What does NIST 800-171 compliance cost for a contractor?
The January 2025 FAR CUI proposed rule estimated first-year labor to implement SP 800-171 Rev. 2 at about $148,200 for a small business (an average of 1,560 hours at $95) and about $543,400 for a business other than a small business (an average of 5,720 hours at $95). The same rule estimated hardware and software at an average of $27,500 in the first year for a small business and $140,000 for a larger one. The CMMC final rule in 32 CFR Part 170 estimated a Level 2 self-assessment plus initial affirmation at $34,277 for a small entity and $43,403 for an other-than-small entity, and a Level 2 C3PAO certification assessment plus affirmation at $101,752 and $112,345. Those CMMC figures exclude the cost to implement SP 800-171 itself, so the two sources answer different parts of the budget. Confirm the current figures in the Federal Register FAR proposal and the CMMC rule before you rely on them.
Government estimates are averages, and your number will depend on your headcount, the number of systems and endpoints that touch CUI, how much of that environment is already documented and monitored, and whether you hold a defense contract. The FAR proposal says implementation time varies with employee count and system complexity, and that some contractors already have staff doing these tasks while others start with no in-house expertise. Recurring costs also differ: the proposal estimated SSP upkeep at 12 hours a year per contractor, and CMMC requires a new Level 2 assessment every three years and an annual affirmation in SPRS. Ask any vendor or partner for a quote that separates one-time setup, hardware and software, SSP maintenance, and recurring assessment support, and that states which CUI systems are in scope.
Your organization owns its controls and the decisions behind them. An implementation partner can plan the work, configure systems, and prepare the policies, logs and records that show the controls operate, but it does not issue results. Only an independent assessor or certification body can issue a CMMC certification or assessment result, and the contracting agency sets the rules for how any other assessment is used. Before you sign, confirm with your contracting officer which revision and assessment path apply to your contract, because the answer determines the scope of the work and the cost you should expect.
Who gets paid for what, and what recurs
This table lists each cost component of NIST SP 800-171 compliance, who is paid for it, whether it is one-time or recurring, and the figures the US Government estimated. Read the supplied figures as regulatory estimates for a typical contractor, not quotes, and use the drivers column to judge where your own spend will land.
| Cost component | Who is paid | One-time or recurring, and what drives it |
|---|---|---|
| Internal staff labor | Your own employees, who are paid through payroll rather than invoiced | Mostly one-time for the first year, then recurring. The FAR CUI proposed rule (January 2025) estimated about 1,560 hours in year one and 1,040 hours a year after for a small business, and about 5,720 hours then 5,200 hours for a business other than a small business, at $95 an hour. Drivers: headcount, system complexity and whether staff already have security skills. |
| Implementation partner | An outside firm you hire to prepare systems, policies, the SSP and evidence, paid under a written scope | Mostly one-time for the build, with optional retainers for upkeep. No supplied fact gives a partner fee. Drivers: number of systems in scope, how far the CUI enclave is already separated, and how much staff work you hand over. Ask for deliverables, hours and exclusions in the quote. |
| Hardware and software | Vendors of endpoints, firewalls, encryption, logging, MFA and backup tools | Both. The FAR CUI proposed rule estimated an average of $27,500 in year one and $5,000 a year after for a small business, and $140,000 then $80,000 for a business other than a small business. Drivers: user count, device types and network complexity, as the rule itself noted. |
| SSP maintenance | Your staff, or a partner under retainer, for updates to the system security plan | Recurring. The FAR CUI proposed rule estimated 12 hours a year per contractor at $95 an hour, and this figure excludes most of the build cost. Drivers: how often systems, vendors and personnel change. |
| CMMC Level 2 self-assessment with affirmation | Your organization for internal assessment effort and the senior official who affirms in SPRS | Recurring every three years for the assessment cycle, with an annual affirmation under 32 CFR 170.22. The CMMC final rule (October 2024) estimated $43,403 for an other-than-small entity and $34,277 for a small entity, including initial affirmation. Drivers: scope size and evidence readiness. |
| CMMC Level 2 C3PAO assessment with affirmation | A certified third-party assessment organization (C3PAO) for the assessment, plus your internal preparation | Recurring every three years, with annual affirmation. The CMMC final rule estimated $112,345 for an other-than-small entity and $101,752 for a small entity. The estimate excludes the cost to implement the SP 800-171 requirements. Drivers: number of assessment objectives and assessor time on site. |
| SP 800-172 enhanced requirements | Only organizations handling CUI for critical programs or high value assets, paid for the same kinds of labor and tools | One-time initial implementation, then recurring at 20 percent a year, as the FAR CUI proposed rule estimated. It estimated $202,500 for a small business with 25 to 50 endpoints and about $2,315,000 for one with 750 to 1,500 endpoints. Confirm with your contracting officer whether this applies to you. |
What makes the cost higher or lower
The Government's estimates show that the same requirements can cost very different amounts depending on the organization's size, its systems and its existing skills. The cards below cover the drivers you can control, and each one ties back to a figure the rulemaking used.
