CMMC consultant cost and what they do

What does a CMMC consultant cost, and what does the money buy?

No published rule sets what a CMMC consultant charges, and the government's published Level 2 figures cover assessment activity only. The 2024 CMMC final rule estimated the C3PAO engagement at $52,056 for an other-than-small entity and $31,234 for a small entity, but it excludes the cost to implement or maintain the NIST SP 800-171 Rev. 2 requirements and says its figures are average effort, not market prices. Consultant and implementation fees therefore come from your own scope, which depends on the number of systems in the assessment boundary, the state of the documentation, and how much of the evidence already exists. The organization owns its controls and the Affirming Official owns the attestation. An implementation partner prepares systems, policies and evidence, and only a C3PAO issues a certificate. Keep those roles separate in every quote you receive. Before you budget, confirm which obligations apply to your contracts today. On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Check the Department of War release on the suspension and ask your contracting officer which assessment your contracts currently require.

When you request a quote, ask the provider to split it into one-time work and recurring work. One-time work usually includes gap assessment, scoping, system security plan drafting, policy writing, and remediation of the 110 Level 2 requirements that are not yet met. Recurring work includes evidence collection, log review, periodic access reviews and support between assessments. Ask what hardware and software are priced separately, whether the quote covers managed services or only advice, and who performs the work, because the people who prepare your evidence must not be the people who assess it. Ask for a written list of deliverables that name each requirement and the evidence the organization will hold. A consultant who guarantees a certification result, or who ties fees to a passing score, is describing a practice the CAP v2.0 prohibits C3PAOs from offering, and you should treat that promise as a warning sign.

Which parties are paid for what, and what recurs

This table lists each party that may be paid during a CMMC effort, what that party is paid for, whether the cost is one-time or recurring, and what drives it. The figures are government averages from the 2024 CMMC final rule and the January 2025 FAR CUI proposed rule, not market prices, so use them to understand the structure of cost and to frame quote requests.

Cost component	One-time or recurring	What it covers and the figure supplied	Main cost drivers
C3PAO assessment	One-time per certification cycle	The 2024 final rule estimated $52,056 for an other-than-small entity (a 5-person team, 200 hours at $260.28 per hour) and $31,234 for a small entity (a 3-person team, 120 hours). The rule says these are average efforts, not actual C3PAO prices.	Size and complexity of the network in scope, team size, hours, and how well evidence is prepared before the assessor arrives
Internal staff time	Recurring while the program runs	The rule assumes other-than-small entities have full-time cybersecurity staff, and its estimates count the contractor's own labor to prepare, support, report and affirm the assessment. Confirm your own hours with your team.	Existing headcount, skill gaps, number of systems in scope, and how much documentation exists today
Implementation labor (consultant or partner)	Largely one-time, with ongoing upkeep	The FAR CUI proposed rule (January 2025) estimated implementation labor for a small business at about $148,200 in the first year (1,560 hours at $95) and about $98,800 a year after that (1,040 hours).	Gap between current controls and the 110 Level 2 requirements, scope of the system security plan, and whether work is fixed-scope or time-and-materials
Managed service provider or external service provider	Recurring, usually billed monthly or annually	The rule assumes small entities are likely to rely on external service providers for IT and cybersecurity. It does not give a provider price. Ask each provider for its written scope and what it will and will not cover.	Number of users and endpoints, which controls the provider manages versus which stay with you, and response time commitments you negotiate
Hardware and software	First year higher, then recurring	The FAR CUI proposed rule estimated an average of $27,500 in the first year and $5,000 a year after for a small business, and $140,000 in the first year and $80,000 a year after for a business other than a small business.	Need for new enclosures, encryption, logging, and identity tools, license tiers, and whether the environment is cloud or on-premises
Registered Practitioner application and renewal	One-time application, then annual renewal	The Cyber AB lists $600 for Registered Practitioner application, training and testing ($500 annual renewal), and $1,000 for Registered Practitioner Advanced ($750 renewal). Each takes about 3 weeks including a background check.	Individual credentials held by the people doing the work, and whether they stay current
Registered Practitioner Organization application and renewal	One-time application, then annual renewal	The Cyber AB lists $6,000 for an RPO application and $5,000 annual renewal, with the process taking about 3 weeks including a background check.	Whether your consultant holds RPO status and keeps it current, and whether that status is needed for the services you buy

