What does CMMC Level 3 cost for a defense contractor?
If a contract or program requires CMMC Level 3, the Department of Defense's 2024 final rule estimated $21,100,000 in nonrecurring engineering and $4,120,000 in recurring engineering for an other-than-small entity, plus $39,021 to support the DIBCAC assessment and initial affirmation. For a small entity, the same rule estimated $2,700,000 in nonrecurring engineering, $490,000 in recurring engineering and $9,050 for DIBCAC support. These are DoD estimates per entity, not quotes, and they describe the national average burden the rule assumed, so your own figure will depend on your environment. Treat them as a starting point for budgeting, not a number to commit to.
The estimates are not the whole bill. The final rule notes that total Level 3 cost includes the Level 2 certification assessment by a C3PAO, which DoD separately estimated at $112,345 for an other-than-small entity and $101,752 for a small entity per assessment including initial affirmation. Your real cost is driven by the systems in your Level 3 scope, how many of the 24 SP 800-172 requirements you already meet, whether you run a 24/7 security operations capability in-house or contracted, and how much specialized engineering your environment needs. Before you accept any quote, ask the provider to break out engineering, assessment support, the Level 2 C3PAO fee and the annual affirmation effort, and to state which systems are in scope.
Confirm the cost basis before you plan around it. The Department of War suspended CMMC Phase II on 13 July 2026, and the Level 3 figures above come from the 2024 final rule, not from a later update. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place, so check with your contracting officer which level and timing apply to your contract. Review the current status in the DoW CMMC Phase II suspension release and the CMMC Program rule in the Federal Register before setting a budget.
Who is paid for what in a Level 3 program
This table compares each cost component of a CMMC Level 3 program by who is paid, whether the cost is one-time or recurring, and what drives it. The 2024 final rule figures are shown where DoD estimated them, so readers can see which costs fall on engineering budgets and which fall on assessment fees. The main takeaway is that most of the expense sits in internal and partner engineering, and the assessment fees are a smaller, recurring layer on top.
| Cost component | Who is paid | One-time or recurring | What drives it |
|---|---|---|---|
| Nonrecurring engineering (internal staff) | Internal staff time, not an outside invoice | One-time | Size of the Level 3 scope, existing controls, and how much SP 800-172 work is new. The 2024 final rule estimated $21,100,000 for other-than-small entities and $2,700,000 for small entities. |
| Nonrecurring engineering (implementation partner) | Implementation partner under a written fixed-scope agreement | One-time | Number of systems in scope, tooling already in place, and the SOC and incident response build-out. Confirm which share of the rule's nonrecurring estimate is partner work in your quote. |
| Nonrecurring engineering (tooling) | Software and hardware vendors, cloud providers | One-time, with licence or hosting renewals | Whether monitoring, detection and isolation tools are open source or licensed, and whether the environment is cloud or on-premises. |
| Recurring engineering | Internal staff, partner retainers, tool vendors | Recurring | Staffing of the 24/7 security operations capability, threat hunting, annual penetration testing and patching. The 2024 final rule estimated $4,120,000 for other-than-small entities and $490,000 for small entities per entity. |
| Level 2 C3PAO certification assessment and initial affirmation | C3PAO, paid by the contractor | Repeated every three years | Level 2 scope and evidence quality. The 2024 final rule estimated $112,345 for other-than-small and $101,752 for small entities per assessment. |
| DIBCAC assessment support and initial affirmation | Assessment support paid by the contractor; DIBCAC performs the assessment without a fee to the contractor | Repeated every three years | Number of Level 3 systems, documentation readiness and POA&M closeout. The 2024 final rule estimated $39,021 for other-than-small and $9,050 for small entities. Confirm current DIBCAC fee treatment with the assessing body. |
| Annual affirmations (Level 2 and Level 3) | Affirming Official's time and internal governance effort | Recurring, annually | Two affirmations per cycle under 32 CFR 170.22(b)(4), one for each level, and the evidence kept current between assessments. |
Why engineering to SP 800-172 is most of the bill
The engineering lines are the largest part of Level 3 cost because the 24 Level 3 requirements require capabilities, not documents. Most of the Level 3 requirements ask an organization to run something: a security operations center that operates 24/7 with allowance for remote or on-call staff (IR.L3-3.6.1e), and a cyber incident response team that can be deployed within 24 hours (IR.L3-3.6.2e). Threat hunting, isolation of specialized assets, and software integrity checks follow the same pattern. Each one needs tooling, logging pipelines, identity design, network changes, staffing or contracted coverage, and a body of evidence that proves it works. The DoD's 2024 CMMC final rule estimated nonrecurring and recurring engineering lines per entity for both small and other-than-small companies, and those lines dwarf the assessment fees. Confirm which of the 24 requirements apply to your environment and how each one maps to a named system before you accept any engineering estimate.
