What does CMMC on AWS cost, and does AWS certify you?
AWS does not certify you for CMMC, and it cannot. CMMC measures your organization's own capabilities, so the assessment, the report or certificate, and the self-assessment all remain with you and an independent assessor. AWS says its cloud services do not need to be CMMC certified on their own, and its CMMC Customer Package in AWS Artifact only breaks down the Level 2 and NIST SP 800-171 controls you can inherit from AWS when you use the Landing Zone Accelerator in AWS GovCloud (US). Treat that package as an input to your system security plan, not as proof that your environment passes. AWS is authorized by FedRAMP at High and by DISA at Cloud Computing SRG Impact Levels 2, 4 and 5, which helps your assessor scope the provider's share of the controls, but your identity configuration, logging, encryption key handling, and the people who administer the account stay in your scope.
The cost of CMMC on AWS is driven by your scope, not by AWS's service fees. The expenses you should expect to plan for include your own engineering time to build and document the enclave, the consultant or Registered Practitioner Organization time you choose to buy, the assessor fees, and the recurring effort of keeping evidence current. Each of these grows with the number of accounts, workloads, endpoints and people who touch CUI. Ask any implementation partner for a written scope that lists the accounts, Regions, identity sources, log pipelines and endpoints in scope, and separate one-time build work from recurring operations. A partner can prepare systems and evidence, but it cannot issue a report or certificate.
Confirm the current requirement before you commit budget. On 13 July 2026 the Department of War suspended CMMC Phase II, which had covered the Level 2 certification requirement for applicable contracts, and started a 60-day review. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place, so you still need a current, accurate system security plan and a credible SPRS score. Ask your contracting officer which assessment type applies to each solicitation and whether a certification will be required during the period of performance. Figures for AWS-based builds are not given here because no supplied fact sets them; request them from your partner and assessor against your own scope.
Which costs are one-time and which recur on AWS
This table lists the cost components of a CMMC environment on AWS or AWS GovCloud (US), who gets paid for each, whether it is one-time or recurring, and what moves it up or down. Use it to structure line-item quotes, since most of the recurring spend sits in consumption, staff time and tooling rather than in the initial build. No amounts are shown, so compare each row against the written scope and the rates your providers quote.
| Cost component | Who is paid | One-time or recurring | What drives it |
|---|---|---|---|
| AWS service consumption | AWS, billed to your account | Recurring, scales with workload | Compute and storage footprint, log retention volume, encryption and key management choices, and number of Regions or accounts in use |
| GovCloud (US) account setup and separate credentials | AWS, and your internal or partner staff for identity setup | One-time setup, then recurring administration | Number of GovCloud accounts, identity federation design, and who verifies US-person eligibility before access is granted |
| Implementation partner for landing zone, hardening and evidence | Implementation partner, under a fixed-scope written agreement | One-time, with optional recurring support retainers | Scope of the landing zone, number of workloads brought into the boundary, and how much evidence packaging is included |
| Internal staff time for the system security plan and policies | Your own employees (salary or time allocation) | Recurring, reviewed on each change and each assessment cycle | Number of systems in scope, frequency of configuration changes, and how often policies are reviewed and updated |
| Third-party security tooling and licenses | Tool vendors or support providers for paid editions | Recurring, usually annual or per-seat | Number of users and endpoints, log volume, and whether you choose open-source tools or paid editions with support |
| Independent assessor or C3PAO fees, if certification is required | Assessor or C3PAO, set by its own engagement terms | One-time per assessment, with periodic reassessment | Scope size, number of sites and systems, and whether the assessor must review AWS customer package evidence in addition to your controls |
| POA&M remediation work | Internal staff, implementation partner or specialist vendors | Variable, one-time per finding plus ongoing monitoring | Number and complexity of open findings, and how many controls depend on configuration changes that need testing |
What makes a CMMC environment on AWS cost more or take longer
The cost and schedule of a CMMC environment on AWS depends less on the platform than on how much of your business falls inside the CUI boundary. The six drivers below set the size of the enclave, the number of controls you must evidence, and how much outside help you will need, so decide each one deliberately before the build starts.
