If you sell to the Department of Defense, CMMC is no longer a someday problem. As applicable solicitations begin requiring a third-party CMMC Level 2 certification, the question every contractor is asking is the right one: what does this actually cost?
Here is the honest answer, with the numbers broken out, the line items most quotes leave off, and the levers that genuinely bring the total down.
The Four Cost Buckets
Every CMMC Level 2 certification budget breaks into the same four buckets:
- Readiness and gap assessment. Figuring out where you stand against the 110 NIST SP 800-171 controls that define Level 2. Done by hand, this is a labor line item that scales with how complex your environment is.
- Remediation and technology. Closing the gaps: access controls, logging, encryption, CUI handling. This is the most variable bucket, from minimal spend for a mature shop to a large investment for a contractor starting from scratch.
- Documentation. Your System Security Plan (SSP), policies, procedures, and evidence. Traditionally the most labor-intensive line item, measured in staff or consultant hours.
- The C3PAO assessment itself. The fee paid to a Certified Third-Party Assessment Organization to conduct the certification assessment.
What the DoD Itself Published
You do not have to rely on vendor quotes to anchor a budget. The DoD CMMC Program Regulatory Impact Analysis put concrete figures on the three-year cost of each path. These are the numbers we treat as the floor for planning.
| Path (3-year cycle) | Small entity | Larger entity |
|---|---|---|
| Level 2 Certification (C3PAO) | $104,670 | $117,768 |
| C3PAO assessor engagement alone | $31,234 | $52,056 |
| Level 2 Self-Assessment | $37,196 | $48,827 |
| Level 1 Self-Assessment | $5,977 | $4,042 |
Source: DoD CMMC Program Regulatory Impact Analysis (DOD-2023-OS-0063-0003), pages 14 and 25-26.
Notice the shape of the small-entity certification number. Of the $104,670 three-year total, the assessor engagement is $31,234. The published breakdown puts Plan and Prepare at $20,699, the conduct of the assessment (your own labor) at $45,509, reporting at $2,851, and three years of annual affirmations at $4,377. The assessment fee is real, but the preparation and your own labor are the larger share. That is the part you can compress.
See what your own preparation actually requires before you write a check to anyone. Start with a free two-minute gap check against all 110 controls.
Run the free gap check →The Line Items Most Quotes Leave Off
- Scoping mistakes. Assess your whole network when a CUI enclave would do, and you pay to certify systems that never needed it.
- Consultant hour creep. Readiness work billed hourly tends to expand, and documentation rework is the classic culprit.
- Conditional assessments. Miss the score and you pay for remediation plus a re-evaluation.
- The scheduling tax. C3PAO capacity is finite. Waiting costs you eligibility on contracts you cannot bid.
How to Cut the Cost Without Cutting Corners
1. Shrink the scope
The single biggest cost lever is scoping. If CUI only touches a defined enclave, only that enclave needs to meet Level 2. Get the scoping decision right before you spend a dollar on remediation. Our small-business cost breakdown walks through why this matters most when you are small.
2. Take the labor out of documentation and evidence
This is where AI-as-a-Service (AaaS) changes the math. Most of the preparation cost is human hours spent on gap analysis, SSP drafting, policy writing, and evidence collection, work that is systematic, repetitive, and exactly what AI does well. An AaaS platform like ai4cmmc.ai does that work continuously: it maps your environment against the 110 controls, helps draft and maintain your SSP and POA&M, gathers evidence as you go, and hands your team a clear report for review. Your people stay in the loop and approve every output. They just stop burning hundreds of hours producing paperwork.
3. Stay audit-ready, not audit-panicked
Certification is not a one-time event. Annual affirmations and a three-year reassessment cycle mean the cheapest path is continuous readiness. Maintaining compliance as a living system costs far less than crisis-mode preparation, every cycle.
The Bottom Line
Budget against the published figures, not a vendor's worst-case quote. The assessment fee is largely fixed. The preparation cost is not. For the certification path specifically, see our CMMC Level 2 certification cost breakdown, and if you want to know how 2026 market conditions shift the picture, read what changed in 2026.