What compliance costs by framework, and which figures are published
Only some frameworks have official cost estimates, and each one measures something different. If you need a baseline before requesting quotes, treat the published figures as anchors for one unit of work, not as totals for your program. The Justice Department's regulatory analysis for its October 2024 proposed rule on US sensitive personal data, drawing on vendor publications, cited $5,000 to $25,000 for a SOC 2 Type 1 audit and $30,000 to $100,000 for a Type 2 audit. The Type 2 range is higher because it covers controls over a period, not a single date. For CMMC, the DoD's final rule (32 CFR Part 170, 15 October 2024) estimated $43,403 per Level 2 self-assessment plus initial affirmation for an other-than-small entity, and $112,345 for a Level 2 C3PAO certification assessment on the same basis. Those figures are per assessment, not three-year programs, and the three-year totals in the same rule ($48,827 and $117,768 for other-than-small entities) add annual affirmations.
Other official figures measure different units. The SEC's September 2009 study of Section 404 found mean total compliance cost for 404(b) companies fell from $2.87 million to $2.33 million after the 2007 reforms, with medians of $1.19 million and $1.04 million. The Commission's impact assessment SWD(2022) 282 estimated conformity assessment at EUR 18,400 per product for self-assessment and EUR 25,000 for third-party assessment, while the AI Act impact assessment SWD(2021) 84 put compliance at roughly EUR 6,000 to 7,000 per high-risk system. The ESA figure cited in SWD(2020) 199 puts threat-led penetration testing at 0.1% to 0.3% of the total ICT budget, a share rather than a dollar amount. Ask vendors and assessors which unit their quote uses before comparing.
Some frameworks publish no official figure. The PCI SSC publishes no cost estimate for PCI DSS, and no official figure was supplied for HITRUST, so ask your QSA or HITRUST assessor for a written scope and fee, and benchmark against the per-assessment figures above only where the scope truly matches. The Compliance requirements compared hub covers the requirements behind these costs.
Published cost figures by framework side by side
This table lists only cost figures that a regulator, government body or official agency has published, with the year, document and scope of each. Read each row as the publisher's estimate for its own purpose, not as a quote you will receive, and check whether the figure includes internal staff time.
| Framework and figure | Publisher, year and document | What it covers and entity size | Figure as published |
|---|---|---|---|
| SOC 2 Type 1 audit | Justice Department, regulatory analysis for its October 2024 proposed rule (89 FR 86116), drawing on vendor publications | One-time point-in-time audit of controls; size tier not specified | $5,000 to $25,000 |
| SOC 2 Type 2 audit | Justice Department, same proposed rule (89 FR 86116), drawing on vendor publications | Audit of controls over a longer period; size tier not specified | $30,000 to $100,000 |
| CMMC Level 2 self-assessment, one assessment | DoD, CMMC final rule (32 CFR Part 170, 15 October 2024), Regulatory Impact Analysis | Self-assessment plus initial affirmation; other-than-small entity | $43,403 per assessment |
| CMMC Level 2 self-assessment, small entity | DoD, same final rule and Regulatory Impact Analysis | Self-assessment plus initial affirmation; small entity | $34,277 per assessment |
| CMMC Level 2 C3PAO certification, three-year total | DoD, same final rule and Regulatory Impact Analysis | Certification assessment with two annual affirmations; other-than-small $117,768, small $104,670 | Other-than-small $117,768; small $104,670 (three-year totals) |
| SOX 404 total compliance cost, companies subject to 404(b) | SEC Office of Economic Analysis, study of Section 404 (September 2009) | Mean and median before and after the 2007 reforms; companies subject to auditor attestation | Mean $2.87 million before, $2.33 million after; median $1.19 million before, $1.04 million after |
| Cyber Resilience Act conformity assessment per product | European Commission, impact assessment SWD(2022) 282 (15 September 2022), secondary data | Average per product, one-off and recurrent costs | Self-assessment EUR 18,400; third-party assessment EUR 25,000 |
| AI Act high-risk system compliance (estimate) | Commission impact assessment SWD(2021) 84 final, AI Act proposal | Compliance by 2025, net of work companies would do anyway; per high-risk system | EUR 6,000 to 7,000, roughly 4 to 5% of development cost |
| DORA threat-led penetration testing | Commission impact assessment SWD(2020) 199, citing an ESA estimate | Share of total ICT budget of the firms concerned, not a fixed sum | 0.1% to 0.3% of total ICT budget |
| PCI DSS compliance | PCI Security Standards Council, FAQ 1015 | The council publishes no cost estimate and imposes no fines | No official figure; ask your acquirer and QSA for quotes |
What the SOC 2 and CMMC cost figures actually include
The published SOC 2 range is an audit fee, not a program budget. The Justice Department's regulatory analysis for its October 2024 proposed rule cited estimates drawn from vendor publications: $5,000 to $25,000 for a Type 1 audit and $30,000 to $100,000 for a Type 2 audit. A Type 1 report covers the system description and control design at a point in time, while a Type 2 report adds an opinion on operating effectiveness over a period. The gap between the two figures reflects how much testing the auditor performs, not what it costs to build controls. Readers should ask whether a quote covers only the attestation fee, or also readiness work, control remediation, evidence collection, internal staff time and the second and later review cycles that a Type 2 period requires.