CUI-bearing systems and users
Every system, workload and user account that stores, processes or transmits CUI is in scope for the Level 2 requirements, and every one must be assessed against NIST SP 800-171 Rev. 2. Count them before design starts, including backups, logs and administrator workstations. Limit the CUI boundary to the fewest systems and people that the contract actually requires, and confirm the list with your program office or prime contractor.
GovCloud (US) or standard Regions
AWS GovCloud (US) requires a separate account and credentials and limits access to US persons who are not subject to export restrictions, which affects who on your staff and among your contractors can administer the enclave. Standard Regions are a valid choice for some CMMC workloads, but the decision changes the staffing model, the ITAR analysis and the evidence you must collect. Confirm the Region choice with your contracts and export counsel before you buy accounts.
Account count and landing zone design
Each AWS account adds its own guardrails, logging, identity configuration and evidence trail. A small number of purpose-built accounts for the enclave, logging and security tooling usually costs less to assess than many ad hoc accounts. AWS describes a Landing Zone Accelerator for GovCloud (US) that the CMMC Customer Package maps to. Reuse a landing zone that already has baselines rather than building separate governance for each team.
Non-cloud systems and endpoints
Workstations, on-premises servers, test equipment, printers and remote laptops that connect to the enclave or handle CUI are assessed in your scope, even though AWS hosts the cloud portion. Each one adds configuration, patching, media and access controls to evidence. Map every connection into the enclave, and remove or segregate endpoints that do not need access before you build the assessment package.
Maturity of policies and evidence
Assessors accept evidence only when it is final, dated and shows the control operating, not just written down. Organizations with current policies, approved system security plans and recurring review records need far less rework than those starting from draft documents. Ask your consultant or implementation partner to inventory what exists, then collect evidence as the build runs so logs, change tickets and access reviews are captured from day one.
Third parties that touch CUI
Every outside service that stores, processes or can access CUI, including managed service providers, SaaS tools, email and ticketing platforms, and support staff with administrative rights, must be identified and assessed as part of your scope. AWS covers the controls it inherits to you, but your own third-party agreements and flowdown terms remain yours to manage. Limit third-party access to the enclave and request written evidence of each provider's responsibilities before contracts are signed.
Standard Regions or AWS GovCloud (US): which fits your contract
When the covered data is CUI that carries no export-control restriction, AWS says customers can deploy CMMC solutions across standard and restricted Regions, including US East and US West, as well as AWS GovCloud (US). The choice then depends on your business requirements and the DoD program or contract you support, not on a single rule that applies to every contractor. Standard Regions do not require a separate account, so the operating model can stay close to the rest of your AWS estate.
- Region choice follows the contract: Standard Regions are an option only when the program does not require GovCloud (US) or a US-person-only boundary.
- Authorization context: Two FedRAMP JAB P-ATOs cover the GovCloud (US) Regions and the US East/West Regions, so ask how your assessor will verify the authorization that applies to the Region you select.
- Shared administration: Standard Regions can be administered by your existing identity and operations staff under your normal controls.
- Inheritance scope: AWS's CMMC Customer Package in AWS Artifact breaks down the Level 2 and NIST SP 800-171 controls you can inherit when using the Landing Zone Accelerator in GovCloud (US), so confirm which controls it covers in your chosen Region.
- Your own controls: Access, logging, configuration and incident response within your account remain your responsibility under every Region option.
Before you build, confirm with your contracting officer which Region the contract expects, and get that answer in writing.
When the workload holds ITAR or other export-controlled technical data, GovCloud (US) is the Region AWS restricts to customers who are US persons not subject to export restrictions. The environment requires a separate account and separate credentials, and AWS states it is managed by US citizens. AWS also says there is no formal ITAR certification and that, as a cloud provider, it is not an exporter of customer data. Its role is to restrict access to the GovCloud (US) network it controls to US citizens, while your own handling of the data remains your responsibility.
