What does CMMC Level 2 cost for a defense contractor?
The 2024 CMMC final rule (32 CFR Part 170) estimated a Level 2 self-assessment plus initial affirmation at $43,403 per assessment for an other-than-small entity and $34,277 for a small entity, with three-year totals of $48,827 and $37,196. For a Level 2 C3PAO certification assessment plus initial affirmation, the same rule estimated $112,345 per assessment for an other-than-small entity and $101,752 for a small entity, with three-year totals of $117,768 and $104,670. The rule priced the C3PAO engagement itself at $52,056 for the other-than-small case and $31,234 for the small case, and the rest of each certification figure is the contractor's own labor and, for small entities, external service provider hours. Treat these as average assessment effort, not current market prices. Your C3PAO quote will reflect market supply, your network size and your scope.
These figures cover assessment and affirmation activity only. The rule excludes the cost to implement and maintain the 110 NIST SP 800-171 Rev. 2 requirements and any remediation of a plan of action, because DFARS 252.204-7012 already required implementation. The estimates also assume the contractor passes on the first attempt. The largest real costs usually sit outside the estimate: engineering and licensing for MFA, logging, encryption, boundary protection and endpoint controls, plus the documentation, staff time and any managed services needed to keep those controls running. Scope drives the rest. The number of CUI assets, how many enclaves you maintain, which external service providers touch CUI, and whether you store CUI in a FedRAMP Moderate or equivalent cloud all change effort materially. Ask any provider to price each asset category and each ESP separately so you can see what a smaller boundary would save.
The Department of War suspended CMMC Phase II on 13 July 2026, which had paused the requirement for Level 2 C3PAO certification on applicable contracts. Phase I obligations remain in place, including self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 duties, so the implementation spending above is still required whichever assessment path a contract later demands. Before you commit to a certification budget, confirm with your contracting officer which level and assessment type your contracts currently require. An implementation partner such as DeployOpen can plan, configure and document the systems and evidence your controls need, but your organization owns those controls and signs the affirmation. Only a C3PAO for certification, or your own self-assessment and affirmation for Level 2 self-assessment, produces the compliance result.
Which costs make up a CMMC Level 2 budget
This table compares each cost component of a CMMC Level 2 budget by who is paid, whether it is one-time or recurring, and what moves it up or down. Figures from the DoD's 2024 final rule show the assessment portion only, so the remaining rows need quotes from your own scope.
| Cost component | Who is paid | One-time or recurring | What drives it up or down |
|---|---|---|---|
| C3PAO engagement (DoD estimate) | C3PAO, which the contractor hires and pays. The 2024 final rule priced it at $52,056 for an other-than-small entity and $31,234 for a small entity | Per assessment, repeated every three years | Team size, assessment hours, number of assets in scope, and market pricing, which the rule says will be set by supply and demand |
| Internal labor for assessment preparation | Your own staff, and the rule's estimate counts this inside the $112,345 and $101,752 certification totals | Recurring at each assessment cycle | Number of in-scope systems, documentation maturity, and how many staff must gather and review evidence |
| External service provider hours | Managed service providers, cloud or IT providers, and consultants. The rule assumes small entities will outsource IT and cybersecurity | Recurring if the service continues, plus one-time setup | Whether the provider is in scope, whether it supplies a FedRAMP Moderate or equivalent cloud service, and how much evidence it must supply |
| Implementing the 110 NIST SP 800-171 Rev. 2 requirements | Your staff, system integrators, tool vendors and implementation partners. Excluded from DoD's estimates | Mostly one-time build, with ongoing operation | Current gap against the 110 requirements, system architecture, tooling choices, and whether an enclave is built |
| Remediating POA&M items | Your staff or contractors. Excluded from DoD's estimates | One-time per item, within a 180-day closeout window | Number of open items, the 88-point threshold, and whether a single gap blocks Conditional status |
| Cloud or enclave services | Cloud providers, including FedRAMP Moderate or equivalent services for CUI, and enclave hosting providers | Recurring subscription or hosting fees | Choice between a cloud service and on-premises systems, number of users, and how much of the environment is scoped in |
| Affirmation and SPRS administration | Your senior Affirming Official, which is internal time. The rule requires an affirmation after each assessment and annually after that | Annual, after the initial assessment | Number of affirmations per cycle and the internal process used to sign and track them |
| Optional consultant or implementation partner work | Registered Practitioner Organizations, consultants or implementation partners you choose to hire. Not required by the rule | Often one-time readiness work, with optional retainers | Scope of help purchased, whether it is fixed-scope, and how much internal staff time is shifted to the partner |
What the CMMC Level 2 estimates leave out
The published DoD totals cover assessment and affirmation work and nothing else. The 2024 final rule's Level 2 estimates exclude the cost to implement or maintain the NIST SP 800-171 Rev. 2 requirements, and they exclude the cost to remediate a plan of action. The rule's reasoning is that DFARS 252.204-7012 already required implementation by 31 December 2017, so the estimates treat those controls as existing. They also assume the contractor passes on the first attempt. For a company whose controls are still being built, that assumption is the largest gap in the numbers.