Why DoD's published estimates leave consultant work out

The cost figures in the 2024 CMMC final rule cover only assessment and affirmation activities for Levels 1 and 2. They do not include the cost to implement or maintain the NIST SP 800-171 Rev. 2 requirements, and they do not include remediating a plan of action. The rule's reasoning is that DFARS 252.204-7012 already required implementation by 31 December 2017, so the implementation spend was treated as already incurred. The estimates also assume the contractor passes on the first attempt. A budget built only from those published numbers will therefore leave out the largest share of real spending: the engineering, policy writing, tooling, and re-assessment work that comes before an assessor arrives. Ask any consultant or implementation partner to show, in writing, which of those items their quote covers and which remain yours.

The rule also says its figures represent average assessment effort, not actual C3PAO market prices. It states that supply and demand in the market will set assessor pricing, and that the size and complexity of the network in scope affects cost. Two conclusions follow for a buyer. First, the C3PAO line in any estimate is a starting reference, not a quote. Second, scope drives the price more than headcount does, so a clearly bounded system security plan and asset list is the cheapest lever you control before you request bids. Keep a dated record of every scope decision, because assessors and resellers will both price from it.

The rule assumes that small entities will rely on external service providers for IT and cybersecurity, since they generally lack full-time security staff, and it expects contractors of both sizes to seek consulting or implementation help. The SBA Office of Advocacy raised concerns about the rule's impact on small businesses, which is why the outside-help assumption carries weight. Treat it as a planning input: confirm early which tasks your own staff will own, which a managed service provider or implementation partner will perform, and which only the independent assessor may perform. Any consultant that offers to guarantee a result or tie fees to a certificate is making a promise that the Cyber AB's assessment process rules prohibit assessors from making.

What makes a CMMC consultant engagement cost more or less

Consultant and implementation fees follow the work your team cannot absorb, and that work grows with how much of the company sits inside the CUI boundary. The six drivers below are the levers you control before you sign a statement of work, and each one changes how many hours someone else must bill you for.

Assessment scope and network size

The 2024 CMMC final rule says that the size and complexity of the network in assessment scope affect cost. Every system, enclave, and connection that touches CUI must be prepared, documented, and assessed. Before you engage help, map where CUI is created, stored, processed, and transmitted, then remove systems that do not need it. Ask any consultant to price the boundary you have defined, not the whole company, and to state which assets they assumed were in scope.

Headcount and in-house security staff

The rule's cost analysis assumes larger contractors have full-time cybersecurity staff, while smaller ones usually do not and rely on outside providers. If your team already owns patching, logging, and access reviews, consultants spend fewer hours teaching and more hours validating. If nobody owns these tasks, expect the consultant to fill those roles, which raises hours and the risk that your Affirming Official signs for work no one on staff understands. Ask who will operate each control after the engagement ends.

Number of systems and locations

Each additional system, operating environment, and facility multiplies the evidence an assessor will sample. Multiple sites add physical protection, media handling, and remote access reviews that repeat at each location. Consolidating CUI into fewer systems before engagement often reduces both the consulting hours and the later assessment hours. Ask for the price per system or per site in the quote so you can see which additions drive the total.

Reliance on external service providers

External service providers that store, process, or transmit CUI, or that manage security for you, come into scope and must be documented with their own evidence. The rule's estimates count external provider hours for small entities, so this reliance adds labor on both sides. Gather each provider's responsibility split, contract terms, and FedRAMP or equivalent status before the consultant starts, because chasing those documents late is a common source of change orders.

Evidence maturity and drafts

A requirement counts as MET only when every applicable assessment objective is satisfied with evidence in final form, and drafts do not count. Policies written for the engagement, screenshots taken without dates, and undocumented procedures all need rework. Mature evidence, such as approved system security plans, dated configuration baselines, and retained audit logs, shortens the consultant's review cycles. Ask the consultant to show how each piece of evidence will be finalized and who approves it.

Remediation backlog

Requirements that are not yet implemented need engineering time, and the rule's cost estimates exclude remediation because DFARS 252.204-7012 already required implementation by 31 December 2017. Any unfinished control, whether it lives in a plan of action or in an undocumented gap, is priced as new work. Run your own gap review against the 110 Level 2 requirements before requesting quotes, and separate items you can close yourself from items that need a funded project.

