The Short Answer
CMMC Level 1 self-assessment typically costs $8,000 to $18,000. CMMC Level 2 with a C3PAO-led assessment runs $40,000 to $140,000 or more, depending on company size and how much of your environment handles Controlled Unclassified Information. There is no single "CMMC cost", the level you need is what determines which of these two very different budgets applies.
This page assumes you already know the CMMC level structure. If not, start with our CMMC 2.0 guide, which also covers the 2026 Phase 2 rollout pause in detail.
CMMC Cost by Level and Company Size
| Level & size | Preparation & remediation | Assessment | Total |
|---|---|---|---|
| Level 1 (self-assessment, any size) | $8,000 – $18,000 | $0 (self-attested) | $8,000 – $18,000 |
| Level 2, small (<50 staff) | $25,000 – $50,000 | $15,000 – $30,000 | $40,000 – $80,000 |
| Level 2, mid-size (50 – 250 staff) | $45,000 – $90,000 | $25,000 – $50,000 | $70,000 – $140,000 |
| Level 3 (DIBCAC-led, rare) | Built on a certified Level 2 baseline | $100,000 – $250,000+ | |
Level 1 covers 17 basic safeguarding practices tied to Federal Contract Information and is self-attested, no assessor fee at all. Level 2 covers the full 110 controls from NIST SP 800-171, tied to Controlled Unclassified Information, and for most contractors requires a paid, formal C3PAO assessment. That structural difference, not company size, is why the two budgets look nothing alike.
What Drives Cost Within Level 2
- CUI scope, not headcount. A large company where CUI is isolated to one tightly controlled enclave can cost less than a smaller company where CUI touches the whole network. Scoping down where CUI actually flows is the single biggest lever available.
- Starting maturity against NIST 800-171. Contractors already running strong access control, encryption, and logging have less to remediate than those starting from a general IT baseline.
- POA&M eligibility. A limited number of lower-weighted controls can remain open on a Plan of Action and Milestones at assessment time, which reduces pre-assessment remediation pressure, but high-weighted controls, especially multi-factor authentication, generally must be fully implemented first.
- C3PAO selection and availability. Assessor day rates and scheduling lead times vary, and C3PAO capacity has been a genuine constraint industry-wide.
Not sure which level your contracts actually require?
Level flows down from the data you handle, not your size. We'll help you confirm it before you budget.
Get a Free QuoteThe Recertification Cycle
Unlike SOC 2's annual full-audit cycle, CMMC certification is generally valid for three years, closer in structure to ISO 27001, with an annual self-affirmation of continued compliance required in the interim rather than a full reassessment. Budget the bulk of your spend in the initial certification year and the year-three recertification, with lighter ongoing cost in between to maintain the affirmation and keep controls operating.
Subcontractors and Flow-Down
Under DFARS 252.204-7021, prime contractors must flow CMMC requirements down to every subcontractor and supplier who processes, stores, or transmits FCI or CUI on their behalf. The required level is set by what data reaches the subcontractor, not by the prime's own level or the subcontractor's size. A small subcontractor that never receives CUI may only need Level 1; one that does, regardless of headcount, needs Level 2.
Preparing for a Level 2 assessment?
We scope CUI boundaries, remediate against NIST 800-171, and prepare you for C3PAO assessment, 3,000+ organisations guided to certification.
Talk to an Avantcert ExpertFrequently asked questions about CMMC certification cost
Why is CMMC Level 2 so much more expensive than Level 1?
Level 1 covers 17 basic safeguarding practices and is self-assessed at no external audit cost. Level 2 covers all 110 controls from NIST SP 800-171 and, for most contractors handling CUI, requires a paid third-party assessment by a C3PAO. The jump reflects both a much larger control set and a mandatory external audit that Level 1 doesn't have.
Does CUI scope affect cost more than company size?
Often, yes. A 200-person contractor where CUI touches only one isolated enclave can cost less to certify than a 40-person contractor where CUI is spread across the whole network, because C3PAO assessment days and remediation effort scale with how much of your environment is actually in scope, not with headcount alone.
What is a POA&M and does it reduce cost?
A Plan of Action and Milestones documents NIST 800-171 controls not yet fully implemented, with a committed closure timeline, typically 180 days. A limited number of lower-weighted controls can remain open on a POA&M at assessment time, which can reduce pre-assessment remediation cost, but high-weighted controls, particularly multi-factor authentication, generally cannot, and missing them can fail the assessment.
How much does a C3PAO assessment itself cost, separate from preparation?
Typically $15,000 to $50,000 depending on company size and CUI scope, billed by the C3PAO for the assessment days themselves. This is separate from, and usually smaller than, the preparation and remediation work needed to actually be ready for the assessment.
Does CMMC certification cost recur annually like SOC 2?
No. A CMMC certification is generally valid for three years, similar in structure to ISO 27001, with an annual self-affirmation of continued compliance required in between rather than a full reassessment. The large cost is concentrated in the initial certification and the year-three recertification, not spread evenly across every year.
Can a small subcontractor avoid Level 2 costs entirely?
Only if CUI genuinely never reaches them. Under DFARS 252.204-7021, the required level flows down based on what data a subcontractor actually processes, stores, or transmits, not their size. A small subcontractor that only ever touches Federal Contract Information, not CUI, may only need Level 1. One that receives CUI needs Level 2 regardless of headcount.
Is it cheaper to prepare for CMMC using NIST 800-171 consulting versus a dedicated CMMC readiness firm?
The underlying control set is identical, since CMMC Level 2 is built directly on NIST SP 800-171, so cost differences come down to the provider's rate and experience with C3PAO assessment expectations specifically, not the framework itself. A firm that has taken contractors through actual C3PAO assessments typically catches gaps a generic NIST consultant misses.
Does the 2026 Phase 2 pause change what we should budget right now?
Not for contractors with a level already required in a signed contract, those obligations remain in force regardless of the pause. For contractors without a contractual deadline yet, the pause is a reasonable window to complete preparation work ahead of mandatory third-party assessments resuming, rather than a reason to delay budgeting entirely.
About Avantcert. Avantcert is a compliance consultancy that has guided 3,000+ organisations across 40+ markets through CMMC readiness, NIST 800-171 remediation, and C3PAO assessment preparation. See our CMMC certification service or request a free quote.