The CMMC figures are per assessment, and they are easy to misread as annual costs. The DoD's 2024 final rule estimated a Level 2 self-assessment plus initial affirmation at $43,403 per assessment for an other-than-small entity and $34,277 for a small entity. The three-year totals, $48,827 and $37,196, cover one assessment cycle plus two annual affirmations. The separate Level 2 C3PAO certification estimate, $112,345 for an other-than-small entity and $101,752 for a small entity, with three-year totals of $117,768 and $104,670, covers a third-party assessment. That path was suspended when the Department of War paused CMMC Phase II on 13 July 2026, so a certification assessment may not be required for a given contract at present. Those figures also exclude the remediation work needed to meet the 110 NIST SP 800-171 Rev. 2 requirements.
Before relying on any CMMC figure, confirm the current contract status with the DoW CIO About CMMC page, which reflected a paused Phase 1 as of 17 October 2026, and check the contracting officer's solicitation requirements. The eCFR text of 32 CFR 170.3(e) still shows the original phase schedule, so the regulation and the department's current guidance may differ. Ask any assessor or consultant to show which costs sit inside their quote, including readiness work, the CMMC assessment itself, and annual affirmation support, and to state what happens to the price if the certification requirement is reinstated.
What moves a published figure up or down in your environment
A published figure is an average for a typical scenario, not a quote for your organization. The factors below change which scenario you are in, so check each one before comparing numbers across frameworks.
SOC 2 report type and period
A Type 1 report tests control design at a single date, while a Type 2 report tests operating effectiveness over a period. The Justice Department's regulatory analysis cited vendor-sourced estimates of $5,000 to $25,000 for Type 1 and $30,000 to $100,000 for Type 2. The CPA firm sets the fee from the scope and the observation window, so ask for both the report type and the period length in any quote.
Trust Services Criteria categories in scope
Security is covered by the common criteria CC1 to CC9, which apply to every SOC 2. Availability, processing integrity, confidentiality and privacy add criteria only when you include them. Each added category means more controls to design, more evidence to collect and more testing time for the CPA, so the fee rises with every category you include. Confirm the category list in writing before accepting a figure.
CMMC entity size and assessment type
The DoD estimated Level 2 self-assessment plus affirmation at $43,403 for an other-than-small entity and $34,277 for a small entity, and C3PAO certification assessment at $112,345 and $101,752 respectively. Entity size and the choice between self-assessment and C3PAO assessment both move the figure. Phase II, which would have required C3PAO certification, is suspended, so confirm which assessment type your contracts currently require before budgeting.
SOX 404(b) auditor attestation status
Section 404(b) adds an external auditor attestation for accelerated and large accelerated filers that are not emerging growth companies. The 2009 SEC study found mean total Section 404 costs for 404(b) companies of $2.33 million after the 2007 reforms. The SEC estimated in 2020 that an issuer newly exempt from the attestation would save about $210,000 per year, roughly $110,000 in audit fees and $100,000 in other costs. Your filer status determines whether this line applies at all.
