CMMC Certification Cost in 2026 by Level: DoD's Own Estimates, Line by Line, and What They Leave Out

CMMC certification cost depends on the level and the assessment route. The Department of Defense’s own estimates, published with the CMMC program rule, run from $5,977 a year for a small company’s Level 1 self-assessment to $104,670 over three years for a small company’s Level 2 certification by a C3PAO, and into the millions for the few companies that need Level 3 (CMMC final rule, 89 FR 83092). For Levels 1 and 2 those figures cover the assessment only. They leave out the cost of implementing the 110 NIST SP 800-171 requirements, which for most small contractors is the bigger bill.

Invadel is not a C3PAO and does not write System Security Plans or run CMMC programs. This guide prices every line, including the one we sell: penetration testing and validated scanning at the fixed prices on our pricing page, mapped to CMMC on our CMMC Level 2 penetration testing page.

Status as of November 6, 2026: Phase 2, which would have made C3PAO certification a condition of award, is still suspended. The Department paused it on July 13, 2026 and opened a 60-day review, while Phase 1 self-assessments, DFARS 252.204-7012 and SPRS posting stay in force (WilmerHale).

CMMC cost by level

These are DoD’s per-company estimates from the rule’s regulatory impact analysis, in 2023 dollars. “Small” means a small business under SBA size standards.

Level and route	Who needs it	How often	DoD estimate, small business	DoD estimate, other than small
Level 1 (Self)	Contractors with Federal Contract Information only	Self-assessment and affirmation every year	$5,977 a year	$4,042 a year
Level 2 (Self)	Contractors with CUI, where the contract allows self-assessment	Self-assessment every three years, affirmation every year	$34,277 in year one, $37,196 over three years	$43,403 in year one, $48,827 over three years
Level 2 (C3PAO)	Contractors with CUI, most contracts under the original rollout plan	Third-party assessment every three years, affirmation every year	$101,752 in year one, $104,670 over three years	$112,345 in year one, $117,768 over three years
Level 3 (DIBCAC)	Contractors on the most sensitive programs	Government assessment every three years, on top of Level 2 (C3PAO)	$9,050 to support the assessment, plus $2.7 million to implement and $490,000 a year to maintain the added requirements	$39,021 to support the assessment, plus $21.1 million to implement and $4.12 million a year to maintain

Three assumptions sit behind these numbers:

• DoD assumes the controls already exist. DoD did not count implementing, maintaining or remediating the Level 1 and Level 2 requirements, because FAR 52.204-21 and DFARS 252.204-7012 already required them, the latter by December 31, 2017.
• DoD assumes you pass the first time, with a Final status or a Conditional one carrying an allowable POA&M.
• Level 3 is the exception. DoD counted implementation there because the 24 added NIST SP 800-172 requirements are new. DoD assessors perform the DIBCAC assessment free of charge, but you must already hold Level 2 (C3PAO).

The 110 requirements, their point values and the scoring rules are in our CMMC Level 2 checklist.

CMMC Level 2 cost: what DoD’s $101,752 is made of

The rule itemizes the small-business C3PAO route hour by hour. Regrouped by who is paid:

Component	Hours	Cost
Your senior leader (a director) planning, sitting and reporting the assessment	122	$23,243
An outside consultant or managed service provider, at $260.28 an hour	176	$45,809
The C3PAO assessment team, three assessors at the same rate	120	$31,234
Entering the result in SPRS	0.08	$7
Initial affirmation of compliance		$1,459
First-year total		$101,752
Two further annual affirmations		$2,918
Three-year total		$104,670

In DoD’s own model the consultant costs more than the assessor: outside preparation help is about 45% of the first-year figure, the C3PAO fee about 31%. DoD assumed small companies outsource most IT and security work. For a company that is not small, the model swaps the consultant for about 660 hours of internal staff time ($60,288 including the initial affirmation) and uses a five-person C3PAO team for 200 hours ($52,056), for $112,345 in total.

C3PAO assessment cost

DoD’s model prices the assessor’s fee at $31,234 for a small company and $52,056 for a larger one. The rule does not set C3PAO prices: it leaves them to supply and demand, and to the size and complexity of the network in scope.