How a consultant engagement moves from scoping to assessment

A consultant engagement moves in a fixed order: define the boundary, measure the gap against the 110 Level 2 requirements, build the fixes and evidence, prove readiness, hand the records to the organization, and only then bring in an independent assessor if certification is required. Each phase ends with a named output that the organization can check.

Agree written scope and system boundary
The consultant and the organization define which systems, enclaves, users, facilities and external service providers handle CUI and fall inside the assessment boundary. Staff from the organization own the decisions, and the consultant documents them. The output is a signed scope statement and a boundary diagram listing in-scope assets, out-of-scope assets and the reasons for each. Ask the consultant to show how it will confirm that no CUI sits outside the boundary.
Run the gap assessment against Level 2
The consultant tests the in-scope environment against the 110 Level 2 requirements, which are identical to NIST SP 800-171 Rev. 2, using the assessment objectives in NIST SP 800-171A. Each requirement is marked as met, partially met or not met, with the evidence reviewed. The output is a gap register that lists every unmet objective, its owner and the artifact that would close it. Ask for the register in a spreadsheet format your team can keep updating.
Remediate controls and build evidence
The organization and its implementation partner close the gaps in configuration, access control, logging, encryption and policy. Work that changes systems is done by the people who run them, with change records kept as normal. The output is working controls plus evidence in final form, such as configuration exports, log samples, signed policies and training records, because drafts do not satisfy an objective. Confirm who signs each policy and who approves each configuration change.
Draft the system security plan and plan of action
The consultant helps write the system security plan describing how each requirement is implemented in this environment, and a plan of action for any requirement still open, with milestones and owners. The organization reviews both documents line by line, because the Affirming Official must be able to stand behind every statement. The output is an approved plan and plan of action with version control. Check that the plan describes what the systems actually do, not what the template says they should do.
Perform an internal readiness check
Someone who did not build the controls tests them against the same objectives used in the gap assessment. This check reproduces the evidence a C3PAO would ask for and looks for gaps the implementation team missed. The output is a readiness report with a pass or fail result per requirement and a list of items to fix before any external assessor is engaged. Keep this check separate from the team that implemented the controls so that the result carries weight.
Hand over the plan, evidence and runbooks
The consultant transfers the system security plan, evidence repository, configuration baselines, runbooks and access records to named people in the organization. Handover includes a walkthrough so staff can answer assessor questions about how each control operates. The output is a signed handover record and a list of recurring tasks, such as log reviews and access recertifications, with owners. Ask what access the consultant keeps after handover and how that access is revoked.
Engage a C3PAO only if certification is required
If a contract or program requires a Level 2 certification assessment, the organization selects a CMMC Third-Party Assessment Organization separately, through its own procurement. The C3PAO is authorized or accredited by the CMMC Accreditation Body, currently The Cyber AB, and it cannot be the consultant that prepared the environment. The output is a signed assessment agreement and a scheduled assessment window. Confirm that the consultant's staff are not on the assessment team and that the C3PAO will not accept any guarantee of results.

Who owns the controls, who prepares evidence, and who assesses

Your organization owns its controls. Nobody else can decide how your environment is configured, which risks you accept, or whether a requirement is actually met in daily operations. Your leadership also carries the legal weight of the submission, because the Affirming Official must personally attest to the status posted for your organization. Outside firms can advise on that role, but they cannot hold it on your behalf.

Control ownership: Your staff decide and run the policies, access reviews, change approvals and incident handling that the Level 2 requirements describe.
Affirming Official: A senior official in your company must affirm compliance and keep that affirmation current. Confirm the current affirmation rules in the CMMC rule and the DFARS clause before you name anyone.
Final decisions: Scope boundaries, plan of action decisions and acceptance of residual risk stay with your leadership, even when a consultant recommends them.
Operational evidence: Logs, tickets, training records and reviews must come from systems your team runs every day, not from documents written for the assessment.

Before you sign any statement of work, confirm which decisions in your plan remain with your staff and who will hold the affirmation.

What no assessor or consultant may promise

No C3PAO and no consultant may guarantee that your company will pass a CMMC assessment. The Cyber AB's CMMC Assessment Process (CAP) v2.0 bars C3PAOs from guaranteeing assessment results, and it also bars them from taking incentive or bonus payments that depend on issuing a Certificate of CMMC Status. Those two rules are the clearest test you can apply during procurement. If a firm offers a guaranteed pass, a success fee payable only on certification, or an assurance of a particular score, treat the offer as a red flag, whether it comes from an assessor or from a consultant who says it can arrange the outcome.

