form, not drafts. The output is an evidence binder indexed to the requirement IDs, such as AC.L2-3.1.1, so an assessor can test each one without interviews alone.
Complete the self-assessment and affirmation in SPRS
Score the environment against the Level 2 requirements, enter the results in the Supplier Performance Risk System (SPRS), and have an affirming official confirm that the organization meets the requirements and will keep meeting them. The output is a current SPRS posting and a signed affirmation. Because self-assessments, SPRS postings and annual affirmations remain in place after the Phase II suspension, these records need to stay current for every contract that requires them.
Arrange a C3PAO assessment if a contract requires it
If a contract requires a Level 2 certification assessment, choose a CMMC Third-Party Assessment Organization (C3PAO) authorized by The Cyber AB and agree the scope and fees in writing. The assessor issues the certification result, not your consultant or implementation partner. The Department of War suspended CMMC Phase II on 13 July 2026, which had required C3PAO certification for applicable contracts, so confirm with your contracting officer whether a certification assessment is currently required before you commit.
Maintain the posture between assessments
Keep the SSP, POA&M, SPRS score and evidence current as systems, staff and contracts change, and repeat the self-assessment and annual affirmation on schedule. The output is a standing review cycle with named owners and a change log. Ask any outside provider for a written list of what they will maintain on your behalf and what remains your responsibility.

Choosing between in-house, outsourced and mixed delivery

Fully in-house delivery means your own employees design, build, operate and document every control in the CMMC Level 2 scope. This model suits a firm with an IT lead who already runs identity, endpoints and backups and who can give security work steady time each week. For a firm with few or no security staff, the work often lands on an office manager or a general IT contractor who lacks the time or experience to write the system security plan and collect evidence in final form. The company keeps full control of configuration, change decisions and staff knowledge, but it also carries every gap.

Control retained: You hold all decisions on tooling, configuration and policy, and no third party sees your CUI environment beyond what your contracts require.
Cost profile: Costs are mostly internal labor and tools. Ask yourself how many hours a month your IT lead can realistically give to the 110 requirements, and what happens when that person leaves.
Skills gap: Assessors test evidence against the NIST SP 800-171A objectives, so staff must know how to show that a control works, not just that it is configured.
Assessment independence: Self-assessments still need a Level 2 scope, and any certification assessment is performed by an independent C3PAO, not by your staff.
Recurring work: Logging review, patching, access reviews and annual affirmations continue indefinitely, so plan for them as ongoing operations.

Before you choose this model, confirm with your contracting officer which assessment phase applies to your awards, because the current status of CMMC Phase II affects when certification may be required.

What a small firm must have in place before the assessment

Before a Level 2 assessment, a small firm needs five things it can point to and prove. Each one is a check the company can run on its own environment today, and each one is a place where assessors commonly find gaps that delay certification or self-assessment results.

A defined CUI boundary

Start by listing where controlled unclassified information actually lives: email, file shares, engineering tools, collaboration platforms and any laptops that touch them. Draw the boundary around those systems and the people and services that connect to them. To check it, pick one CUI document and trace every copy, backup and transfer path. If the trace leaves the boundary without a documented reason, the boundary is not yet defined. An overly broad boundary raises cost, so scope tightly but completely.

A current system security plan

The system security plan describes the boundary, the system components, how each requirement is met and who is responsible for it. It is the document an assessor reads first, so it must match the environment as it runs today. To check it, compare the plan against your asset inventory and firewall rules, then ask an engineer who did not write it to walk through one access control. Gaps between the plan and reality are a common reason assessments stall.

Evidence in final form

Assessors accept evidence only when it is final, not drafts. A policy marked as a draft, a screenshot without a date or an unsigned procedure will not satisfy an objective, even if the practice happens. To check it, review each evidence item for a version number, an approval record, a date and an owner. Keep a simple index that maps each requirement to the artifact that proves it, so the evidence can be produced quickly during the assessment.

An accurate SPRS score

Level 2 self-assessments produce a score that is posted to the Supplier Performance Risk System. The score must reflect the requirements that are actually met, with any unmet requirements recorded honestly in a plan of action and milestones where the rules allow it. To check it, recalculate the score from your own assessment worksheet and confirm it matches the posted value. An inflated score creates contract and False Claims exposure, so verify it before any affirmation is signed.

Named people for the Affirming Official role

The Affirming Official is the senior person who attests that the company meets the requirements and keeps them met. That person must have the authority to commit the business to the statement and to fund the work behind it. To check it, confirm in writing who holds the role, that they understand what they are affirming and that a backup is named. Outside consultants can prepare the evidence, but they cannot sign the affirmation for the company.