Market quotes run higher than the model. CMMC consultancy CBIZ Pivot Point Security put Level 2 C3PAO assessments at $30,000 to $100,000 on average in 2026, trending upward, with $75,000 now a common starting point (Pivot Point Security, page last updated August 24, 2026). DoD’s summary of its 2026 industry RFI put the average assessment cost cited by a subset of respondents at $47,000, separate from the cost of meeting NIST SP 800-171, and said prices had fallen over the program’s first year (Federal News Network). Supply is an open question: GAO found DoD had no documented plan for private-sector assessor capacity falling short of demand (GAO-26-107955).

What moves a C3PAO quote:

• Assets in scope. An enclave of 30 machines and a company-wide scope of 300 are different assessments.
• Locations and travel. Each site that needs on-site time adds days, and travel is often billed on top.
• Readiness. Gaps in evidence mean more assessor hours; draft policies do not count.
• Cloud inheritance. A cloud provider’s customer responsibility matrix leaves fewer requirements to evidence yourself.

The fee usually excludes readiness work and mock assessments (C3PAOs work under conflict-of-interest rules, so preparation comes from a separate firm), remediation, and sometimes the POA&M closeout assessment.

The costs DoD’s estimate leaves out

Every line a first Level 2 cycle can carry, who provides it, and whether DoD counted it:

Line item	Who provides it	In DoD’s estimate?	What sets your number
CUI scoping and gap assessment	You, a consultant, or a Registered Provider Organization	No	Systems that handle CUI, and whether you scope to an enclave. PreVeil, which sells an enclave product, lists $3,500 to $20,000 or more (PreVeil)
Remediation of requirements you do not meet	You and your IT provider	No	NOT MET requirements, especially 5-point and 3-point ones, which with one exception cannot go on a POA&M
CUI enclave and security tooling	Cloud, identity, logging and endpoint vendors	No	Users in the enclave. PreVeil lists $300 to $400 per user per month for a hosted one (PreVeil, published August 21, 2026)
System Security Plan and policies	You or a consultant	Partly, inside the preparation hours	Whether documents exist and are final
Preparing for and sitting the assessment	You and a consultant	Yes: $69,059 for a small company	Readiness on day one
Penetration testing and validated scanning	A testing firm (the line we provide)	No	Hosts, sites and applications in CUI scope
C3PAO assessment fee	A C3PAO	Yes: $31,234 for a small company	Market, scope, travel
Annual affirmations	Your senior official	Yes: $1,459 a year for a small company	Fixed
Running the controls: monitoring, patching, log review, training	You and your managed service provider	No	Enclave size and how much is outsourced

The SBA estimated that total compliance costs can reach approximately $593,800 per certification for a small firm needing a third-party assessment, and about $388,600 for one eligible for self-assessment (SBA). The SBA does not itemize them, but at over five times DoD’s three-year figure they plainly cover more than the assessment.

Your gap assessment decides where you land. A company that implemented NIST SP 800-171 when DFARS required it pays close to DoD’s assessment figures. A company that marked requirements as met without building them pays for the build too.

How long CMMC certification takes, and why time drives cost

The rule fixes a few durations and leaves the rest to how ready you are. Only the fixed ones can be planned to the day.

Stage	Set by the rule?	What decides the time
CUI scoping and gap assessment	No	How many systems touch CUI, and whether you scope to an enclave
Remediation and tooling	No	The number of NOT MET requirements. This is the longest and least predictable stage
System Security Plan, policies and evidence	No	Whether documents are final and match what is deployed
C3PAO assessment	Partly: DoD’s model assumes 120 assessor hours for a small company, and a NOT MET requirement can be re-evaluated for 10 business days after the active assessment period	Scope, sites and how complete your evidence is on day one
POA&M closeout, if you receive Conditional status	Yes: within 180 days of the Conditional status date, or the status expires	How many 1-point items were left open
Affirmation	Yes: at each assessment and every year after	Fixed
Reassessment	Yes: every three years	Fixed

The durations come from 32 CFR 170.17 and 32 CFR 170.21.

Time is a cost in three ways. Consultants and managed service providers bill by the hour (DoD’s model uses $260.28), so every month of remediation adds to the largest line in the estimate. Enclave and tooling subscriptions start the day the environment is built, whether or not you are assessed that year. And a gap assessment goes stale: if remediation drags, the evidence you collected first has to be collected again before the assessor sees it.

Does the July 2026 pause change the cost?

It moves one line and leaves the rest.