The practical effect is that a company with unfinished controls will spend well above the published figures. Before using any estimate in a budget, check the control baseline in your own environment: which of the 110 requirements are fully implemented, which are partly implemented, and which exist only as intent. Then check document maturity. Assessors need final system security plans, policies and evidence, and drafts do not count. Ask whether your team has already produced final artifacts for each requirement, or whether those artifacts still need to be written, reviewed and tested.
Also plan for retest and remediation. If an assessment finds gaps, the time and labor to fix them, re-collect evidence and prepare for a second assessment are real costs that the estimate does not include. Estimate how likely a retest is by running an internal mock assessment against NIST SP 800-171A objectives and scoring the result honestly. Any quote from an implementation partner or C3PAO should state whether it covers control build-out, documentation, mock assessment and a re-evaluation, or only the assessment itself.
What makes CMMC Level 2 cost more or less
Most of what a CMMC Level 2 assessment costs is set before an assessor arrives, by how many systems hold CUI, how large the network around them is, and how much of the environment is documented and proven. The cards below cover the drivers you can shape and the questions to put to any provider quoting the work.
CUI assets set the assessment load
Under 32 CFR 170.19(c), CUI assets are assessed against all Level 2 requirements, so every system, endpoint, and device that stores, processes, or transmits CUI carries the full load. Shrinking that list is the most direct cost lever. Before quoting, ask for an asset inventory that labels each asset by category and names which CUI flows reach it. A quote built on an unreviewed inventory usually changes after the first walkthrough.
Network size and complexity
The 2024 final rule notes that the size and complexity of the network inside scope affect cost. A flat network with many segments, legacy servers, and shared administrative accounts takes longer to document and test than a segmented one with a clear boundary. Ask the provider how it will count systems, subnets, and administrators, and whether the quote assumes a single boundary or several.
Enclaves and VDI reduce scope
Placing CUI work in a dedicated enclave or a virtual desktop environment can confine the assessed footprint to a smaller set of systems, while the rest of the business stays outside the CUI boundary. The saving depends on whether the separation is real and documented, because the assessor will test the boundary, not the diagram. Ask whether the quote includes designing the enclave and proving the separation, not just building it.
External service providers and cloud
A cloud service that stores or processes CUI must be FedRAMP Authorized at the Moderate baseline or higher, or meet equivalent requirements, under 32 CFR 170.17(c)(5) and (6). A non-cloud external service provider is assessed within your scope. Each provider adds documentation, responsibility matrices, and sometimes its own evidence requests. Ask which providers are in scope, who holds their evidence, and whether the quote covers verifying their status.
Specialized assets documented, not assessed
Under 32 CFR 170.19(c), specialized assets such as IoT, OT, and test equipment are documented but not assessed. Documenting them still takes effort, and mixing them into CUI systems pulls them into full scope. Ask the provider to confirm in writing which assets are specialized, how they are separated from CUI assets, and what documentation the quote includes for each.
