How much does CMMC Level 2 certification cost?

For a small or mid-sized defense supplier, total first-cycle cost commonly lands somewhere between roughly $100,000 and $400,000 when you combine gap assessment, documentation, technical remediation, enclave licensing, and the C3PAO assessment. Organizations with a tight CUI enclave and mature security controls come in well under that; companies starting from scratch across a whole network come in above it.

How much does the C3PAO assessment itself cost?

The certification assessment is typically quoted between roughly $35,000 and $110,000 depending on scope, number of sites, and assessor. It is separate from the remediation and documentation work that precedes it, and it repeats on a three-year cycle.

What does CMMC Level 1 cost?

Level 1 covers 15 basic safeguarding practices for Federal Contract Information and is self-assessed annually, so most organizations reach it with a few thousand dollars of configuration and documentation work plus internal time. No third-party assessor fee applies.

Can we reduce CMMC cost by shrinking scope?

Yes, and it is usually the single largest lever. Isolating CUI into a dedicated enclave means only that enclave's users, endpoints, and systems must meet all 110 controls, rather than every device in the company. Scoping decisions made early routinely change the total by six figures.

Do we need Microsoft GCC High for CMMC?

Not always, but frequently. GCC High is commonly required where CUI includes export-controlled data under ITAR. Commercial Microsoft 365 can satisfy some CUI scenarios with the right configuration, so this should be a scoping decision made against your contract language rather than a default purchase.

What is the ongoing annual cost after certification?

Plan for enclave and security licensing plus continuous compliance work — evidence collection, POA&M closure, policy maintenance, monitoring, and annual affirmation. Managed compliance for that typically runs $2,500 to $12,000 a month depending on scope, and the C3PAO assessment repeats every three years.

Is CMMC cost allowable under our contracts?

Many CMMC-related costs are treated as allowable indirect costs, but treatment depends on your contract type and accounting practices. Confirm with your contracting officer and accountant before assuming recovery.

Cost Guide

What CMMC certification actually costs

A line-by-line breakdown for Level 1 and Level 2 — assessment, documentation, remediation, licensing, C3PAO fees, and the recurring cost nobody budgets for.

The cost lines for CMMC Level 2

Ranges reflect what small and mid-sized defense suppliers typically encounter. Treat them as planning brackets, not quotes — scope is the variable that matters most.

Gap assessment against NIST 800-171

$8,000 – $25,000

Scoping the CUI boundary, assessing all 110 controls, and producing a scored gap report and prioritized remediation plan. Cost scales with sites, systems, and enclave complexity.

System Security Plan (SSP) & POA&M

$10,000 – $30,000

The documentation an assessor actually reads. Written once, then maintained — an SSP that does not match reality is the single most common assessment failure.

Technical remediation

$15,000 – $150,000+

MFA, FIPS-validated encryption, logging and SIEM, endpoint protection, access control, network segmentation, and often a GCC High migration. The widest and least predictable line item.

Enclave or GCC High licensing

$35 – $85 per user / month

Microsoft 365 GCC High or a dedicated CUI enclave, plus the security tooling layered on top. Recurring, not one-time.

C3PAO assessment (Level 2)

$35,000 – $110,000

The third-party certification assessment itself, priced by scope and assessor. Required every three years, with annual affirmations in between.

Ongoing managed compliance

$2,500 – $12,000 / month

Continuous monitoring, evidence collection, POA&M closure, policy upkeep, and annual affirmation support. Compliance decays without this.

Level 1 is a different order of magnitude. It covers 15 basic safeguarding practices for Federal Contract Information, is self-assessed annually, and most organizations reach it for a few thousand dollars of documentation and configuration work plus internal time.

What moves your number

Scope size

How many users, endpoints, and systems actually touch CUI. A tight enclave is dramatically cheaper to certify than a whole company.

Current maturity

Organizations already running MFA, EDR, logging, and documented policies often spend a fraction of what a from-scratch environment does.

Level required

Level 1 is an annual self-assessment against 15 practices. Level 2 requires all 110 NIST 800-171 controls and, for most contracts, a C3PAO assessment.

Cloud posture

Whether you need GCC High, and whether existing SaaS tools can meet the requirements or must be replaced.

Manufacturing environment

Shop-floor and OT systems that cannot be patched normally require segmentation and compensating controls.

Internal capacity

Evidence collection is labor. Someone pays for it — either your staff's time or an outside team's.

Budget the timeline, not just the invoice

Months 1–2

Scope and gap assessment

Define the CUI boundary, assess the 110 controls, and produce a scored SPRS baseline.

Months 2–4

Documentation

SSP, POA&M, and the policy set built to match the environment you will actually run.

Months 3–9

Remediation

Close technical gaps, migrate to an enclave if required, and stand up logging and monitoring.

Months 9–12

Evidence maturity

Run the controls long enough to produce evidence an assessor will accept — this is what most schedules underestimate.

Months 12–18

C3PAO assessment

Readiness review, assessor scheduling, and the certification assessment itself.

Get a scoped number for your environment

A 30-minute scoping call tells you which level your contracts require, how large your CUI boundary really is, and which of the lines above you can avoid entirely.

Prefer to read first? Read the CMMC Level 2 guide