- Separate identity boundary: Plan separate accounts, separate credentials and separate administrator groups for GovCloud (US) rather than extending standard-Region roles into it.
- Who may access: Limit administrators and users to people who meet the US-person test, and document how you verify that status.
- Encryption as a safeguard: Under 22 CFR 120.54(a)(5), storing or sending unclassified technical data is not an export when it is protected with end-to-end encryption using FIPS 140-2 (or successor) compliant modules or equivalent AES-128 strength, and it is not sent to or stored in a country proscribed in 22 CFR 126.1.
- Legal review: Whether your data meets the regulation's conditions is a legal determination for your export compliance function and counsel, not something the cloud platform decides for you.
- Evidence: Keep records of account separation, access approvals and key management that an assessor can test.
Confirm your export classification and the US-person requirements with qualified export counsel before you select the Region.
Many contractors run one environment that holds some CUI with no export restriction and some export-controlled technical data. AWS says CMMC solutions can span standard and restricted Regions, which allows you to place each data set where its requirements apply. The cost of a split design is the added boundary, not the Region itself: every connection between a standard Region and GovCloud (US) becomes a path your assessor must understand and your team must control.
- Segregate by data, not by team: Classify data sets first, then decide which Region holds each one, so the boundary follows the requirement.
- Control cross-Region flows: Document every replication, transfer and shared service that crosses between accounts, and confirm each one keeps protected data within its permitted Region.
- Duplicate controls: Identity, logging, configuration and vulnerability management may need to run in both accounts, which adds recurring operating effort.
- Scope clarity: A smaller restricted enclave can reduce assessment scope, but only if the boundary is drawn clearly and tested.
- Written decisions: Record the reasoning for each placement so that auditors and your contracting officer can follow it.
Ask your contracting officer whether the contract accepts a split design and which system security plan boundary they expect to review.
How ITAR data fits into an AWS GovCloud (US) design
AWS states that there is no formal ITAR certification, that as a cloud provider it is not an exporter of customer data, and that it supports customers' ITAR compliance by restricting access to the AWS GovCloud (US) network it controls to US citizens. That leaves the parts that make a design compliant with ITAR in your hands: how data is protected, who can reach it, and where it can travel. A GovCloud account is a starting condition, not a finished control set, so the export analysis for each dataset still has to be done by your organization.
The key test for unclassified technical data is in 22 CFR 120.54(a)(5). Sending, taking or storing that data is not an export if it is secured with end-to-end encryption using FIPS 140-2 (or successor) compliant modules, or other means of at least AES-128 strength, and it is not intentionally sent to or stored in a country proscribed under 22 CFR 126.1. In practice, confirm that every path carrying the data, including backups, log stores, collaboration tools and support tickets, uses FIPS-validated cryptography, and that you can show which keys you hold and where they are kept. Confirm the current FIPS validation status of each module with the vendor rather than assuming it.
Your organization must still decide which people can access the data. Define the list of US persons or other authorized individuals, tie it to identity groups in your identity provider and to IAM roles in the account, and review that list on a schedule. Keep records of screening and of any access granted to foreign persons, since a GovCloud account does not replace an export compliance program that covers classification, licensing, training and recordkeeping. Ask your export counsel to confirm how the design maps to your technical data and to any licenses you hold.
How a CMMC build on AWS moves from scope to assessment
This sequence takes a defense contractor from defining which CUI systems are in scope to an assessment-ready AWS environment with evidence that maps to each NIST SP 800-171 requirement. The timeline depends on scope size and on the current status of CMMC Phase II, which the Department of War suspended on 13 July 2026 pending review.
Map CUI scope and data flows
Start by listing every system, person and service that stores, processes or transmits CUI, including identity providers, logging, backup and administrator paths. Your team owns this decision, and an implementation partner can document the data flows and draw the boundary. The step is done when a signed-off scope statement and data-flow diagram show which AWS accounts and services fall inside the assessment boundary.