Evidence maturity
Assessors accept only final evidence, not drafts, so the cost of work that is not yet written, reviewed, and retained rises quickly. Policies, the system security plan, and logs that exist but were never reviewed each need rework before an assessment. Ask whether the quote starts from current artifacts or includes building them, and what the provider will charge if the first attempt does not pass.
How CMMC Level 2 cost differs by company size
The DoD's 2024 final rule estimated a Level 2 self-assessment plus initial affirmation at $43,403 per assessment for an other-than-small entity, with a three-year total of $48,827 across one assessment cycle and two annual affirmations. For a Level 2 certification assessment plus initial affirmation, the same rule estimated $112,345 per assessment, with a three-year total of $117,768 including two annual affirmations. Within that certification figure, the rule priced the C3PAO engagement itself at $52,056, based on a 5-person team working 200 hours at $260.28 per hour.
- Who is paid for what: The C3PAO is paid for the assessment team's hours. The rest of the estimate is the contractor's own labor to prepare, support, report and affirm, and the rule assumes larger entities mostly use their own staff for this work.
- One-time and recurring costs: The assessment and initial affirmation are one-time events in each cycle. Annual affirmations and the next assessment at the three-year mark recur.
- What drives the number up: Network size and the number of in-scope assets, as the rule notes that network complexity affects cost.
- What the rule assumes: Contractors pass on the first attempt and implementation of NIST SP 800-171 is excluded from the figures.
- What to ask for in a quote: A breakdown of C3PAO hours, team size, and the contractor's internal labor estimate, so you can compare it to the published averages.
Check whether your own asset inventory and scope match the scale the rule assumed before using these figures for budgeting.
The same 2024 final rule estimated a Level 2 self-assessment plus initial affirmation at $34,277 per assessment for a small entity, with a three-year total of $37,196. The certification estimate for a small entity was $101,752 per assessment, with a three-year total of $104,670 including two annual affirmations. The C3PAO engagement for a small entity was priced at $31,234, based on a 3-person team working 120 hours. The rest of the certification estimate covers the contractor's own labor and external service provider hours.
- More outside help assumed: The rule assumes small entities are likely to outsource IT and cybersecurity to an external service provider, so a larger share of the estimate sits in provider hours rather than internal staff.
- Consulting and implementation: The rule also assumes contractors of both sizes are likely to seek consulting or implementation help, which the estimate does not fully price.
- Smaller C3PAO engagement: The 3-person, 120-hour engagement reflects a smaller environment, but the actual scope depends on your asset categories and enclave design.
- Recurring costs: Annual affirmations and the three-year reassessment recur, and they apply the same way regardless of company size.
- What to confirm: Which tasks your external service provider covers and whether its responsibility matrix supports the controls assessors will test.
Confirm with each provider and C3PAO which hours they expect to bill, since the split between internal labor and outside hours will shape your actual cost.
Recurring CMMC Level 2 costs over the three-year cycle
A Level 2 assessment does not end with the certificate or the self-assessment score. Under 32 CFR 170.16 and 170.17, a new Level 2 assessment, self or C3PAO, is required every three years. Between assessments, a senior Affirming Official must affirm continuing compliance in SPRS after each assessment and then annually under 32 CFR 170.22. If that annual affirmation is missed, the assessment lapses, so the affirmation itself is a recurring cost with a named owner. Budget the next assessment as a future expense from the first day, not as a one-time event.
The rule's three-year totals cover one assessment cycle: the initial self-assessment or certification assessment, the initial affirmation, and two annual affirmations. For a self-assessment, the DoD's 2024 final rule estimated $48,827 for an other-than-small entity and $37,196 for a small entity. For C3PAO certification, it estimated $117,768 and $104,670. Those totals exclude the cost to implement or maintain the NIST SP 800-171 Rev. 2 requirements, so the recurring spend on security operations is not in them. They also assume the contractor passes on the first attempt, so a re-assessment after a failed cycle is an additional cost.