Headcount and employee count
The FAR CUI proposed rule scaled labor with the number of employees, so a larger workforce usually means more accounts, more devices and more people to train and screen. The rule's labor averages for a small business and for a business other than a small business differ by a wide margin in both the first year and later years. Ask any provider to break its quote down by role and hours, and check how many users fall inside the CUI boundary before you accept a per-head price.
Number and complexity of systems
Every information system that stores, processes or transmits CUI, or that can affect its protection, must be inventoried, configured and documented. The rule tied implementation time to system complexity, so a single enclave with standard tooling costs far less to bring into compliance than a mix of legacy servers, custom applications and several cloud accounts. Confirm the system boundary early, because each extra system adds hours to the system security plan and to the evidence set.
Users, device types and network design
Hardware and software costs in the rule depend on the number of users, the device types they use and the complexity of the network. Laptops, mobile devices, remote access paths and collaboration tools each need their own configuration, encryption and monitoring. Segmenting CUI into a smaller network zone can reduce the devices that must meet every requirement, so ask whether the quote assumes a single broad boundary or a scoped one.
In-house skills versus starting from zero
The rule noted that some contractors already have staff doing these tasks, while others start with no in-house expertise. Staff who already run identity management, logging and patching need less outside time, while a team without that background will pay for learning, documentation and rework. Before you request a quote, list which requirements your team already performs with evidence, and ask the provider to price only the gaps.
Endpoint count for SP 800-172
The enhanced SP 800-172 requirements apply only to critical programs or high value assets, and the rule's estimates rose with endpoint count. Initial implementation was estimated at a much higher level for a small business with 50 to 100 endpoints than for one with 25 to 50, and far higher again for 750 to 1,500 endpoints. Recurring costs were estimated at 20 percent of initial implementation. Confirm with the contracting officer whether SP 800-172 applies at all before you size endpoints for it.
Evidence maturity
An organization that already produces dated configuration records, access reviews, scan results and incident logs will assemble assessment evidence faster than one that must create them. Weak evidence drives rework, extra interviews and open plans of action, and each of those adds labor. The SSP upkeep estimate of 12 hours a year per contractor at $95 an hour is a floor for keeping records current, so ask what evidence the quote will produce and how it will be maintained.
Why recurring costs and reassessment add to the budget
The recurring cost of NIST SP 800-171 is larger than many first-year budgets suggest. The FAR CUI proposed rule of January 2025 estimated that a small business would spend about 1,040 hours a year after the first year to keep Rev. 2 implemented, against 1,560 hours in year one, and that a business other than a small business would spend about 5,200 hours a year after the first year, against 5,720 in year one. Those labor figures are priced at $95 an hour, and the same rule estimated recurring hardware and software at $5,000 a year for a small business and $80,000 a year for a larger one. The rule also estimated system security plan upkeep at 12 hours a year per contractor at $95 an hour. Ask any consultant or internal team to show how their quote separates one-time setup from these annual items, and confirm whether licenses, monitoring services and staff time for SSP updates appear as separate lines.