Scope is the first decision that moves the number. Level 3 applies to the systems in the Level 3 scope, so the cost depends on how many systems, enclaves and specialized assets fall inside that boundary. A narrower boundary means fewer monitored endpoints, fewer engineered controls and less evidence to produce. Ask your program office or contracting officer to confirm which programs and systems require Level 3, then document the boundary in the system security plan before requesting quotes. Scope also drives the recurring side: every system in scope must pass the Level 3 certification assessment every three years, and the affirmations that follow are tied to that same boundary.
Ownership is split, and the split should appear in every quote. Your organization owns its controls, accepts the risk and signs the affirmations. An implementation partner such as DeployOpen can plan, deploy and document self-hosted open-source platforms inside your own cloud accounts or data centers, and can prepare systems and evidence for assessment. Only independent assessors issue results: C3PAOs perform the Level 2 certification assessment, and DCMA DIBCAC performs the Level 3 assessment. DeployOpen does not issue reports or certificates. When you compare proposals, ask each provider which deliverables are engineering work, which are evidence preparation and which, if any, are assessment support, and get the scope, deliverables and timeline in writing before work starts.
What moves the Level 3 number up or down
The DoD estimates for Level 3 are averages, and the number a contractor actually pays depends on a handful of decisions it controls. Each card below names one of those decisions, what it changes, and what to check before asking for a quote.
Scope of Level 3 systems
The Level 3 boundary decides how many systems must meet the 24 SP 800-172 requirements, which is usually the largest driver of engineering cost. Every system, enclave, or service that falls inside the Level 3 scope must be implemented and later assessed, so a narrow boundary with clear segmentation costs far less than one that pulls in corporate IT. Ask your assessor-facing advisor to show the scoping diagram and list each asset in it, and confirm which systems are out of scope and why.
In-house or outsourced SOC coverage
Level 3 requires a security operations center that operates 24/7, and staffing that model is one of the largest recurring cost decisions. An in-house team carries salaries for round-the-clock coverage, while a remote or on-call model shifts part of that cost to a provider but must still meet the 24/7 requirement and the 24-hour incident response deployment expectation. Ask how the provider staffs nights and weekends, how quickly on-call staff respond, and who holds the evidence of monitoring.
Existing Level 2 maturity
Level 3 builds on Level 2, and a Level 2 certification assessment must be passed first. An organization with mature, well-documented Level 2 controls starts Level 3 engineering with fewer gaps, while one that has not yet closed Level 2 gaps must pay for that work before any Level 3 work begins. Ask for the current Level 2 gap list, the open plan of action items, and the dates each item is expected to close.
Third-party and cloud services in scope
Each external service that stores, processes, or transmits Level 3 data or supports Level 3 security functions can enlarge the scope. Managed monitoring, cloud platforms, and specialized tools each need a documented responsibility split and, where required, evidence from the provider. Confirm which providers are in scope, whether they are FedRAMP-authorized where the rule requires it, and whether their contracts give you the logs and reports an assessor will ask for.
Evidence maturity
Assessors accept only final evidence, not drafts, and a requirement counts as met only when its applicable objectives are satisfied with that evidence. Organizations that already produce logs, change records, test reports, and signed plans on a routine basis spend less on rework than those that must build evidence trails after the fact. Ask the advisor how each Level 3 requirement will be evidenced, who signs off on each artifact, and how long records are kept.