What paused. Phase 2, which would have made C3PAO certification a condition of award for most Level 2 contracts from November 10, 2026, and the later phases, including Level 3 DIBCAC assessments. Contracting officers will remove Phase 2 or 3 requirements from existing contracts by modification, and DoD says it will enforce NIST SP 800-171 Rev. 2 through self-assessments and select government-led assessments while the review runs (WilmerHale).

What did not. DFARS 252.204-7012, NIST SP 800-171 Rev. 2, self-assessments, SPRS scores and annual affirmations. Implementation and the self-assessment ($34,277 for a small company in DoD’s model) are due now.

What is still available. The Cyber AB confirmed that C3PAO Level 2 certification assessments remain operational and available, so a contractor can still certify without a contract requiring it (Cyber AB). Some do because primes ask, and the status lasts three years.

What might change. The Task Force report was unpublished in late October, but the RFI summary Federal News Network obtained floats restarting Phase 2 within 90 days for a narrower population, a 270-day POA&M window instead of 180, NIST SP 800-171 Rev. 3 and ISO 27001 reciprocity, none of it decided (Federal News Network). Reciprocity would matter to companies paying for both audits, which our ISO 27001 certification cost guide prices the same way.

What the pause does not reduce: liability. A self-assessment score is a statement to the government, affirmed by a senior official. On September 1, 2026, Honeywell Aerospace agreed to pay $2,042,518 to resolve False Claims Act allegations that it failed to implement NIST SP 800-171 on one network from April 2020 through December 2023, with no determination of liability (U.S. Department of Justice). Independent testing evidence is one of the strongest ways to show that the controls behind that score work.

What it costs to test: the penetration testing line

CMMC Level 2 does not name a penetration test, though Level 3 does through NIST SP 800-172; our guide to which compliance frameworks require penetration testing compares the frameworks that do. Level 2 does require periodic assessment that controls work (CA.L2-3.12.1), vulnerability scanning (RA.L2-3.11.2), remediation (RA.L2-3.11.3) and boundary protection (SC.L2-3.13.1), where an enclave holds or fails. Our NIST SP 800-171 penetration testing guide maps every practice a test evidences.

Test	Invadel fixed price, from
External network penetration test	$4,200
Internal network penetration test, including enclave segmentation testing	$6,000 (internal penetration testing cost)
Validated vulnerability scan, up to 250 devices	$1,500 per scan (vulnerability scanning cost)
Web application penetration test for a portal that stores CUI	$5,200
Cloud penetration test for a cloud-hosted enclave	$6,800

For a typical small enclave, the external and internal tests together start at $10,200, about a tenth of DoD’s estimate for the certification itself. Every price is fixed in writing from your scope details, with no sales call, and onboarding starts within 24 hours of a signed proposal. Each finding names the requirement it touches, and the free retest of remediated findings means the report shows the gaps closed before assessment day. Validated scans include a free re-scan of what you fix, and the attestation letter is included. Firms in the capital region can start from our page on CMMC penetration testing for DC-area contractors.

Timing matters more than price. A finding on a 5-point or 3-point requirement generally cannot sit on a POA&M (non-FIPS-validated encryption is the one exception), so test early enough to fix it before the C3PAO arrives. For defense manufacturers, the enclave often sits beside a plant network, which OT and ICS penetration testing covers with plant-safe methods.

A three-year Level 2 budget you can fill in

DoD’s small-business figures for the C3PAO route plus our published testing prices, at one external and internal test a year and a validated scan every quarter. That cadence is a common choice, not a rule.

Line	Year 1	Year 2	Year 3
Gap assessment, remediation, enclave and tooling	From your gap assessment	Tooling renewals	Tooling renewals
Assessment preparation, C3PAO fee, initial affirmation (DoD estimate)	$101,752
Annual affirmation (DoD estimate)		$1,459	$1,459
External and internal penetration tests, retest included (Invadel)	$10,200	$10,200	$10,200
Validated scans, four a year, up to 250 devices (Invadel)	$6,000	$6,000	$6,000
Known lines	$117,952	$17,659	$17,659

The known lines total $153,270 over the certification period, before remediation and tooling. In Year 4 the preparation and C3PAO assessment lines repeat for recertification. If your contracts allow self-assessment, replace $101,752 with DoD’s $34,277. The penetration testing cost calculator totals the testing lines for your scope.