Reassessment adds cost on a fixed schedule that is set by DoD rather than by your own program. Under 32 CFR 170.16 and 170.17, a Level 2 assessment must be repeated every three years, and under 32 CFR 170.22 an organization must affirm its continuing compliance in SPRS every year. Each cycle means paying an assessor or preparing an internal self-assessment, collecting current evidence, and closing any plans of action that remain open. Before you commit to a budget, confirm with your contracting officer which assessment type applies to your contracts, since the CMMC rule's own cost estimates for Level 2 self-assessment and third-party certification differ, and the current DoD deviation affects who assesses during the suspension of CMMC Phase 2.
Two cost points are easy to miss because they sit outside the Government's figures. First, the implementation estimates in the January 2025 proposal covered only non-defense contractors, because defense contractors already had to implement Rev. 2 under DFARS 252.204-7012. If you hold defense contracts, the implementation money was spent years ago, so your recurring budget is mainly for maintaining controls, assessments and affirmations. Second, the CMMC final rule states that its Level 1 and Level 2 estimates exclude the cost to implement or maintain the Rev. 2 requirements. A CMMC assessment fee is therefore not a total compliance budget. Plan the maintenance labor, tooling and SSP work separately, and treat any vendor quote that presents assessment fees alone as incomplete.
How the Government's estimates differ by business size
The January 2025 FAR CUI proposal estimated the cost for a small business to implement SP 800-171 Rev. 2 at an average of 1,560 hours of labor in the first year, priced at $95 an hour, which comes to about $148,200. In later years the same rule estimated 1,040 hours, or about $98,800 a year. Hardware and software were estimated at an average of $27,500 in the first year and $5,000 a year after that. The estimates treat labor as the largest component and assume the business starts with some capacity to do the work.
- First-year labor: about 1,560 hours at $95 an hour, or about $148,200.
- Recurring labor: about 1,040 hours a year, or about $98,800.
- First-year hardware and software: an average of $27,500.
- Recurring hardware and software: an average of $5,000 a year.
- Excluded: SSP maintenance, which the rule estimated separately at 12 hours a year at $95 an hour.
The rule said implementation time varies with the number of employees and the complexity of the information systems, and that some contractors start with no in-house expertise. Check your own figures against the hours your staff can realistically spend on policy, configuration and evidence work. Ask any quote to state its hours, rate and assumed headcount.
For a business other than a small business, the same rule estimated first-year labor at an average of 5,720 hours at $95 an hour, or about $543,400. In later years it estimated 5,200 hours, or about $494,000 a year. Hardware and software were estimated at an average of $140,000 in the first year and $80,000 a year after that. These figures are larger because larger organizations typically run more systems, more users and more network segments that must be brought under the requirements.
- First-year labor: about 5,720 hours at $95 an hour, or about $543,400.
- Recurring labor: about 5,200 hours a year, or about $494,000.
- First-year hardware and software: an average of $140,000.
- Recurring hardware and software: an average of $80,000 a year.
- Excluded: SSP maintenance, which the rule did not fold into these labor totals.
The gap between this tab and the small business tab is mostly a function of scope, not of the requirements themselves. Two organizations with the same headcount can still differ widely if one runs a single enclave and the other runs a mixed estate. Ask your integrator to show how the hours map to systems, endpoints and users in your environment.
The rule put the first-year cost for 5,875 non-defense contractors to implement SP 800-171 Rev. 2 at $1,524,706,500 in total. Of that, $861,808,500 fell on 4,905 small businesses, and the remaining contractors carried the rest. Recurring costs across the population were estimated at $1,065,919,000 a year. These are aggregate figures used to size the rule's burden, not per-company costs, and they are the basis for the individual averages in the other tabs.
- Population: 5,875 non-defense contractors, of which 4,905 are small businesses.