Evidence reused across other regimes
Many costs fall on evidence collection, not on the audit fee itself. PCI SSC FAQ 1567 says a QSA cannot rely on SOC 2 or SOC 3 reports for a PCI DSS assessment, but may reuse the evidence from those audits after independently reviewing it. Who pays changes here: your team builds the evidence once, and each assessor reviews it. Ask each assessor which evidence it will accept and how much re-review it will charge for.
AI and product population in scope
The Commission's impact assessment estimated EUR 18,400 per product for self-assessed conformity and EUR 25,000 for third-party assessment, including one-off and recurrent costs. For AI systems it estimated EUR 6,000 to 7,000 per high-risk system by 2025, net of work companies would do anyway. Total cost scales with the number of products or systems in scope, so an inventory of what is covered is the first input to any estimate.
Where no official cost figure exists for PCI DSS and HITRUST
No official cost figure exists for PCI DSS, so budget for it from a written scope rather than from a published number. The PCI Security Standards Council publishes no cost estimate for PCI DSS compliance, and it does not impose fines. Any financial consequences of non-compliance come from individual payment brand programs, so ask each acquirer and card brand you deal with what they require and what they would charge. Your assessment is documented either on a Report on Compliance completed by a Qualified Security Assessor or on a Self-Assessment Questionnaire, and each is closed with an Attestation of Compliance. Ask your assessor which of these documents applies to your environment, who signs the attestation, and whether the fee covers the report, the attestation and any follow-up validation work.
No official HITRUST cost figure is supplied here, so ask HITRUST and your chosen assessor for current fees in writing. The fee you pay depends on which assessment type you select, the number of in-scope systems and locations, whether you need an interim review before the final assessment, and whether the assessor is also doing other work for you. Ask for a line-item quote that states what is included, such as scoping, testing, the assessor's report, quality review and any remediation validation, and what is billed separately. Confirm the certification validity period and what a recertification or interim assessment will cost.
Whatever the framework, ask every provider for a written, scoped quote rather than relying on third-party averages. Averages from vendor blogs or survey sites rarely show your asset count, your number of locations, your existing evidence or your remediation backlog, and those drive the price more than any headline figure. Compare quotes on the same scope document, and record which costs are one-time (readiness work, gap remediation, first assessment) and which recur (annual assessments, attestations, scans, retainers). Treat any figure that cannot be tied to a written scope as a guess.
How to turn a published figure into your own budget
This sequence turns a published regulator or official-body estimate into a budget line you can defend, by tying each figure to the proof your customers or regulators require and checking whether it still fits your scope and date. It ends with written, scoped quotes that you can compare against the published baseline.
List the proofs you must produce
Start with the customers, regulators and contracts you answer to, and write down the exact proof each one requires: a SOC 2 report, a CMMC assessment or affirmation, a PCI DSS Report on Compliance or Self-Assessment Questionnaire, an ISO certificate, or no formal proof at all. Confirm the requirement in writing with the contract owner or the regulator's own text, not from memory. The output is a short register with one row per framework and one named proof per row.
Map each proof to its published figure
For each row, find the official estimate that matches the proof type and nothing else. A SOC 2 Type 1 and a Type 2 have different published ranges, a CMMC Level 2 self-assessment and a C3PAO certification assessment have different published totals, and PCI DSS has no official cost estimate to use. Mark rows with no official figure as unknown and note that they need a quote instead. The output is a mapping table where every cost cell cites its source.
Check each figure's date and scope
Compare the year, the entity size and the population the estimate assumed with your own situation. A regulator's estimate for a small entity may not fit an other-than-small one, and a figure drawn from vendor publications reflects the assumptions of its authors. Note the publication date and any later rule changes, and record where your scope differs. The output is a list of assumptions each figure rests on, with a flag for every one that does not match your organization.
Separate one-time costs from recurring costs
Split each mapped figure into the first-cycle work and the costs that repeat each year or each assessment period. Some published estimates already combine one-off and recurring costs, while others cover a single assessment only, so read each source's definition before adding numbers across years. Track the annual affirmations, the periodic re-assessments and the recurring evidence collection separately from the initial build. The output is a two-column budget with one-time and recurring totals kept apart.