Number of systems under DIBCAC review
DCMA DIBCAC repeats its Level 3 certification assessment every three years for all systems in the Level 3 scope, and each additional system adds assessment preparation and review time. Consolidating Level 3 functions into fewer, well-controlled systems reduces both the engineering effort and the evidence that DIBCAC must examine. Confirm how many systems are in scope, which of them DIBCAC will review, and whether any can be removed from the boundary before the assessment.
The three-year cycle that keeps Level 3 active
Level 3 status is not a one-time purchase. Under 32 CFR 170.18, a Level 3 certification assessment by DCMA DIBCAC must be repeated every three years for all systems in the Level 3 scope. Because Level 2 is a prerequisite, a new Level 2 certification assessment by a C3PAO is also required on the same three-year rhythm. Organizations should map both expiry dates against their contract calendar now, and confirm with their contracting officer which systems sit in the Level 3 scope, since that scope drives the size of each reassessment.
Between assessments, 32 CFR 170.22(b)(4) requires a Level 3 contractor to affirm annually both its Level 2 (C3PAO) status and its Level 3 (DIBCAC) status. The two affirmations are needed because the C3PAO and DIBCAC check different requirements, so neither result covers the other. This is why the DoD's cost figures include recurring affirmation work. The DoD's 2024 CMMC final rule estimated $44,445 over three years for an other-than-small entity's Level 3 DIBCAC support, including two annual affirmations, and $12,802 for a small entity. For Level 2, the same rule estimated $117,768 and $104,670 over three years, including two annual affirmations. These are three-year totals, so they carry the initial assessment and the two affirmations together.
Budget for the cycle, not the first assessment. The recurring items are the Level 2 and Level 3 reassessments, the annual affirmations, the upkeep of the Level 3 engineering controls (the SOC, incident response and penetration testing work described in the sibling requirements section), and the internal labor to keep evidence current. Ask any consultant or implementation partner to price the upkeep separately from the build. Before signing, confirm with the Department of War which phase dates and assessment rules apply at the time of your award, since the 13 July 2026 suspension of CMMC Phase II changed the timing for Level 2 certification requirements.
Small versus other-than-small entity estimates
The DoD's 2024 CMMC final rule estimated Level 3 costs for a small entity at a lower level than for a larger company, mainly because the engineering work to implement the SP 800-172 requirements is smaller. The estimate covers the one-time build, the recurring engineering that continues each year, and the government-side cost of the DIBCAC assessment. It also includes the Level 2 certification underneath, because the rule counts that assessment as part of the total cost of Level 3.
- Nonrecurring engineering: The rule estimated $2,700,000 per entity to implement the Level 3 requirements for the first time.
- Recurring engineering: The rule estimated $490,000 per entity each year to keep those controls operating and current.
- DIBCAC support: The rule estimated $9,050 per entity to support the DIBCAC assessment.
- Level 2 C3PAO cost: The rule estimated $101,752 for a Level 2 certification assessment plus initial affirmation, which sits underneath Level 3.
- Three-year total: The rule estimated $12,802 for DIBCAC support over three years, including two annual affirmations, and $104,670 for the Level 2 C3PAO assessment over the same period.
Before you rely on these numbers, confirm how many systems and sites your Level 3 scope covers, since the engineering estimate assumes a particular scope. Ask an assessor or your contracting office which entity size applies to your company.
The DoD's 2024 CMMC final rule estimated Level 3 costs for an other-than-small entity at a much higher level. The gap comes from the size of the environment that must meet the Level 3 requirements, including the monitoring, incident response and specialized asset work. The same structure applies, with one-time engineering, recurring engineering, DIBCAC support and the Level 2 C3PAO assessment, but each component is larger.
- Nonrecurring engineering: The rule estimated $21,100,000 per entity for the first-time implementation of the Level 3 requirements.
- Recurring engineering: The rule estimated $4,120,000 per entity each year to maintain the Level 3 controls.
- DIBCAC support: The rule estimated $39,021 per entity to support the DIBCAC assessment and initial affirmation.