- First-year total: $1,524,706,500 across all contractors.
- First-year share for small businesses: $861,808,500.
- Recurring total: $1,065,919,000 a year across all contractors.
- Defense contractors: excluded, because DFARS 252.204-7012 already requires SP 800-171 Rev. 2 for them.
Aggregate totals hide wide variation, so do not multiply an average by your own contract count and call it a budget. Confirm with your contracting officer which revision your contract names, because the FAR overhaul proposed rule of 23 June 2026 points toward Rev. 3. Use the figures to frame the discussion, then build a quote from your written scope.
How Rev. 3 and the FAR overhaul could change the cost
The revision your contract names sets the cost baseline. DoW Class Deviation 2026-O0025, Revision 3, signed on 3 September 2026, has contracting officers use a revised DFARS 252.204-7012 that names SP 800-171 Revision 2 explicitly. It cites a 13 July 2026 DoW CIO memorandum requiring baseline compliance with Rev. 2 while CMMC Phase 2 is suspended. The January 2025 FAR CUI estimates were also built on Rev. 2, with 110 requirements. Confirm the exact revision in your contract clauses, and check whether any modification or subcontract flow-down references a different version. Read the full deviation text through the DoW class deviation memo before you treat any cost figure as current.
The June 2026 FAR overhaul proposal would change that baseline for civilian agency contractors. It folds the January 2025 CUI proposal into a new FAR 52.240-7 that would require SP 800-171 Rev. 3, with organization-defined parameter values published by the DoW CIO. The rule was not final as of October 2026, and the comment period closed on 23 July 2026. Rev. 3 has 97 requirements, but it adds new requirements, withdraws others and requires you to assign ODP values where the agency has not. Any cost estimate built on Rev. 2 labor hours will therefore understate or misplace effort if the move happens. The January 2025 figures for labor, hardware and software should be treated as a Rev. 2 baseline, not a forecast for Rev. 3.
Before you budget, ask the contracting officer which revision and which ODP values will apply, and when. Then ask any implementation partner to show, in the written scope, how a Rev. 3 move would be handled: which requirements change in your environment, whether the system security plan and assessment evidence would be rebuilt or updated, how ODP assignments would be documented, and what is priced separately if the rule becomes final mid-engagement. A fixed-scope quote should state the revision it assumes and the trigger for re-scoping. Ask your own assessor the same question, since only an independent assessor can judge whether the evidence meets the revision your contract names.
What SP 800-172 adds for critical programs
SP 800-172 is an enhanced layer that sits on top of SP 800-171 and applies only to CUI tied to critical programs or high value assets. The cost of that layer is separate from the base implementation, so scoping it correctly before budgeting is the most important step for organizations that may be affected.
Who applies it
The enhanced requirements apply only where CUI is tied to a critical program or high value asset. The contract or agreement with the federal agency is what brings them in, so the organization does not decide this alone. Ask the contracting officer in writing whether SP 800-172 applies to the specific CUI in scope, and record the answer before pricing the work.
Small business endpoint estimates
The rule estimated initial SP 800-172 implementation at $202,500 for a small business with 25 to 50 endpoints, about $1,000,000 for one with 50 to 100 endpoints, and about $2,315,000 for one with 750 to 1,500. Endpoint count is the main driver in those figures, so an accurate asset inventory is the first input to any quote.
Recurring cost at 20 percent
The same rule estimated annual recurring costs for SP 800-172 at 20 percent of the initial implementation cost. Budget this as a yearly line item that continues after the first build, because enhanced controls such as added monitoring, testing and access restrictions need ongoing operation. Ask any implementation partner to separate one-time work from recurring operations in the quote.
Overlap with base controls
SP 800-172 builds on SP 800-171, so work already done for the base requirements reduces the enhanced build. Systems that lack a current system security plan, tested encryption or mature monitoring will carry extra cost in the enhanced layer. Review the base environment first, then identify which enhanced requirements add new tooling rather than extending existing controls.