Decide Region and account placement
Decide whether the workload runs in standard AWS Regions or in AWS GovCloud (US). GovCloud requires a separate account and credentials and is restricted to US persons not subject to export restrictions, so confirm eligibility for every administrator and engineer before choosing it. Confirm the contract and DoD program requirements with the contracting officer or your counsel. The output is a written Region and account decision with a named access roster.
Review the CMMC Customer Package
Download the CMMC Customer Package from AWS Artifact, using the version for the Region you chose, and read which Level 2 and NIST SP 800-171 controls AWS says customers can inherit when they use the Landing Zone Accelerator in AWS GovCloud (US). Compare each inherited claim against your own scope and contract terms, and record every requirement that remains yours. The output is a responsibility matrix that marks each requirement as inherited, shared or customer-owned.
Build and harden the landing zone
Deploy the multi-account landing zone with identity, centralized logging, network segmentation and encryption defaults, then harden the baseline against the configuration management and access control requirements in your matrix. Engineers configure the environment, and the organization approves the design. The step is complete when the baseline is deployed from versioned code, and a test run shows that changes are logged and that unapproved paths are blocked.
Configure controls and capture evidence
Configure the remaining controls for identity and MFA, audit logging, encryption with FIPS-validated cryptography, vulnerability scanning and backups, then capture the evidence each control needs, such as configuration exports, log samples and approved change records. Confirm with AWS and your assessor which FIPS validation evidence applies to each service you use. The output is an evidence repository indexed by requirement ID.
Write the system security plan and policies
Write the system security plan describing the boundary, the responsibility matrix, the control implementations and the owners of each control, and approve the supporting policies and procedures. The organization signs the plan, since it is the organization that owns its controls. The output is an approved plan that matches what the environment actually does, with each gap listed in a plan of action and milestones.
Self-assess against NIST SP 800-171A
Test each Level 2 requirement against the assessment objectives in NIST SP 800-171A, marking a requirement MET only when every applicable objective is satisfied with final, not draft, evidence. Record the results and the evidence location for each objective. The output is a completed self-assessment with an accurate score and a remediation plan for open items, which feeds the SPRS posting your contract requires.
Obtain an independent certification assessment if required
If your contract requires a Level 2 certification, engage a C3PAO authorized or accredited by The Cyber AB to assess the environment, and provide the evidence and the matrix. Whether this step applies depends on your contract and on the current status of Phase II, which the Department of War suspended on 13 July 2026 for a 60-day review. Only the C3PAO issues the certification, and DeployOpen does not issue audit reports or certificates.
What must be in place before an assessor looks at the AWS environment
An assessor will test the AWS environment only after the organization has defined what it contains, what it covers and who answers for each control. The six items below connect the boundary, the evidence, the inherited controls and the owners, so each one can be checked before the assessment starts.
Documented CUI boundary and data flow
Draw the boundary around every AWS account, VPC, workload, administrative path and connected endpoint that stores, processes or transmits CUI, then trace how that data enters and leaves. Check that the diagram matches the live environment, including backups, logging accounts and support access paths. Mark any system outside the boundary and record why it stays out. An assessor will start scoping from this diagram, so gaps here spread into every control family.
Final-form evidence for each objective
A requirement counts as MET only when every applicable NIST SP 800-171A assessment objective is satisfied with evidence in final form. Walk each objective and confirm that the artifact is an approved, dated and versioned document or a retained log export, not a draft or a screenshot without context. Check that the evidence was produced in the period the assessor will examine. Missing objectives are the most common reason a requirement fails review.
Inventory of accounts, identities and logs
List every AWS account in the organization, every IAM user, role and federated identity with access to CUI systems, and every logging source that feeds the security record. Confirm that each identity maps to a named person or an owned process, and that the logging sources cover the accounts in the boundary. Verify that the inventory is produced from AWS sources, not maintained by hand, so the assessor can compare it with the live state.