- Level 2 C3PAO cost: The rule estimated $112,345 for a Level 2 certification assessment plus initial affirmation, which must be in place before Level 3.
- Three-year total: The rule estimated $44,445 for DIBCAC support over three years, including two annual affirmations, and $117,768 for the Level 2 C3PAO assessment over the same period.
Compare the engineering estimate with the number of security tools, logging sources and specialized systems in your environment. Ask whether the figure includes operating staff, outside monitoring services and the cost of replacing equipment that cannot meet the requirements.
These are estimates from a federal rulemaking, not quotes, and they do not include every cost your organization will bear. The rule itself notes that Level 3 is expected to affect only a small subset of the defense industrial base, so the figures describe a typical cost profile rather than your own. Use the two tabs as a benchmark, then build your own estimate from the scope you have written down.
- Engineering versus assessment: Engineering is the largest component and is paid to your own staff or outside firms. The DIBCAC and C3PAO fees are paid to assessors.
- One-time versus recurring: Nonrecurring engineering is paid once, while recurring engineering and affirmations continue for the life of the Level 3 status.
- Three-year view: The three-year totals include two annual affirmations, so they show the cost of one full certification cycle.
- What is missing: Hardware, cloud consumption, licenses and internal labor may fall outside these estimates, so confirm them separately.
- Quote questions: Ask any provider to state which SP 800-172 requirements, systems and sites its price covers.
Check your scope against the Level 3 requirements and the DIBCAC process before you request a quote, because a narrower or broader scope changes every line above.
How a Level 3 cost plan gets built, step by step
The sequence turns an undefined Level 3 scope into a costed plan that separates one-time engineering from recurring assessment and affirmation spending, so the organization can ask for quotes against the same boundary.
Define the Level 3 assessment boundary
The organization, with its program office and security lead, identifies which systems, enclaves, facilities and personnel handle CUI or support the Level 3 program, and records them as the proposed scope. Level 3 covers all systems in its scope, so an unclear boundary makes every later estimate unreliable. Output: a signed scope statement with a system inventory and data-flow diagram. You know it is done when each in-scope asset has a named owner and a reason for inclusion. Ask any implementation partner to price against this written boundary, not a general description.
Confirm the Level 2 baseline inside scope
Before Level 3 is costed, the team checks the current state of the 110 Level 2 requirements against NIST SP 800-171A assessment objectives for every in-scope system, since Level 2 compliance is a prerequisite for Level 3. Gaps are recorded per requirement ID, and existing evidence is tested for final form rather than drafts. Output: a Level 2 gap register with an owner for each gap. You know it is done when every Level 2 requirement is marked met, partially met or not met with cited evidence. Any Level 2 gap becomes a cost item before Level 3 engineering begins.
Run gap analysis against the SP 800-172 requirements
The team maps the 24 Level 3 requirements, with their DoD-assigned parameters, onto the in-scope environment and compares them with what the organization already runs. Typical gaps include 24/7 security operations coverage, incident response deployable within 24 hours, threat hunting, and software integrity controls. Output: a Level 3 gap register separating requirements the organization already meets, requirements it can meet by extending existing tools, and requirements that need new capability. You know it is done when each requirement has a status and a named owner. Confirm the parameters with the DoD program office rather than assuming them.
Estimate nonrecurring and recurring engineering
Each gap from the register is converted into a build or change item, with labor, tooling, licensing, hosting and integration estimated separately. Items that will be built once, such as new logging pipelines or segmentation, are placed in a one-time column, while staffing for monitoring, testing and tool subscriptions go in a recurring column. Output: a two-column engineering estimate tied to requirement IDs. You know it is done when every line can be traced to a gap and a cost driver. The DoD's 2024 final rule estimated engineering for an other-than-small entity at $21,100,000 nonrecurring and $4,120,000 recurring per entity, and for a small entity at $2,700,000 and $490,000. Those figures are government averages, so use them only to sanity-check your own build.