Which NIST 800-171 revision applies and when

The CMMC Level 2 requirements are identical to NIST SP 800-171 Rev. 2. Under 32 CFR 170.14(c)(3), the 110 Level 2 requirements are the Rev. 2 requirements, and the CMMC rule still incorporates that revision. NIST withdrew Rev. 2 on 14 May 2024 when it published Rev. 3, but the Department of War said on 13 July 2026 that it will enforce Rev. 2 in the interim. For a small business, this means the practices you build and the evidence you collect should be mapped to Rev. 2 numbering, even if your internal documents or a consultant's templates use Rev. 3 language. Ask your contracting office to confirm in writing which revision it will assess against for your solicitation.

The schedule is the harder part to pin down. The Department of War suspended CMMC Phase II on 13 July 2026, which had been set to start on 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. Phase I self-assessments, SPRS postings, annual affirmations and the obligations under DFARS 252.204-7012 remain in place. The DoW CIO's About CMMC page, as of 17 October 2026, says implementation is paused in Phase 1 (which began 10 November 2025) and may only require self-assessments at Levels 1 and 2. The eCFR text of 32 CFR 170.3(e) still shows the original four-phase schedule. Where the two disagree, treat the official DoW statements as the current position and do not plan around the old phase dates alone.

Before you commit budget, confirm three things with your contracting officer or prime: which assessment type your current and upcoming solicitations require, which NIST revision the assessment will use, and whether any Level 2 certification requirement applies to your contracts during the suspension review. Record the answers and the date you received them, because the Reform Task Force review may change the position again. Your self-assessment, SPRS score and System Security Plan should continue to be accurate and current in the meantime, since those obligations are not suspended.

Who does what in a small contractor's CMMC project

A small contractor's CMMC work involves three parties with different jobs. The company owns its controls and signs the affirmation, a partner helps prepare systems and evidence, and an independent assessor issues any certificate or report. Keeping those roles separate is what makes the result credible to a prime contractor and to the government.

The company owns the controls

Your organization decides which systems hold CUI, operates the controls, and keeps the evidence that proves they run. A senior leader must sign the annual affirmation, which makes that person accountable for the accuracy of the posted score and the status of each requirement. Before you sign, check that every requirement marked MET has final evidence behind it, not a draft policy or a plan.

The partner prepares systems and evidence

An implementation partner may scope the CUI environment, configure identity, logging and backup tools, write the system security plan, and draft policies for your review. The partner works on your systems and hands you the artifacts, which you then adopt and operate. Ask the partner to state in writing which deliverables it produces and which decisions remain with your staff.

The assessor issues any certificate

Only an independent assessor or certification body issues a report or certificate. Level 2 certification assessments are performed by C3PAOs authorized or accredited by The Cyber AB. Confirm that the assessor is listed for the assessment you need and that it has no role in building the environment it will evaluate.

What small firms usually outsource

Small contractors often have no full-time cybersecurity staff, so they commonly outsource system configuration, the system security plan, vulnerability scanning, log review and the mapping of evidence to requirements. Staff keep ownership of access approvals, change decisions and incident response. Get a written list of tasks, owners and hours before work starts, since the split drives most of the cost.

The independence boundary

A partner that builds your environment cannot also certify it. An assessor that helped design the controls it is testing has a conflict that undermines its findings. Keep the preparation contract and the assessment contract separate, and ask the assessor to confirm in writing that it has not performed consulting for the same scope.

Who pays for what

The DoD's 2024 final rule estimated a small entity's Level 2 self-assessment plus initial affirmation at $34,277, and a C3PAO certification assessment plus initial affirmation at $101,752. Those figures are government estimates, not quotes. Ask each provider to separate its one-time setup fees from recurring tooling, monitoring and affirmation costs, and to state which items it will not cover.

Questions small contractors ask about CMMC cost and effort

What does Level 1 CMMC cost a small defense contractor each year?

The DoD's 2024 final rule estimated a Level 1 self-assessment plus annual affirmation at $5,977 per year for a small entity, and $4,042 for an other-than-small entity. That estimate assumed the small firm would use an external service provider, and it assumed no implementation cost because FAR 52.204-21 already requires the 15 Level 1 safeguards. The figure is a federal estimate, not a quote. Your real spend depends on whether you do the work in-house, what tools you already own, and whether you pay an outside firm to prepare evidence or sit in on the assessment. Ask any provider to itemize labor, tools and the affirmation step separately, and to say which items recur every year.

Can a small defense contractor complete a CMMC self-assessment on its own?