The recurring items that sit outside those totals are the ones to plan for each year. They include internal labor to keep evidence current, such as access reviews, change tickets, training records and System Security Plan updates; vulnerability scanning and log retention; change control that keeps the baseline accurate; closure of POA&M items within the 180-day closeout window; and subscriptions for cloud or enclave services that hold CUI. Ask a provider or consultant to quote these as annual line items, and confirm with your C3PAO or self-assessment lead which artifacts must be refreshed before each affirmation.
How the July 2026 Phase II suspension changes CMMC Level 2 budgets
The suspension changes when a C3PAO certification must be bought, not what the controls cost to build. On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start on 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. The Department also started a 60-day review by a CMMC Reform Task Force. Phase I self-assessments, SPRS postings, annual affirmations and the obligations under DFARS 252.204-7012 remain in place. The DoW CIO "About CMMC" page says implementation may only require self-assessments at Levels 1 and 2 for now, but the eCFR text of 32 CFR 170.3(e) still shows the original four-phase schedule. Treat the eCFR as out of date on timing and confirm the current requirement in writing.
Confirm the requirement in each contract and solicitation before you set a certification budget. Ask the contracting officer or prime which assessment type applies, whether a self-assessment is accepted for now, and whether a certification will be required later in the period of performance. Record the answer with the contract number and date, because the review could change it again. If a prime asks for a C3PAO certificate, the certification line in your budget is the one that moves, and the figures in the 2024 final rule are the only researched basis for it.
Budget for the controls regardless of timing. The cost of implementing the 110 NIST SP 800-171 Rev. 2 requirements, documenting them and producing final evidence does not depend on whether the assessment is self-performed or certified. The 2024 final rule excluded that implementation cost from its estimates for this reason, and DFARS 252.204-7012 already required implementation. A delay therefore buys time to plan, not savings to keep. Use the pause to finish scoping, close gaps and collect evidence, so that a self-assessment or a later certification starts from final documents rather than drafts.
Who pays for each part of a CMMC Level 2 project
The organization owns its controls, its system security plan and its evidence, and no outside party can take that ownership over. Internal staff carry most of the recurring cost because they run access reviews, log reviews, patching, change control and incident drills every month, not only during an assessment. The 2024 CMMC final rule's estimates for assessment and affirmation are largely the contractor's own labor, so the internal share is usually the largest line in the budget.
- Accountable executive: A senior Affirming Official must affirm continuing compliance in SPRS, which is a role the company must fill itself.
- Operations staff: Administrators maintain accounts, configurations, backups and endpoint settings that the controls depend on.
- Security and compliance staff: They own the SSP, the POA&M, the risk assessment and the evidence library.
- Application and business owners: They approve scope decisions and confirm which users and data flows touch CUI.
- Training time: Awareness and role-based training are recurring costs for every new hire and contractor.
Before you request quotes, confirm with each vendor and partner which of these tasks they will perform and which your staff must keep.
An implementation partner is paid to prepare systems, documents and evidence so the organization can meet the NIST SP 800-171 Rev. 2 requirements that Level 2 uses. This work is usually the largest one-time cost in a project, because it covers configuration, hardening, logging, identity, encryption and documentation that the 2024 CMMC final rule excluded from its assessment estimates. DeployOpen works this way: it plans, implements, integrates and documents self-hosted open-source platforms inside the client's own infrastructure, and it does not issue any assessment result.
- Scoping and gap analysis: Mapping assets to the five asset categories and identifying which requirements are unmet.
- Build and hardening: Deploying and configuring the in-scope systems, enclaves or virtual desktops.
- Documentation: Drafting the SSP, policies and procedures, which the organization must review and approve.
- Evidence preparation: Setting up logs, scans, baselines and records that assessors can test.
- Mock assessment support: Helping the organization score itself against the assessment objectives before the real assessment.