Price assessment support and the Level 2 C3PAO assessment
The plan adds the cost of assessment support, meaning the work of preparing evidence and the systems for a DIBCAC assessment, and the cost of a Level 2 certification assessment by a C3PAO, which the Level 3 total includes. Assessment support is typically a separate scope from engineering and should be quoted separately. Output: an assessment cost schedule listing the C3PAO work, DIBCAC support and affirmation effort. You know it is done when each assessment line names who is paid and for what. The DoD's 2024 final rule estimated the Level 2 C3PAO assessment plus initial affirmation at $112,345 for an other-than-small entity and $101,752 for a small entity, and the DIBCAC support at $39,021 and $9,050 respectively.
Plan the recurring assessment and affirmation calendar
The team builds a calendar showing when each recurring cost falls due. Under 32 CFR 170.18, the Level 3 certification assessment must be repeated every three years, and a new Level 2 C3PAO assessment is also required in that cycle to keep Level 3 status. Under 32 CFR 170.22(b)(4), Level 3 contractors affirm annually both their Level 2 and Level 3 status. Output: a three-year cost timeline that places each assessment, affirmation and recurring engineering line on a date. You know it is done when the calendar shows both annual affirmations and the three-year reassessments. Ask the C3PAO and DIBCAC contacts to confirm current scheduling and fees in writing before the budget is approved.
Assemble the quote request and approve the budget
The plan is packaged into a written scope and a cost summary that separates one-time engineering, recurring engineering, assessment support, C3PAO and DIBCAC fees, and affirmation work. Each vendor or implementation partner is asked to quote against the same boundary, requirement IDs and calendar, so proposals can be compared line by line. Output: a quote request and a signed budget that the accountable executive approves. You know it is done when every bidder returns a quote mapped to the same gap register. Fixed-scope written agreements make these comparisons easier, and any quote that cannot map to requirement IDs should be questioned.
Who owns controls, who prepares evidence, and who assesses
The organization that holds the contract owns its controls and signs the affirmation. That point decides how Level 3 cost should be read: the spend on outside help buys preparation, not a verdict. An implementation partner can design, build, configure and document the systems that carry the Level 3 requirements, and it can assemble the evidence an assessor will examine. It cannot issue a result, and it cannot be the party that certifies its own work. Before accepting any quote, ask the provider to state in writing which tasks it performs, which decisions remain with your security leadership, and who signs the affirmation on your behalf.
Assessment is split by level. A Level 2 certification assessment is performed by a C3PAO, a third-party assessment organization. C3PAOs are authorized or accredited by the CMMC Accreditation Body, which is currently The Cyber AB. You can check a C3PAO's standing through The Cyber AB's assessment and certification guidance before you sign. A Level 3 certification assessment is performed by DCMA DIBCAC, a government assessor, not by a private firm. Because the two bodies check different requirements, a Level 3 holder must keep both statuses current, and no single assessor can stand in for the other.
The practical consequence is a separation of duties you should write down. Your internal owners keep accountability for each control, the system security plan and the evidence trail. The implementation partner's work product is reviewed by your own staff before it reaches an assessor, and the assessor's findings are not negotiated by the partner. Confirm who holds the assessment relationship, who receives assessor questions, and who keeps the records that show a control worked over time. Those answers determine how much of the cost is preparation you can reuse and how much is verification you must pay an independent body to perform.
CMMC Level 3 cost questions buyers ask
Do DoD's Level 3 cost estimates apply to my company?
They apply only if your company falls into one of the two size categories DoD used, and they are estimates, not quotes. The 2024 CMMC final rule estimated costs separately for a small entity and for an other-than-small entity, and it estimated nonrecurring engineering, recurring engineering and the DIBCAC assessment support cost for each. Your actual figure depends on how many systems fall inside Level 3 scope, how much of the 24 SP 800-172 requirements you already meet, and whether you use cloud services or internal staff to run them. Treat the published numbers as a starting baseline and ask any implementation partner to price your own written scope against them.
Is the Level 2 certification cost included in the Level 3 estimate?