The same caution applies to implementation partners, including DeployOpen. An implementation partner prepares systems, configurations, documentation and evidence for the Level 2 practices. It does not decide whether a requirement is MET, and it does not issue a certificate. Under 32 CFR 170, a requirement is MET only when all applicable assessment objectives are satisfied with evidence in final form, and the assessor makes that determination. Ask any partner to show, in writing, which deliverables are its own and which decisions belong to the Affirming Official and the independent assessor. DeployOpen does not guarantee assessment results or certification outcomes, and it states that in every fixed-scope agreement.

Before you sign, ask each firm to put three things in writing: what it will deliver, what evidence it expects you to produce and which party is responsible for the final scoring. Confirm how fees are structured, and whether any part of the payment depends on certification. A fixed-scope quote with milestones tied to deliverables is easier to verify than a percentage of contract value. Check the current requirements on the DoW CIO About CMMC page, since the phase schedule and assessment expectations have changed in 2026, and confirm with your contracting officer which level your contracts require.

Questions to ask before signing a CMMC consultant

A consultant can prepare your environment, documentation and evidence, but it cannot issue your certification and must stay out of the assessment itself. The cards below turn that split into questions you can put to any firm before signing, covering its designation, its independence, the scope of work, the people doing it, how it treats drafts, and what you still own.

Confirm the designation

Ask whether the firm is a Registered Practitioner Organization (RPO) or whether the individuals doing the work are Registered Practitioners (RPs) or Registered Practitioner Advanced (RPAs) listed by The Cyber AB. Check each name against the public directory yourself rather than relying on a logo or a slide. A firm that cannot show current registrations for the people on your project should not be your implementation partner for CMMC work.

Confirm it will not assess you

Get a written statement that the firm, and every person on the engagement, will not serve on the C3PAO assessment team for your company. Ask which C3PAO you plan to use and whether the consultant has any relationship with that firm. The consultant prepares your evidence, while the assessor must be independent, so a conflict here can invalidate the assessment you paid for.

Require a written scope

Ask for a scope document that names the systems, enclaves, sites and external service providers in scope, the Level 2 requirements covered, and each deliverable with its acceptance criteria. Look for what is excluded, such as specialized assets, cloud tenants or subcontractor flowdown. An open-ended hourly arrangement with no defined outputs makes it hard to tell later whether the work is finished.

Ask who does the work

Request the names, roles and relevant background of the people who will touch your environment, not only the senior staff who sell the engagement. Ask how many hours each person is expected to contribute and whether any subcontractors are involved. Confirm that the team is authorized to access CUI-related systems under your own security and personnel rules before they start.

Ask how drafts are handled

Ask how the firm writes and reviews evidence, including the system security plan, policies and screenshots. Under the assessment rules, a requirement is met only when its objectives are satisfied with evidence in final form, so drafts do not count. Ask who approves each artifact before it is treated as final, and who keeps version control of the evidence set.

Get a list of what you own

Ask for a written list of tasks and decisions that remain with your organization, including the Affirming Official's responsibilities, operation of security controls, incident response, and approval of the scope. Compare that list with the work the firm will perform. Any promise that the firm will guarantee a result, or tie fees to an outcome, is a reason to walk away, because the rules bar assessment guarantees and contingent bonuses.

CMMC consultant cost questions buyers ask

How does a CMMC consultant's cost compare with a C3PAO assessment?

They are separate purchases, and the consultant is usually not the larger one. A C3PAO assessment is the independent certification assessment, and the 2024 CMMC final rule priced the C3PAO engagement itself at $52,056 for an other-than-small entity (a 5-person team, 200 hours at $260.28 per hour) and $31,234 for a small entity (a 3-person team, 120 hours). Consultant or implementation work is a different contract, paid to a Registered Practitioner Organization or implementation partner to prepare systems, policies and evidence. Its price depends on the number of systems in scope, how far controls already are from the 110 Level 2 requirements, and how much hands-on work you ask for. The rule itself did not price consultant fees, so ask each firm for a fixed-scope quote.

Can a company prepare for CMMC without hiring a consultant?