CMMC Customer Package mapped to own duties
Download the CMMC Customer Package from AWS Artifact in the AWS GovCloud (US) Region and map each Level 2 and NIST SP 800-171 control it lists against your responsibilities. AWS states that the package breaks down the controls customers can inherit when using the Landing Zone Accelerator in GovCloud (US), so confirm which of those inherited controls depend on your configuration. Record the remaining controls as yours, with the evidence each one needs.
System security plan and plan of action
Write a system security plan that describes the AWS architecture, the boundary, each control's implementation and who operates it. Pair it with a plan of action that lists every requirement not yet fully met, the remediation steps, the owner and the target date. Check that the plan describes the environment as it runs today, because assessors compare the written plan against the configuration they sample.
Named owners for each control family
Assign one accountable person to each of the 14 CMMC domains, such as access control, audit and accountability, or system and communications protection. Each owner should be able to show the evidence for their family, explain the AWS services that support it and state which parts the organization operates itself. Confirm that owners have the access and time to produce evidence, and that an alternate is named for each family.
Who owns each part of a CMMC environment on AWS
Your organization owns the outcome. AWS documents the controls it operates, and the CMMC Customer Package in AWS Artifact shows which Level 2 controls you can inherit from AWS when you use the Landing Zone Accelerator in AWS GovCloud (US). The requirements still apply to you as the defense contractor, so your team decides the scope, writes the policies and signs off on what is claimed.
- Policies and the system security plan: Your team writes the policies and the system security plan that explain how each of the 110 Level 2 requirements is met, including which controls come from AWS and which come from you.
- Personnel security: Screening people before they access systems with CUI, handling terminations and transfers, and confirming US-person status for anyone you grant GovCloud (US) access remain your obligations.
- Incident response and daily operations: Your staff run the incident handling capability, track and report incidents, and review audit logs and alerts.
- POA&M decisions: Your team decides which gaps go on a plan of action and milestones, assigns owners and tracks closure.
- The affirmation: The Affirming Official attests to the state of the environment. A partner can prepare the documents, but this person is accountable for what is affirmed.
Before any partner starts work, confirm that a named internal owner exists for each of the 14 CMMC domains.
An implementation partner such as DeployOpen plans, builds, hardens and documents the environment under a written scope. The partner prepares systems and evidence for your assessment. It does not issue reports, attestations or certificates, and it does not decide whether your controls are met.
- Account and landing zone build: The partner can set up the separate GovCloud (US) account and credentials, define network boundaries and deploy the Landing Zone Accelerator in AWS GovCloud (US) if that is your chosen approach.
- Hardening and self-hosted tooling: Identity, logging, configuration baselines, vulnerability scanning and time synchronization are configured for the systems you run inside the boundary.
- Evidence preparation: The partner produces configuration exports, log samples, baseline documents and control inheritance mapping that your assessor can review against the NIST SP 800-171A assessment objectives.
- Documentation and handover: Runbooks and draft sections of the system security plan are written for your team, which must review and adopt them as its own.
- Ongoing support: Upgrades, patching and continuous testing can be contracted as a retainer, with the scope agreed in writing.
Ask any partner for a written scope that lists which controls it configures, which it only documents and which it does not touch.
Level 2 certification assessments are performed by C3PAOs authorized or accredited by the CMMC Accreditation Body, currently The Cyber AB. The assessor tests your controls against the NIST SP 800-171A assessment objectives and issues the outcome. Whether your contracts currently call for a certification assessment depends on the Department of War's program status, so confirm that in writing with the contracting officer before you book one.
- Testing and evidence review: The assessor reviews evidence, interviews staff and inspects systems. It does not configure the environment for you.
- Outcome issuance: Only the assessor issues the certification outcome that enters the official record.