Yes, the cost of Level 3 includes Level 2, but the Level 2 portion is not the whole story. The final rule notes that the total cost of Level 3 covers the Level 2 certification assessment by a C3PAO as well as the cost to implement and assess the Level 3 requirements. For an other-than-small entity, the rule estimated a Level 2 C3PAO certification assessment plus initial affirmation at $112,345, and $101,752 for a small entity. Those figures sit underneath the Level 3 engineering and DIBCAC costs, so budget for both layers and confirm with your sponsor which Level 2 scope must be assessed first.
How often do Level 3 costs recur?
Some costs are one time and others repeat for as long as you hold Level 3 status. The rule separates nonrecurring engineering from recurring engineering, and it adds DIBCAC support and affirmations on a cycle. Under 32 CFR 170.18, the Level 3 certification assessment must be repeated every three years for all systems in scope, and a new Level 2 C3PAO assessment is also required in that window. Under 32 CFR 170.22(b)(4), you affirm annually for both Level 2 and Level 3 status. Ask every quote to show one-time and recurring items separately, including the three-year cycle.
How much work does Level 3 need from our internal staff?
Internal staff must own the decisions, the evidence and the daily operation, even when outside help does the build. Level 3 requires a 24/7 security operations capability, with allowance for remote or on-call staff (IR.L3-3.6.1e), and an incident response team that can be deployed within 24 hours (IR.L3-3.6.2e). Named internal owners are needed for the system security plan, the risk assessment, change control, the plan of action items and the annual affirmations. Ask a partner to name which tasks they perform, which your team performs, and how many hours each recurring activity requires, and confirm that in the written scope.
Can we run a Level 3 program in-house instead of hiring help?
You can, but the decision turns on whether your team can build, operate and evidence the requirements at the required standard. The organization owns its controls in every case. An implementation partner can prepare systems, documentation and evidence, and it can build or harden the platforms that run them, but it does not issue assessment results. Only DCMA DIBCAC can perform the Level 3 certification assessment and only a C3PAO can perform the Level 2 assessment. In-house teams should compare the engineering and staffing cost against the rule's estimates and against the outside scope, and should confirm that the people they name can meet the 24/7 and incident response expectations.
How do we confirm the current CMMC status after the Phase II suspension?
Confirm the status directly with the Department of War and your contracting officer, because the schedule changed in 2026. On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026, and started a 60-day review by a CMMC Reform Task Force. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Since the eCFR text of 32 CFR 170.3(e) still shows the original four-phase schedule, check the DoW CIO page and the suspension notice before you commit budget, and ask your sponsor in writing which Level 2 or Level 3 requirements apply to your contracts.
How DeployOpen scopes Level 3 engineering and prepares evidence
DeployOpen helps defense contractors estimate and plan the engineering side of CMMC Level 3 cost by scoping the self-hosted open-source platforms that carry the work inside the client's own infrastructure. We prepare systems and evidence for assessment, while the organization owns its controls and DCMA DIBCAC and C3PAO assessors issue the findings.
How we scope
- We map the systems that hold CUI and fall inside the Level 3 assessment boundary, so engineering effort follows the real system scope.
- We separate one-time build work from recurring operations work, so the written scope shows which costs recur each cycle.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before any work starts, and a quote follows from that scope.
How we build
- We plan and deploy self-hosted open-source platforms for logging, detection, vulnerability management and configuration baselines inside your own cloud accounts or data centers.
- We integrate those platforms with existing identity, network and ticketing systems so the evidence they generate reflects how the program actually runs.
- We test the built controls against the assessment objectives in NIST SP 800-172A and document where gaps remain before an assessor arrives.
How we hand over
- We deliver configuration records, runbooks, system documentation and evidence packages that your team can maintain after the engagement ends.
- We explain which evidence sources an assessor will review and confirm with your team how each one is retained and accessed.
- We document ownership for each control so the organization knows who must answer for it during Level 2 and Level 3 affirmations.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, which can cover recurring work between assessment cycles.
- We can help refresh evidence and documentation ahead of each three-year Level 3 certification assessment and each annual affirmation, as agreed in scope.
- Ask any provider to confirm in writing which recurring tasks, response times and deliverables are included before you sign.