Measure the internal effort the figures miss
Published figures usually price external assessors and do not price your own staff. Estimate the hours your security, IT, HR, change management and system owners will spend on evidence, control remediation, access reviews and interviews, and record who owns each activity. Also count the cost of tooling you must add to produce evidence, such as logging or ticketing. Confirm these internal costs with your finance and operations leads, since no official source sets them for you. The output is an internal effort plan with named owners.
Request written, scoped quotes
Ask each assessor, auditor and consultant for a written quote tied to a defined scope, listing the frameworks, systems, locations, sampling approach, deliverables and timelines. Compare each quote with the published baseline and ask the provider to explain any large gap, including what is excluded. DeployOpen plans and implements work under written, fixed scopes, and quotes follow from that scope. The output is a side-by-side quote comparison where every line maps to a deliverable.
Recheck status before each renewal
Before approving the budget and again before each renewal, confirm whether the rule, standard or assessment program has changed. CMMC is the clearest case to check, because the Department of War has suspended Phase II and started a review, and its published figures may no longer match the requirement you face. Record the date of each check and the source you used. The output is a dated status note that tells the budget owner whether the mapped figures still stand.
Questions buyers ask about compliance costs before hiring help
How much does a SOC 2 audit cost according to official estimates?
The only official figure supplied comes from the US Department of Justice. Its regulatory analysis for an October 2024 proposed rule on US sensitive personal data cited vendor-based estimates of \$5,000 to \$25,000 for a SOC 2 Type 1 audit, which checks control design at a point in time, and \$30,000 to \$100,000 for a Type 2 audit, which tests controls over a longer period. These are estimates drawn from vendor publications, not published audit fees. The main drivers are the number of Trust Services Criteria in scope, the length of the observation period, the size and complexity of the system, and how ready your controls and evidence are. Ask any CPA firm for a quote that separates the readiness work from the examination fee, and confirm whether the quote covers Type 1, Type 2 or both. The AICPA SOC 2 overview explains how the report types differ.
What does a CMMC Level 2 assessment cost, and is the figure still current?
The DoD's CMMC final rule (32 CFR Part 170, published 15 October 2024) estimated a Level 2 self-assessment plus initial affirmation at \$43,403 per assessment for an other-than-small entity and \$34,277 for a small entity. Over three years, including two annual affirmations, the totals were \$48,827 and \$37,196. For a Level 2 certification assessment by a C3PAO, the same rule estimated \$112,345 per assessment for an other-than-small entity and \$101,752 for a small entity, with three-year totals of \$117,768 and \$104,670. These figures are dated to the rule. On 13 July 2026 the Department of War suspended CMMC Phase II, which had required C3PAO certification for applicable contracts, and started a 60-day review. Phase I self-assessments, SPRS postings and annual affirmations remain in place. Confirm the current requirement with your contracting officer and the DoW CIO About CMMC page before you budget for either path.
Do the SEC's Section 404 cost figures apply to a private company?
No. The SEC Office of Economic Analysis study of September 2009 measured Section 404 costs for public companies subject to the auditor attestation requirement under 404(b). It found mean total compliance costs of \$2.87 million before the 2007 reforms and \$2.33 million after, with medians of \$1.19 million and \$1.04 million. Section 404 applies to SEC registrants, so a private company is not subject to it and these figures do not describe its costs. A private company that wants SOC 2 or ISO 27001 evidence faces different scope and cost drivers, and the official figures for those are covered elsewhere on this page. If you are an SEC issuer, the SEC estimated in 2020 that a newly exempt issuer would save about \$210,000 per year on average, roughly \$110,000 in audit fees and \$100,000 in other costs (Release 34-88365). Ask your auditor which of your IT general controls are in scope for your own evaluation.
What does the EU AI Act cost estimate actually cover?