Yes, provided it has the internal capacity and expertise to do the work. The 2024 CMMC final rule assumes larger companies have full-time cybersecurity staff, while small entities typically do not and are likely to rely on external service providers. Preparing alone means someone must map each requirement to your environment, write the system security plan, collect evidence in final form, and run a self-assessment against the NIST SP 800-171A objectives. Because a requirement is met only when every applicable objective has final evidence, most gaps come from missing documentation rather than missing tools. If you prepare internally, consider a consultant only for a second-opinion review before you book the assessment.

How much work does a CMMC project need from internal staff?

Internal staff remain responsible for decisions and for evidence that only your organization can produce. Expect demands on the people who run identity, endpoints, networks and HR, plus an executive who can sign the affirmation. Typical internal tasks include confirming the asset inventory, approving policies, reviewing access lists, supplying logs, and answering interview questions during the assessment. The 2024 final rule's cost analysis treats the contractor's own labor as the largest share of each estimate, alongside external provider hours for small entities. Ask a consultant to name the internal roles and hours it expects, and check that the plan does not assume the consultant will run your operations after the engagement ends.

Are the government's CMMC cost figures the price I should budget?

No. Use them as a floor for understanding scope, not as a budget. The 2024 CMMC final rule states that its Level 1 and 2 estimates cover only assessment and affirmation activities. They exclude the cost to implement or maintain the NIST SP 800-171 Rev. 2 requirements and the cost to remediate a plan of action, because DFARS 252.204-7012 already required implementation by 31 December 2017. The rule also says its estimates are average efforts, not actual C3PAO market prices, that market supply and demand set prices, and that network size and complexity raise costs. For implementation labor, the FAR CUI proposed rule of January 2025 estimated about $148,200 in the first year for a small business (1,560 hours at $95) and about $98,800 a year after that. Its hardware and software estimates were $27,500 in the first year and $5,000 a year after for a small business, and $140,000 in the first year and $80,000 a year after for an other-than-small business. Treat these as one-time and recurring components to check against your own environment.

Does the Phase II suspension change how much CMMC will cost me?

The suspension changes when you must buy certification, not whether you must meet the requirements. On 13 July 2026 the Department of War suspended CMMC Phase II, which would have required Level 2 C3PAO certification for applicable contracts, and started a 60-day review by a CMMC Reform Task Force. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place, and the Department says it will enforce NIST SP 800-171 Rev. 2 in the interim. Because the requirements do not change, implementation spend is largely unaffected. The timing of the C3PAO fee may move, so confirm the current phase with the contracting officer and the DoW CIO's About CMMC page before you commit to an assessment date.

What should I ask for in a CMMC consultant quote?

Ask for a written, fixed-scope quote that lists each deliverable, the systems and sites in scope, and the assumptions behind the price. Request a breakdown by task, including gap assessment, system security plan, policy set, evidence collection, technical configuration and assessment support, and state whether each is one-time or recurring. Confirm who performs the work, whether the firm is a Registered Practitioner Organization, and how its staff are credentialed. Check that the quote excludes assessment and does not promise a result. Under CAP v2.0, a C3PAO may not guarantee outcomes or take incentive payments tied to certification, and a responsible consultant will not promise a pass. Also ask what happens if the assessment finds gaps and how re-work is priced.

How DeployOpen works on this

DeployOpen works on CMMC as an implementation partner. We prepare systems, controls and evidence inside your own environment, while the Affirming Official owns the controls and only an independent C3PAO or certification body issues any assessment result. Engagements are fixed-scope, with the work agreed in writing before it starts.

How we scope

Written scope names the systems, enclaves and CUI flows that fall inside the assessment boundary.
Deliverables, responsibilities and timelines are agreed in writing before any work starts.
Your Affirming Official and our team agree which requirements we prepare and which stay with your staff.

How we build

We configure and document the NIST SP 800-171 Rev. 2 controls in your cloud accounts, data centers or air-gapped networks.
We test each control against the assessment objectives so evidence is final, dated and traceable to an owner.
We integrate open-source platforms with your existing identity, logging and change processes rather than replacing them.

How we hand over

We deliver the system security plan, evidence binder and open plan of action items as documented, owned work products.
We train your staff to run the controls, collect evidence and answer assessor questions without us present.
We hand over administrative access, runbooks and configuration records so your team can operate the environment independently.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after the fixed-scope work closes.
Retainers cover evidence refreshes between assessments and changes to the boundary as your environment grows.
Ask any implementation partner to confirm in writing which parts of the assessment remain with the C3PAO and your team.

What a CMMC consultant does and what it costs