CMMC guide

What CMMC Level 2 costs

DoD estimated that a small business would spend about $37,196 over three years on a Level 2 self-assessment, or about $104,670 over three years on a Level 2 C3PAO certification assessment. Those estimates cover assessing, not implementing: DoD assumed the 110 requirements of NIST SP 800-171 were already in place, so the work of getting there is on top.

Last checked: October 29, 2026.

DoD's estimates for a small business

From the regulatory analysis DoD published with the CMMC program rule. Assessment and affirmation costs only.

DoD's estimated CMMC assessment costs for a small entity
Assessment	DoD estimate	What it covers
Level 1 self-assessment	$5,977 a year	Planning, the self-assessment, reporting in SPRS and the annual affirmation.
Level 2 self-assessment	$37,196 over 3 years	The self-assessment and the affirmations over the three years.
Level 2 C3PAO certification	$104,670 over 3 years	The C3PAO assessment (DoD assumed about 120 assessor hours), your own and consultant time to support it, and the annual affirmations.
Level 3 DIBCAC assessment	$12,802 over 3 years, plus Level 2 certification	The Level 3 assessment only. DoD separately estimated about $2.7 million one-time and $490,000 a year to implement the extra Level 3 requirements.

While Phase 2 is suspended, current DoD solicitations designate only Level 1 or Level 2 self-assessments, so the C3PAO cost isn't required today. It is expected to return when Phase 2 resumes. See CMMC Phase 2 suspended: what still applies.

What the estimates leave out

DoD's analysis doesn't count the cost of implementing NIST SP 800-171 or FAR 52.204-21, because contracts with DFARS 252.204-7012 have required those safeguards for years. For a contractor that hasn't finished that work, implementation is usually the larger part of the bill. These are the main drivers:

Scope

How many people, systems and locations handle CUI. A tight boundary, or a separate environment just for CUI, reduces almost every other cost.

Identity and access

Multi-factor authentication, least privilege and account reviews across every system in scope.

Encryption

Encryption of CUI must use FIPS-validated cryptography, which can mean changing tools or cloud tenants.

Logging and monitoring

Collecting, keeping and reviewing audit logs, and reporting incidents within 72 hours.

Policies and evidence

Written policies and procedures for the 14 requirement families, plus the records that show they're followed.

People and time

Your own staff time is often the biggest single line, with outside help where you don't have the expertise.

Where TractionGRC fits in the budget

TractionGRC is one line in that budget: the platform where you track the requirements, owners, evidence, policies and gaps. CMMC Level 1 is on Starter ($349 a month) and Level 2 on Professional ($999 a month, or $9,990 a year billed annually).

It reduces staff time on documentation and evidence, and an existing ISO 27001 program carries over through the mapped controls. It doesn't replace the changes to your environment or an assessor.

CMMC in TractionGRC Compare plans Free tool: stack check

This is a summary, not financial or legal advice. Your costs depend on your scope and what is already in place.

Questions

How much does a CMMC Level 2 assessment cost?

DoD estimated about $104,670 over three years for a small business to go through a Level 2 C3PAO certification assessment and the annual affirmations, and about $37,196 over three years for a Level 2 self-assessment. Those figures cover the assessment, not the work of implementing the 110 requirements.

Do I have to pay for a C3PAO assessment now?

Not for current DoD solicitations. While Phase 2 is suspended, they designate only Level 1 or Level 2 self-assessments. Third-party assessments are expected to return when Phase 2 resumes.

Why are the real costs higher than DoD's estimates?

DoD assumed the NIST SP 800-171 requirements were already in place, because DFARS 252.204-7012 has required them for years, so its estimates leave out implementation. For a contractor that hasn't finished that work, implementation is usually the largest cost.

What drives the cost of implementation?

Mostly scope: how many people, systems and locations touch CUI. A tight boundary, or a separate environment for CUI, shrinks everything else. After that come multi-factor authentication, validated encryption, logging and monitoring, written policies and procedures, and your own staff time.

What does TractionGRC cost for CMMC?

CMMC Level 1 is on Starter at $349 a month and Level 2 on Professional at $999 a month, or $9,990 a year billed annually. That covers the platform, not an assessor or the changes to your environment.