The figure comes from the Commission's impact assessment accompanying the AI Act proposal (SWD(2021) 84 final). It estimated compliance at around two thirds of the average conformity assessment cost per product, which was EUR 18,400 for self-assessment and EUR 25,000 for third-party assessment, including one-off and recurrent costs, based on secondary data. That gives roughly EUR 6,000 to 7,000 per high-risk AI system by 2025, or about 4 to 5% of development cost. The estimate is an allowance that removes work companies would do anyway, so it is not a total budget for a compliant system. It also predates the final regulation as amended in 2026, so treat it as a proposal-stage estimate. The cost components to scope yourself include risk management, data governance, technical documentation, logging, human oversight and post-market monitoring. Ask any provider for an itemized quote that maps to the obligations that apply to your system.
Do PCI DSS and HITRUST have official cost figures?
No official figure exists for either in the sources supplied. The PCI Security Standards Council publishes no cost estimate for PCI DSS compliance, and it does not impose fines. Financial consequences for non-compliance come from individual payment brand programs (PCI SSC FAQ 1015). Your assessment cost depends on whether you complete a Report on Compliance with a Qualified Security Assessor or a Self-Assessment Questionnaire, the size of your cardholder data environment and the number of locations and service providers in scope. For HITRUST, no official cost figure was supplied either. Its cost depends on the assessment type, the scope of the environment and whether you need a readiness assessment first. In both cases, ask assessors for a written scope and a fee breakdown that separates assessor time, remediation support and any recurring annual costs.
Does hiring outside help change the cost of compliance?
Outside help changes who is paid and what is paid for, and it can reduce duplicated work, but it does not remove the external assessor's fee. The cost components are typically the readiness work, the remediation of controls, the independent assessment or attestation, and the recurring evidence and reassessment work. Published figures such as the DoD's CMMC estimates and the Justice Department's SOC 2 ranges already include some third-party assessment cost, so compare any vendor quote against the same scope. Overlap can lower evidence work: under PCI SSC FAQ 1567, a QSA may reuse evidence from a SOC 2 or SOC 3 audit after independently reviewing it. DeployOpen plans, implements, hardens and documents self-hosted platforms in your own infrastructure, and prepares systems and evidence for compliance assessments. It does not issue audit reports or certifications. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. DeployOpen does not publish a price list, so a quote follows from that written scope.
How DeployOpen helps scope compliance work before you commit
DeployOpen plans, implements, documents and supports self-hosted open-source platforms inside your own infrastructure, and prepares systems, controls and evidence for compliance assessments. We do not issue audit reports, attestations or certifications, so the cost figures on this page shape the work that independent auditors and certification bodies will later review.
How we scope
- Scope is agreed in writing before work starts, covering which systems, frameworks and evidence are in play.
- Deliverables and timelines are defined in the same written scope, so you can compare quotes on equal terms.
- Ask us to name which cost components sit inside the scope and which remain with your auditor or assessor.
How we build
- We implement and harden the self-hosted platform inside your cloud accounts, data centers or air-gapped network.
- Controls, configurations and evidence collection are built to the assessment criteria you confirm with your auditor.
- Security testing of applications, APIs and infrastructure can be scoped alongside the build where your evidence needs it.
How we hand over
- Handover includes documentation of configurations, controls, evidence locations and operating procedures.
- Your team receives the artifacts needed to show an auditor how each control operates in your environment.
- Confirm with your auditor or assessor which evidence format and retention period they expect before handover.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Retainers cover the recurring work that drives annual assessment costs, such as evidence refresh and patching.
- Ask for the retainer scope in writing so recurring costs are visible next to one-time implementation fees.
Sources and further reading
- CMMC Program final rule, 32 CFR Part 170 (Federal Register, 15 October 2024) ↗
- Federal Register: Justice Department proposed rule on U.S. sensitive personal data, 89 FR 86116 (October 29, 2024) ↗
- SEC Office of Economic Analysis: Study of SOX Section 404 (September 2009) ↗
- Commission impact assessment SWD(2022) 282 accompanying the Cyber Resilience Act proposal ↗
- Impact assessment accompanying the AI Act proposal, SWD(2021) 84 final ↗
- PCI SSC FAQ 1015: consequences of non-compliance ↗