- Independence: The firm that built your AWS environment should not also serve as your C3PAO. Shared work creates a conflict that an assessor must avoid.
- Evidence in final form: A requirement counts as MET only when every applicable objective is satisfied with final evidence, so ask which artifacts the assessor accepts before your team builds them.
- Boundary alignment: The assessor checks whether the AWS services in use and your enclave boundary match what your system security plan describes.
Confirm in writing that your assessor and your implementation partner are separate organizations before any engagement starts.
How to choose an AWS CMMC implementation partner or assessor
Choosing help for a CMMC environment on AWS involves two different roles: a partner that builds and documents the environment, and an assessor that tests it. The cards below cover the checks that separate them and the questions to put to each before a written scope is agreed.
GovCloud (US) and Landing Zone Accelerator experience
Ask for named examples of accounts built in AWS GovCloud (US), which requires a separate account and credentials from standard Regions. Ask whether the team has deployed the Landing Zone Accelerator in GovCloud (US) and how they map its controls to the CMMC Customer Package in AWS Artifact, so you know which Level 2 requirements AWS covers and which remain yours.
Assessor authorization through The Cyber AB
Only a C3PAO authorized or accredited by the CMMC Accreditation Body, currently The Cyber AB, can perform a Level 2 certification assessment. Confirm the firm's status on the Cyber AB registry before discussing scope, and do not accept a consultant's own assessment as a substitute. Phase II certification requirements are currently suspended, so confirm with your contracting office which assessment your contracts need.
Independence between build and assessment
The organization that designs and configures your AWS environment should not also certify it. Ask whether the implementation partner will assess its own work, and if the same firm is considered for both roles, get the separation reviewed by your assessor and written into the engagement. Build work prepares systems and evidence; only the independent assessor issues the result.
Written scope with deliverables and evidence formats
A fixed-scope agreement should list the accounts and Regions in scope, each Level 2 requirement family the work covers, and the artifacts delivered, such as the system security plan, network diagrams, configuration baselines and log retention settings. Ask in which format evidence will be handed over and who owns the final versions, since assessors accept only evidence in final form.
US-person staffing for GovCloud administration
GovCloud (US) is restricted to customers who are US persons not subject to export restrictions, and AWS states it is managed by US citizens. Ask how the partner staffs administration, support and access to CUI-related systems, which personnel will hold admin roles, how their citizenship and eligibility are verified, and how that staffing is documented for your assessment.
Support and retainers after handover
A CMMC environment changes after the assessment: patches, new accounts, vendor updates and evolving DoD requirements all affect scope. Ask what support the partner offers after handover, whether it is billed as a retainer, what response expectations are written down, and who maintains the evidence set between assessments. Ask also how changes to the Level 2 baseline, including the review of the 2024 Rev. 2 requirements, would be handled.
Questions buyers ask about CMMC on AWS
Does AWS make us CMMC compliant?
No. CMMC measures a defense contractor's own capabilities, so compliance is your responsibility as the organization handling CUI. AWS states that cloud services do not need to be CMMC certified, that it is authorized by FedRAMP at High, and that it is authorized by DISA at Cloud Computing SRG Impact Levels 2, 4 and 5. AWS's CMMC Customer Package, available in AWS Artifact, breaks down the Level 2 and NIST SP 800-171 controls you can inherit from AWS when you use the Landing Zone Accelerator in AWS GovCloud (US). You still own the controls the package does not cover, the policies, the system security plan and the evidence. Only a C3PAO can issue a Level 2 certification, and only where a contract requires one.
Do we need AWS GovCloud (US) to handle CUI?
Not necessarily. AWS states that customers can deploy CMMC solutions across standard and restricted Regions, including US East/West and AWS GovCloud (US), based on the requirements of their business and DoD programs and contracts. GovCloud (US) requires a separate account and credentials and is restricted to customers who are US persons not subject to export restrictions, so the choice depends on who must access the data and what your contracts and export obligations say. Confirm the Region requirements with your contracting officer and your legal counsel before you design the environment.