Confirm the scope in writing
Because the enhanced requirements depend on how the government classifies the program or asset, cost estimates from the rule are only a starting reference. Confirm the applicable version, the program or asset designation and the assessment expectations directly with the contracting officer. Keep a copy of that confirmation with the scope document used to price the engagement.
How to build a budget and request a quote
This sequence turns a vague sense of cost into a comparable three-year budget. Each step produces a document you can hand to an implementation partner or an independent assessor, so quotes can be compared on the same scope.
Define the CUI boundary and count systems
Start by listing every place CUI is created, stored, processed or transmitted, then mark which systems, accounts, endpoints, cloud services and people touch it. Your security or compliance lead owns this inventory, and it should be reviewed with the contracting team. The output is a boundary statement and a system count. Every later cost line depends on this number, so do not request quotes until the list is agreed in writing.
Estimate internal staff hours by task
Break the work into tasks such as policy writing, access control configuration, logging, encryption, training, and the system security plan, then estimate hours for each against the Government's hour ranges for small and other-than-small businesses. Note which tasks your staff already perform and which need outside expertise. The output is an internal labor sheet with hours, roles and a marked gap list. Treat the Government's figures as a reference point, since the rule itself says effort varies with headcount and system complexity.
Price hardware and software by user and device count
List the tools you expect to buy or license, such as identity, logging, endpoint management, encryption and backup, and attach each to the number of users, device types and network segments it covers. Separate one-time purchases from subscriptions and support contracts. The output is a hardware and software sheet that shows which costs scale with users and which are fixed. Ask vendors to confirm licensing terms in writing, because pricing models vary.
Request written scope from implementation partners
Send the boundary statement, system count, labor sheet and tool list to each implementation partner and ask for a quote based on a written scope. Require the quote to name deliverables, exclusions, responsibilities for the system security plan and evidence collection, and what the client must provide. The output is a set of scope documents you can compare line by line. Ask each partner to state clearly that the organization keeps ownership of its controls and that the partner does not issue any assessment report or certificate.
Budget independent assessment fees separately
Assessment is a separate purchase from implementation. Ask prospective independent assessors or certification bodies for their fees under the assessment type your contract requires, and confirm which assessment applies, since the CMMC rules and DoD procedures differ. The output is a distinct assessment quote that is not bundled with implementation. Also confirm who pays for re-assessment and any remediation retesting, because those costs fall outside the first engagement.
Compare one-time and recurring costs over three years
Combine the implementation quote, tool costs, assessment fees and internal labor into two columns: one-time and recurring. Add recurring items such as annual SSP upkeep, the yearly affirmation, subscriptions and staff time, and place the assessment cycle on the three-year timeline that CMMC rules describe. The output is a three-year budget that shows the first-year peak and the steady-state run rate. Use this model to test each quote for missing items before you accept any proposal.
Check the quote against the contract revision
Before signing, confirm with the contracting officer which NIST SP 800-171 revision and which assessment method apply to your contract, because a revision change can alter scope and labor. Ask the implementation partner to state how the quote would change if the requirement moves, and record the answer in the scope document. The output is a signed-off budget with a documented assumption about the governing revision, ready for approval.
Who pays for which part of the work
The organization owns its controls, its System Security Plan and its compliance outcome. No outside party can accept that accountability on its behalf. Most of the cost falls on internal people, and that cost is easy to miss in a budget because it appears as salaried time rather than an invoice. NIST states that application and implementation of SP 800-171, and any compliance issues, are the responsibility of the federal agency that holds the contract, irrespective of the organization's size, so the organization must also be ready to answer to its customer.
- Staff time: Security, IT, HR, facilities and engineering staff carry out the policy, access, logging and training work. The FAR CUI proposed rule of January 2025 estimated the labor for a small business at about 1,560 hours in the first year, but that figure is an average and your own hours will depend on your environment.
- Budget decisions: Leadership sets the scope, approves hardware and software purchases and decides whether to hire, train or contract out.
