Resources / CMMC cost guide
How Much DoesCMMC Cost?
Last reviewed: October 15, 2026
It depends mostly on how much work your environment needs to meet the requirements, and that is the part DoD’s published estimates leave out. DoD estimates that, for a small business, a Level 2 self-assessment costs on the order of $35,000 and a third-party Level 2 assessment on the order of $100,000, each over a three-year cycle. Those figures cover preparing for and conducting the assessment, reporting it and affirming annually. They do not include the cost of implementing the security requirements.
Current status, October 15, 2026
DoD suspended CMMC Phase 2 on July 13, 2026, so third-party (C3PAO) assessments are not being required in new or existing contracts while a reform task force reviews the program. Level 1 and Level 2 self-assessments, SPRS scores, annual affirmations, and DFARS 7012 with NIST SP 800-171 still apply, and voluntary C3PAO assessments remain available. That makes the third-party assessment fee below optional for now, unless your prime or contract still requires it. See the details.
What DoD’s estimate covers
Published figures for small entities, as reported by Greenberg Traurig, vary slightly between sources and are approximate:
| Item | Roughly, per three-year cycle |
|---|---|
| Level 2 self-assessment | About $33,000 to $37,000 |
| Level 2 third-party (C3PAO) assessment | About $100,000 to $105,000 |
| Annual affirmation | About $1,500 each year |
DoD does not count implementation costs in these figures, because it treats those as part of existing requirements under DFARS 252.204-7012. Implementation costs depend on your environment and vary widely.
What actually drives your cost
- Scope. The number of systems, people and vendors that handle CUI is the biggest lever. A small enclave costs far less to secure than a whole company network.
- Where you start. Organizations that already follow NIST SP 800-171 have a shorter path than those starting from scratch.
- Technology gaps. Common ones are multi-factor authentication, logging and monitoring, encryption, endpoint protection and a compliant cloud for CUI.
- Documentation. A system security plan, policies and procedures take time to write properly, and assessors read them.
- Staff time. Your people will spend real hours collecting evidence and being interviewed.
- Ongoing operation. Controls must keep running after the assessment, with monitoring, reviews and an annual affirmation.
What Logos support looks like
Build your CMMC stack
You choose what you need. If you already own a tool that meets a control, you pay only for the gaps. Most clients land on a documentation package, one cloud enclave, and a handful of security solutions.
Documentation
One time
A written package: policies, procedures, system security plan, plan of action and milestones, shared responsibility matrix and tailored training. Starts from $10,000.
Cloud enclave
Choose one
Pick the environment that fits your CUI. FedRAMP High for ITAR and specified CUI, FedRAMP Moderate for CUI basic, or an encrypted email and drive option for organizations staying on commercial Microsoft 365. Enclave seats start around $60 per user per month.
Security solutions
Pick what you need
Endpoint protection, firewall, logging and SIEM, security awareness training and backups. Each is priced as its own line, so you only buy what your current tools do not already cover.
Managed services
Monthly
24/7 monitoring and management of the systems in scope, priced per device.
Optional hardware
As required
FIPS-validated security keys and encrypted drives, only where your contract calls for them.
These are starting points, not a quote. Cost moves with scope, user count and the tools you already run, and Logos prepares you for assessment but is not a C3PAO. Request a scoping call for a written estimate.
How to estimate your own cost
- Confirm which level your contract requires.
- Map where CUI lives and decide whether to contain it. See CUI scoping and enclave design.
- Run a gap assessment against the 110 requirements to see how much is missing.
- Price the fixes: tools, services and staff time.
- Add the assessment fee if your contract requires a third party, plus the yearly affirmation.
How to lower the cost
- Shrink the scope before you buy anything.
- Fix the biggest gaps first, and reuse tools you already own where they meet the requirement.
- Combine work with other frameworks you need, such as HIPAA or SOC 2, so you collect evidence once.
- Plan early. Rushing near an assessment deadline usually costs more.
Frequently asked questions
Is a self-assessment really cheaper?
Yes, in DoD’s estimate, but whether you may self-assess is set by your contract, not by cost.
What is not in DoD’s estimate?
The cost of implementing the security requirements: tools, services and staff time to close your gaps.
Can you give me a quote from this page?
No. Prices vary with scope. A short scoping conversation is the fastest way to a real number.
Get a realistic number for your environment.
Call 877-855-CMMC or email [email protected]. Related: CMMC readiness, CMMC Level 2.