Ask for a written, fixed scope with deliverables and a responsibility matrix that states which controls the partner builds and which the organization operates. Ask how the partner will avoid any role that would bar its staff from later assessing the same organization.
The outcome of a Level 2 assessment comes only from an independent body. For a certification assessment, the contractor hires and pays a C3PAO authorized or accredited by The Cyber AB, and the C3PAO's team tests the environment and reports the result. For a self-assessment, the organization performs the assessment itself and a senior Affirming Official makes the affirmation in SPRS. The 2024 final rule priced the C3PAO engagement itself at $52,056 for an other-than-small entity (a 5-person team, 200 hours at $260.28 per hour) and $31,234 for a small entity (a 3-person team, 120 hours).
- C3PAO fee: The engagement fee is the assessor's own price, set by market supply and demand, so it may differ from the rule's average.
- Recurring affirmation: A senior official must affirm after every assessment and annually after that.
- Independence rule: The Cyber AB says certified assessors who took part in any capacity with an organization preparing for CMMC cannot serve on that organization's assessment team.
- Re-assessment: A new Level 2 assessment is required every three years.
- Quote questions: Ask whether the fee covers report and POA&M closeout work, travel and re-evaluation.
Before engaging any assessor, verify its authorization on The Cyber AB Marketplace and confirm in writing that its team has no preparation role for your organization.
CMMC Level 2 cost questions buyers ask
Does a CMMC Level 2 self-assessment cost less than a C3PAO certification?
Yes, on the figures DoD published, but the gap covers assessment activity only. The DoD's 2024 final rule estimated a Level 2 self-assessment plus initial affirmation at $43,403 per assessment for an other-than-small entity and $34,277 for a small entity, with three-year totals of $48,827 and $37,196. It estimated a C3PAO certification assessment plus initial affirmation at $112,345 for an other-than-small entity and $101,752 for a small entity, with three-year totals of $117,768 and $104,670. Within the certification estimate, the C3PAO engagement itself was priced at $52,056 for other-than-small entities and $31,234 for small entities. The rest is your own labor and, for small entities, external service provider hours. Self-assessments are not free of preparation work, and the certification path adds a paid third-party assessor.
Are the DoD cost estimates enough to build a CMMC budget?
No. The estimates cover assessment and affirmation activities only. The DoD's 2024 final rule excluded the cost to implement or maintain the NIST SP 800-171 Rev. 2 requirements and the cost to remediate a plan of action, because DFARS 252.204-7012 already required implementation by 31 December 2017. The estimates also assume the contractor passes on the first attempt, and the rule says they are average assessment efforts rather than actual C3PAO market prices. Treat the published figures as a floor for the assessment line item. Your real budget must add the security work needed to meet all 110 requirements, the cost of any gaps, and a reserve for a failed first attempt. Confirm current assessor pricing directly with C3PAOs, since market supply and demand set those rates.
How much internal effort does a CMMC Level 2 assessment take?
The internal effort is usually larger than the external invoice, and it falls on the same few people. Expect staff from IT, security, HR, facilities and contracts to spend time on the system security plan, asset inventories, policies, evidence collection, interviews and the mock assessment. The DoD's 2024 final rule counts the contractor's own labor as the bulk of each certification estimate, but it does not give a per-role breakdown you can copy. Ask a consultant or C3PAO to help you estimate hours from your scope: the number of CUI assets, the number of enclaves, how many external service providers you use and how many policies need rewriting. Those inputs drive effort more than headcount does.
Can an organization complete CMMC Level 2 without outside help?
Many organizations can run a Level 2 self-assessment with internal staff, provided they have people who understand NIST SP 800-171 and the assessment objectives in NIST SP 800-171A. The DoD's 2024 final rule assumed small entities would outsource IT and cybersecurity to an external service provider, and that contractors of both sizes would likely seek consulting or implementation help. Internal teams often struggle with scoping, evidence that is final rather than draft, and the 110 requirements spread across the 14 domains. Certification assessments must be performed by a C3PAO, so you will need an outside assessor regardless of how you prepare. Self-assessment and certification also differ in who signs the affirmation, so confirm which path your contracts require before you decide what to do alone.