- Recurring duties: Keeping the SSP current, reviewing controls, tracking plans of action and running periodic assessments continue after the first year.
- Customer obligations: Contracts may require incident reporting, flow-down to subcontractors and annual affirmations, which the organization must staff.
- Quote check: Ask any partner or assessor to separate their fee from the labor your own team must provide.
Before accepting any quote, confirm which of these internal tasks you have already staffed and which will fall to people who are already at capacity.
An implementation partner such as DeployOpen prepares systems, controls and evidence inside the client's own infrastructure. Its work is typically fixed in scope, with deliverables and timelines agreed in writing before work starts. The partner does not decide whether the organization is compliant and does not issue any report, attestation or certificate. That decision belongs to the independent assessor.
- Systems preparation: Hardening, logging, access configuration, encryption and boundary设置 on self-hosted open-source platforms, depending on the agreed scope.
- Control documentation: Drafting policies, procedures and SSP content for the organization to review, approve and own.
- Evidence production: Configuring the platform so that logs, inventories, baselines and access records can be exported for an assessor.
- Gap work: Identifying which requirements are unmet and remediating the technical items within the written scope.
- Quote basis: A quote follows from the written scope. DeployOpen does not publish a price list, so ask for the scope, deliverables and assumptions behind each line.
Confirm in writing that the partner will not sign, attest or present itself as an assessor, and that the organization retains ownership of every control and document.
The independent assessor performs the assessment and is the only party whose findings count toward a formal result. Under the CMMC program, Level 2 certification assessments are performed by a CMMC Third-Party Assessment Organization (C3PAO), while Government assessments such as DCMA DIBCAC work are performed by the Government. Assessors examine evidence, interview staff and test the controls against the assessment procedures in SP 800-171A. Their fee covers the assessment itself, not the preparation that makes an assessment pass.
- Assessment fee: The DoD's CMMC final rule of October 2024 estimated a Level 2 C3PAO certification assessment plus affirmation at $112,345 for an other-than-small entity and $101,752 for a small entity.
- Self-assessment cost: The same rule estimated a Level 2 self-assessment plus initial affirmation at $43,403 for an other-than-small entity and $34,277 for a small entity.
- Exclusions: Those CMMC estimates exclude the cost to implement or maintain the SP 800-171 requirements, which the rule treats as already required under DFARS 252.204-7012.
- Independence: An assessor that has also built the environment it is testing faces a conflict, so ask how the firm separates the two roles.
- Recurring cycle: Certification must be renewed every three years, and an annual affirmation applies in SPRS.
Verify the current assessment rules and assessor eligibility in the eCFR before booking, because the 2026 changes to who assesses may affect your timing.
NIST 800-171 cost questions buyers ask
Can a small contractor implement NIST 800-171 in-house?
Yes, many small contractors do, but the work is usually more than one person's side task. The FAR CUI proposed rule of January 2025 estimated first-year labor for a small business at about $148,200 (an average of 1,560 hours at $95 an hour), dropping to about $98,800 a year after that (1,040 hours). The same rule noted that some contractors already have staff doing these tasks while others start with no in-house expertise. Before deciding, count the people who already administer identity, logging, patching, backups and encryption, and ask whether they have time for the documentation. A partner can prepare systems, controls and evidence, but the organization still owns its controls and must be able to explain them to an assessor.
How much staff time did the Government estimate for implementation?
The Government's estimates are averages, not a plan for your organization. The January 2025 FAR CUI proposed rule estimated about 1,560 hours in the first year for a small business and about 5,720 hours for a business other than a small business, with recurring effort of 1,040 and 5,200 hours a year, all priced at $95 an hour. The rule said the time varies with the number of employees and the complexity of your information systems. Ask any partner or internal lead to show how many systems, users and locations are in scope, because those counts move the estimate more than headcount does.
Do CMMC assessment fees include the cost of implementing SP 800-171?