In principle, yes, for Level 1 and for Level 2 self-assessments where the contract allows them. Level 1 is 15 safeguarding requirements, and the owner or a designated employee can assess them and submit the results. Level 2 covers 110 requirements from NIST SP 800-171 Rev. 2 and needs the assessment objectives in NIST SP 800-171A applied to evidence in final form. A requirement counts as MET only when all applicable objectives are satisfied. Many small firms find this difficult without someone who knows the framework, so they often pay a consultant or implementation partner for gap analysis and documentation. Whether a self-assessment is permitted for a given contract depends on the level the contract requires, so confirm that with the contracting officer and the clauses in the solicitation.

How much of the work does a small contractor's owner need to do?

The owner stays accountable even when outside help does most of the drafting. The Affirming Official must sign the affirmation, which means someone with authority must be able to state that the requirements are implemented and that the evidence is current. Owners usually need to make decisions on scope, approve policies, confirm which systems hold controlled unclassified information, and assign a person to keep evidence updated. Expect to set aside time for review meetings and to answer questions about how the business actually operates. Ask any partner which decisions they will make for you and which ones they will only prepare options for, because the organization owns its controls and the evidence about them.

How long does CMMC preparation take for a small firm?

No researched duration is available for this page, so treat any timeline as something to confirm. The length depends on how many systems hold federal contract information or CUI, how much of the environment is already documented, whether the firm uses a managed cloud enclave, and how quickly staff can supply evidence. Ask a provider for a written schedule tied to a defined scope, with named milestones such as scoping, gap remediation, documentation and a readiness review. Also ask what happens if the contract timeline moves, since federal implementation milestones have changed and should be checked against current official sources before you commit.

Can an implementation partner guarantee that we pass CMMC?

No. A partner can plan, implement, document and test the controls, and it can prepare evidence for assessment, but it cannot promise an outcome. Only an authorized assessor, such as a C3PAO for Level 2 certification, can issue a certification, and the organization's own senior official signs the affirmation for self-assessments. Be cautious with any proposal that promises a pass, a score or a fixed date for the assessor's decision. A sound statement of work describes the systems in scope, the controls delivered, the evidence produced, and the roles of the owner, the partner and the assessor. DeployOpen works on fixed-scope engagements agreed in writing before work starts, and the scope defines what the engagement covers.

How do we know whether Level 2 applies to our firm?

Level 2 usually applies when a contract or subcontract requires safeguarding of controlled unclassified information, which is the CUI level under the CMMC Program rule. Level 1 applies to contracts that involve only federal contract information. Start by reading the contract clauses, especially DFARS 252.204-7012 and any CMMC requirement the solicitation or contract names, and then check which systems store, process or transmit the covered information. A subcontractor's requirement is set by the prime, so ask the prime in writing which level flows down to you. Because requirements and phase dates have been changing, confirm the current status with the contracting officer and the official DoD CIO CMMC pages before deciding what to build.

What does a small firm pay for once and what recurs?

One-time costs usually include the initial gap analysis, scoping, policy and plan writing, technology changes such as secure configuration or encrypted storage, and any readiness review. Recurring costs include the annual affirmation, licenses for security tools, log retention, patching, staff time for evidence collection, and periodic reassessment work. The DoD's Level 2 estimates separate a first assessment with its initial affirmation from later annual affirmations, so budget for both. Ask any quote to show one-time and recurring items on separate lines, and to state which tools are supplied by the firm and which must be licensed in the client's own environment.

How DeployOpen helps a small defense contractor prepare

DeployOpen plans, implements and documents self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, so the systems and evidence behind your CMMC Level 2 practices are in place before an assessment. We prepare systems and evidence only; your organization owns its controls, and an independent assessor issues any result.

How we scope

We agree a written, fixed scope that names the systems that store, process or transmit CUI and the users who reach them.
We map which of the 110 NIST SP 800-171 Rev. 2 requirements your environment touches, domain by domain.
We document scope boundaries, shared responsibilities and any external service providers before build work starts.

How we build

We deploy self-hosted open-source identity, logging, configuration management and vulnerability scanning tools in your environment.
We configure access control, audit logging and encryption settings to match the requirements in scope, then test them against NIST SP 800-171A objectives.
We harden systems and record each configuration so the evidence reflects the system as it runs.

How we hand over

We deliver a system security plan and policy documents written for your organization to review, approve and own.
We produce evidence packages that map each requirement to its artifacts, such as configuration exports, log samples and scan reports.
We train your staff to operate the tools, run the evidence collection and keep records current after handover.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after the fixed-scope work is complete.
We can refresh evidence and check configuration drift between your self-assessments or certification assessments.
Before any assessment, we help you confirm which requirements, assessment path and program rules currently apply with your contracting officer and the assessor.