Can we run a CMMC environment on AWS ourselves?
You can, if your team has the skills to design, configure and document the environment and to produce the evidence an assessor will test. The work includes account structure, identity, logging, encryption, network boundaries, configuration baselines and the system security plan. An implementation partner can prepare systems, controls and evidence under a written, fixed scope, but it does not issue assessment results. Many organizations split the work: internal staff own policy and operations, and an outside firm builds the baseline. Ask any partner to show how it will hand over documentation your staff can maintain.
What does the work need from our internal team?
Plan for named owners in several areas before the build starts. Typical roles include an executive sponsor who accepts risk, an engineer who operates the AWS accounts, an identity administrator, someone who owns logging and monitoring, and a compliance lead who maintains the system security plan and the Plan of Action and Milestones. Your team must also decide which controls AWS inherits through the CMMC Customer Package and which remain yours. Expect ongoing effort after the build, because evidence must stay current between assessments. Ask any partner which of these roles it will fill and which it expects you to staff.
What changed with the Phase II suspension?
On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts, and started a 60-day review by a CMMC Reform Task Force. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. The Department's CIO page also says implementation is paused in Phase 1 and may only require self-assessments at Levels 1 and 2, while the eCFR text still contains the original four-phase schedule. Because the rules are in flux, confirm your current obligations with your contracting officer before you commit to a certification timeline or budget.
How does ITAR affect our choice of AWS Region?
ITAR is a separate obligation from CMMC, and the Region choice is one input to it. AWS states that there is no formal ITAR certification and that, as a cloud provider, it is not an exporter of customer data. It supports your ITAR compliance by restricting access to the AWS GovCloud (US) network it controls to US citizens. Under 22 CFR 120.54(a)(5), storing unclassified technical data is not an export if it is protected with end-to-end encryption using FIPS 140-2 (or successor) compliant modules or other means of at least AES-128 strength, and the data is not intentionally sent to or stored in a country proscribed in 22 CFR 126.1. Your export counsel should confirm how these conditions apply to your data flows.
How do we get a quote for a CMMC environment on AWS?
Start with a written scope. Describe the systems that handle CUI, the Regions you need, the number of accounts, your identity provider, your logging needs, the ITAR and export constraints, and whether you need Level 2 certification or a self-assessment. Ask the provider to separate one-time build work from recurring operations and evidence upkeep, and to state what it will deliver and what you must supply. DeployOpen does not publish a price list. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and the quote follows from that scope.
How DeployOpen scopes and prepares an AWS CMMC environment
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own AWS accounts, including AWS GovCloud (US) where your contracts call for it. We prepare systems and evidence for your assessment, while your organization owns its controls and an independent assessor issues any certification.
How we scope
- Confirm which workloads, users and data types, including CUI and any ITAR technical data, fall inside the CUI boundary.
- Map which Level 2 requirements AWS inherits through the CMMC Customer Package and which remain your responsibility.
- Agree the scope, deliverables and timelines in writing before work starts, since engagements are fixed-scope.
How we build
- Deploy the environment in a separate GovCloud (US) account or the standard Region you have chosen, with credentials your US-person staff control.
- Configure identity, MFA, logging, configuration baselines and encryption, with FIPS-validated cryptography confirmed against the services you use.
- Test controls against the NIST SP 800-171A assessment objectives and record the results as final, dated evidence.
How we hand over
- Deliver the system security plan, inheritance matrix, policies and evidence packages mapped to each requirement ID.
- Document operating procedures so your staff can run, change and review the environment without us.
- Provide a clear list of open items and plan of action entries, with the owner of each item named.
How we support
- Offer ongoing support, upgrades, backups and continuous testing under a retainer when you want help between assessments.
- Keep evidence current as configurations change, so each Level 2 requirement stays supportable through reviews.
- Confirm with your assessor or contracting office which CMMC phase and assessment type applies to your contracts before scoping.