No. The CMMC final rule (32 CFR Part 170, October 2024) states that its Level 1 and Level 2 cost estimates exclude the cost to implement or maintain the SP 800-171 Rev. 2 requirements, because DFARS 252.204-7012 already required implementation by 31 December 2017. The assessment figures cover the assessment itself: the rule estimated a Level 2 self-assessment plus initial affirmation at $43,403 for an other-than-small entity and $34,277 for a small entity, and a Level 2 C3PAO certification assessment plus affirmation at $112,345 and $101,752. Your implementation labor, hardware, software and staff time sit outside those numbers, so budget for both.
Why is SSP upkeep budgeted separately from implementation?
The system security plan is a living record that must stay accurate as systems change, so its upkeep recurs every year rather than ending at go-live. The FAR CUI proposed rule estimated SSP upkeep at 12 hours a year per contractor at $95 an hour, and it excluded that work from the implementation labor figures quoted above. Treat the SSP as a separate recurring line item, and ask who will update it after a new system, vendor or network change. The SSP's contents and rules are covered in the system security plan guide on this site.
What should a partner's quote for NIST 800-171 work include?
A useful quote starts from a written scope, not a price list. DeployOpen does not publish prices, and most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. Ask the partner to state which systems and CUI flows are in scope, which requirements they will prepare evidence for, what they will deliver (such as configuration, documentation, the SSP draft and gap report), what the organization must do itself, and whether any retainer covers ongoing upkeep, testing or support. Also confirm that the partner prepares evidence only and that the assessment will be performed by an independent assessor or certification body.
Can a partner guarantee a passing assessment result?
No responsible partner can guarantee an assessment outcome, because the result belongs to the assessor. Assessments are performed by the Government or by an authorized third-party assessment organization, which issues the findings. An implementation partner can prepare systems, controls and evidence against the requirements, and can help you prepare for the assessment, but it does not issue reports, scores or certifications. Ask instead for the scope, the evidence list and the handoff plan, and check that the written agreement describes deliverables rather than outcomes.
Which costs recur after the first assessment?
Several costs repeat, so plan for them before the first invoice. Under 32 CFR 170.16 and 170.17, a Level 2 assessment must be renewed every three years, and under 32 CFR 170.22 an annual affirmation of continuing compliance must be posted in SPRS. Beyond those obligations, expect recurring labor for patching, access reviews, log review, training, the SSP and remediation of findings, plus ongoing software and hardware licenses. The first-year and recurring labor figures from the FAR proposal show how much of the total effort continues every year.
How DeployOpen scopes NIST 800-171 work
DeployOpen plans, implements and documents self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, and it prepares the systems and evidence that an assessment will examine. Any cost estimate for that work starts with a written scope, because the scope decides which components of the CUI environment are in play: the enclave boundary, the identity and logging stack, the encryption and key management services, the configuration baselines, and the system security plan that ties them together. A quote follows from that scope. DeployOpen does not publish a price list, so the first useful step is to give us the system inventory, the list of places CUI is stored, processed or transmitted, and the contract clauses that apply to you.
The scoping conversation should settle a few decisions before any number is discussed. Decide which parts of the work your staff will own and which you want to outsource, such as the initial SSP drafting, hardening of a self-hosted identity or logging platform, or evidence collection for a Basic Assessment. Confirm which revision your contracting officer has named, because a Rev. 2 or Rev. 3 baseline changes the requirement set and the evidence list. Ask whether the organization-defined parameters have been assigned by the agency. These choices move the effort more than any hourly rate, and they belong in the written scope, not in an invoice later.
DeployOpen does not issue assessment reports, attestations or certifications. Those come from the Government, a certified third-party assessment organization or another independent assessor, depending on the contract. Engaging DeployOpen does not guarantee an assessment outcome, a particular SPRS score or acceptance by a contracting officer. What it can do is leave you with systems that are configured as documented, evidence that maps to each requirement, and a plan for keeping both current. Confirm the assessor's requirements and the exact deliverables with them before signing a scope, and treat any vendor who promises a result as a warning sign.