Does a CMMC Level 2 engagement require an implementation partner?
No rule requires an implementation partner. The contractor owns its controls and its affirmation. An implementation partner, such as DeployOpen, prepares systems, configurations and evidence on the contractor's own infrastructure, typically under a fixed scope with written deliverables agreed before work starts. Only an independent assessor, which for certification means a C3PAO authorized through The Cyber AB, issues the assessment result. A partner can help with self-hosted open-source platforms that produce logs, access records, configuration baselines and documentation, but the partner cannot assess the organization. The Cyber AB also says certified assessors who took part in preparation cannot serve on that organization's assessment team, so keep preparation and assessment with different firms.
What does the three-year CMMC cycle add to the cost?
The cycle adds recurring work, not a one-time fee. Under 32 CFR 170.16 and 170.17, a new Level 2 assessment is required every three years, whether self or C3PAO. Under 32 CFR 170.22, a senior Affirming Official must affirm continuing compliance in SPRS after each assessment and annually after that, and the assessment lapses if the annual affirmation is not made. The DoD's three-year totals include two annual affirmations. Ongoing costs you should budget for include log retention, periodic access reviews, vulnerability scanning, patching, policy updates, staff training, and the next assessment. Ask whether your platform and monitoring costs will rise as the environment grows, since scope size affects effort.
What should a CMMC Level 2 quote include?
A useful quote states its scope in writing before any price. Ask the provider to list the in-scope asset categories, the enclaves or systems covered, the requirements and domains addressed, and which external service providers are in scope. Then ask for the deliverables: the system security plan, policies, evidence set, responsibility matrices, mock assessment report and handover documentation. Confirm what is one-time and what recurs, who pays for re-testing after a failed attempt, and what happens if scope changes. For a C3PAO, confirm that its authorization is current on The Cyber AB Marketplace and that its fee is separate from any consulting work. DeployOpen does not publish a price list. A quote follows from a written scope, and most engagements are fixed-scope.
How does the Phase II suspension affect CMMC spending?
The suspension changes when certification becomes required, not whether the underlying work is needed. On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. It started a 60-day review by a CMMC Reform Task Force. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. The DoW CIO page says Phase 1 may only require self-assessments at Levels 1 and 2, while the eCFR text still shows the original four-phase schedule. Defer a certification commitment until your contracts and the Task Force outcome are clear, but keep funding the controls, since DFARS 252.204-7012 already applies. Confirm the current requirement with your contracting officer.
How DeployOpen works on this
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure, so the environment that carries CUI is one you can scope, price and evidence. We prepare systems and evidence for an assessment; the organization owns its controls, and only an independent assessor issues a certification.
How we scope
- We agree the CUI boundary, assets and enclaves in writing before any work starts, which is the input that most drives cost.
- The written scope states which asset categories are in, which are documented only, and which are excluded.
- We identify external service providers and list the responsibilities each must evidence for your assessment.
How we build
- We implement and configure in-scope platforms against the NIST SP 800-171 Rev. 2 requirements that CMMC Level 2 incorporates.
- We document system security plan content and control evidence as final artifacts, not drafts, for each in-scope system.
- We test controls against the NIST SP 800-171A assessment objectives and record gaps for remediation or a plan of action where the rules allow.
How we hand over
- You receive configuration baselines, policies, procedures, evidence sets and a remediation log tied to each requirement ID.
- We walk your team through the evidence so staff can answer assessor questions about their own systems.
- Deliverables are fixed in the written scope, and we confirm with you what remains for your own sign-off and affirmation.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, which cover recurring work between assessments.
- Retainers can keep evidence current for the three-year assessment cycle and the annual affirmation, which you still make yourself.
- Quotes follow from the written scope. Ask any provider to itemize one-time and recurring costs, including the assessor's fees.