How to lower CMMC certification cost

1. Confirm the level you need. A company with Federal Contract Information but no CUI needs Level 1, at $5,977 a year in DoD’s small-business model, not a $101,752 Level 2 certification. Ask your contracting officer or prime what flows to you and whether it is marked as CUI.
2. Scope to an enclave, then prove the boundary. An enclave limits where the 110 requirements apply to a few dozen systems, but only if the segmentation holds, which network segmentation testing proves; our NIST SP 800-171 penetration testing guide covers how the boundary is tested.
3. Use a cloud provider that already meets FedRAMP Moderate. DFARS 252.204-7012 requires security equivalent to the FedRAMP Moderate baseline from any cloud service that stores, processes or transmits covered defense information, so one that already meets it saves you proving equivalence. Our FedRAMP penetration testing guide covers the testing those providers go through.
4. Fix the 5-point and 3-point requirements first. Conditional status needs at least 88 of 110 points. The POA&M may hold only 1-point requirements, plus SC.L2-3.13.11 where encryption is used but not FIPS-validated, and never AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4 or PE.L2-3.10.3 to 3.10.5. Every item must be closed within 180 days (32 CFR 170.21). Below 88, after a 10-business-day window to supply more evidence, you pay for a second assessment.
5. Test before you book the assessor. A failed assessment is a second C3PAO fee; a penetration test with a free retest costs far less.
6. Get a fixed price for every outside line. A day-rate estimate leaves the overrun risk with you.

Frequently asked questions

How much does CMMC Level 2 certification cost? DoD estimates $101,752 in the first year for a small business on the C3PAO route and $104,670 over the three-year period, or $112,345 and $117,768 for larger companies. That covers preparation, the C3PAO fee and affirmations. Implementing the 110 requirements is extra, and the SBA put total compliance as high as about $593,800 for a small firm needing a C3PAO assessment.

How much does CMMC Level 1 cost? DoD estimates $5,977 a year for a small business and $4,042 a year for a larger one. That covers the annual self-assessment and affirmation. There is no third-party assessor at Level 1 and no POA&M is allowed, so every requirement has to be met when you affirm.

How much does CMMC Level 3 certification cost? The DIBCAC assessment itself is free, but DoD estimates $9,050 for a small company to support it, plus $2.7 million to implement and $490,000 a year to maintain the 24 added NIST SP 800-172 requirements. You must hold Level 2 (C3PAO) first, so that cost comes on top. Level 3 assessments are among the phases paused in July 2026.

How long does CMMC Level 2 certification take? There is no fixed length. The rule sets only the back end: 180 days to close a POA&M after Conditional status, an affirmation every year and a new assessment every three years. Everything before the assessment depends on your gap. A company that built the NIST SP 800-171 controls when DFARS first required them can go straight to preparation; one that did not has to build them first.

How much does a C3PAO assessment cost? DoD’s model assumes $31,234 for a small company and $52,056 for a larger one. The market sets the actual price, and one CMMC consultancy put 2026 quotes at $30,000 to $100,000. Ask whether travel and the POA&M closeout are included.

Can we recover CMMC costs on our contracts? The CMMC rule made no change to cost allowability under FAR 31.201-2 and left cost recovery outside its scope. Recovery depends on your contract types and accounting.

Can we self-assess for CMMC instead of paying a C3PAO? Only where the contract designates Level 2 (Self). DoD’s model puts that route at $34,277 in the first year for a small company, against $101,752 for C3PAO certification, and the July 2026 pause has suspended Phase 2’s C3PAO requirement. The 110 requirements are the same either way, and a senior official still affirms compliance every year.

Which parts of the CMMC bill can Invadel cover? Only the testing line. We are not a C3PAO, so we cannot certify you, and we do not act as your CMMC consultant, which keeps the testing independent. External and internal tests start at $10,200 together, validated scans at $1,500, each with a free retest or re-scan of what you fix.

The short version

DoD prices CMMC assessment at $5,977 a year for a small company’s Level 1 self-assessment and $104,670 over three years on the Level 2 C3PAO route. The bigger, more variable cost is implementing NIST SP 800-171, which DoD left out; the SBA puts total compliance at up to about $593,800 for a small firm on the C3PAO route. The pause deferred the C3PAO fee, not the obligation. External and internal testing starts at $10,200, retest included: see CMMC Level 2 penetration testing and our pricing, or scope your test.