Ask ten consultants what CMMC certification costs and you will get ten ranges. Having delivered CMMC Level 2 remediation for defense contractors, here are the real numbers for 2026 – and the scoping decisions that swing them by six figures.
The short answer
For a small-to-mid defense contractor pursuing CMMC Level 2 in 2026: $75,000-$150,000 in year one is the realistic all-in range, with the C3PAO assessment itself running $30,000-$70,000. Level 1 (FCI only) is dramatically cheaper – typically $3,000-$10,000 of mostly internal effort, since it is an annual self-assessment. Estimate your own numbers in two minutes with our free CMMC Cost & Roadmap Planner.
What actually drives the cost
1. Scope: enclave vs enterprise (the six-figure decision)
The single biggest lever. Bring your whole network into scope and every control applies everywhere; build a tight CUI enclave (PreVeil, Exostar, or a ZTNA-segmented environment) and you can roughly halve implementation cost. Most of the variance between a $60K journey and a $200K journey is decided here, in month one.
2. Your data classification
CUI Basic can live on a FedRAMP Moderate baseline. ITAR/EAR and CUI-Specified data push you toward GCC High and US-person-only access controls – higher licensing, higher admin cost. FCI-only contractors may not need Level 2 at all.
3. Your starting SPRS score
A contractor starting at 45 has a very different remediation bill than one starting at 95. Baseline yourself honestly with our free SPRS Score Calculator – all 110 requirements with the official DoD weights.
4. Ongoing costs nobody budgets
Certification is not one-and-done: annual affirmations, continuous monitoring, log retention, evidence upkeep and a triennial reassessment. Budget $1,500-$5,000/month for managed continuous compliance depending on size – still far below the cost of a failed assessment or a lost contract.
Typical 2026 cost breakdown (Level 2, ~50-employee contractor, enclave scope)
- Gap assessment and scoping: $5,000-$15,000
- Enclave platform and licensing (year one): $10,000-$30,000
- Control implementation and remediation: $15,000-$40,000
- SSP, POA&M and evidence preparation: $8,000-$20,000
- C3PAO assessment: $30,000-$70,000
How to cut the bill without cutting corners
Scope ruthlessly (fewest possible CUI users and systems), digitize paper CUI so physical controls drop out of scope, use native cloud backups instead of third-party tools that fail assessments, reuse overlap with ISO 27001/SOC 2 if you hold them, and use timezone-advantaged delivery: our international CMMC practice and hybrid team typically undercuts US-only consultancies by 30-50% for the same outcome.
CMMC certification cost by company size (2026 modeled ranges)
These are modeled year-one ranges from our CMMC Cost Index 2026, built from real engagement scoping, published platform pricing and the DoD cost analysis in 32 CFR 170 — not a survey. Your position inside a range depends on your starting SPRS score and how tightly you scope.
| Contractor profile | Scope | Modeled year-one cost |
|---|---|---|
| Level 1, ~10 users (FCI only) | Whole environment, self-assessment | $2,000–$8,000 |
| Level 2, ~10 CUI users | Enclave (PreVeil/Exostar class) | $45,000–$115,000 |
| Level 2, ~25 CUI users | Enclave | $70,000–$120,000 (median ≈ $90,000) |
| Level 2, ~50 employees | Enclave | $75,000–$150,000 |
| Level 2, 100+ users | Enterprise-wide scope | $150,000–$250,000 |
| ITAR/EAR + CUI-Specified enterprise | GCC High, US-persons controls | $190,000–$330,000 |
Two rules of thumb hold across every profile: the C3PAO assessment is only 25–40% of the true year-one total, and a well-built enclave cuts the total by 40–60% versus enterprise-wide scope.
Level 1 vs Level 2 at a glance
| Level 1 (FCI) | Level 2 (CUI) | |
|---|---|---|
| Controls | 17 basic safeguards (FAR 52.204-21) | 110 NIST SP 800-171 requirements |
| Assessment | Annual self-assessment + affirmation | C3PAO assessment for most contracts (triennial) + annual affirmation |
| Typical year-one cost | $2,000–$10,000, mostly internal effort | $45,000–$250,000+ depending on scope |
| Ongoing | Minimal | $1,500–$5,000/month continuous compliance |
Not sure which level applies? If you only handle Federal Contract Information, Level 1 may be enough — check your DFARS clauses or ask us. If you touch CUI in any form, plan for Level 2. Our Level 1 vs Level 2 explainer covers the edge cases.
July 2026 update: budgeting during the Phase II suspension
On July 13, 2026 the Department of War suspended CMMC Phase II requirements for a 60-day Reform Task Force review. That pauses new C3PAO assessment mandates in contracts — it does not pause DFARS 252.204-7012, NIST 800-171, SPRS score submissions or Level 1/2 self-assessment obligations, which sit in clauses that remain in force.
For budgeting, the suspension is a window, not a waiver: C3PAO calendars have loosened, remediation lead times are shorter, and contractors who use the pause to close gaps will certify faster and cheaper when mandates resume than those who re-enter a crowded queue. Our scenario-by-scenario guide shows what still binds your specific contract mix.
When the money actually leaves your account
- Months 0–2: gap assessment and scoping — $5,000–$15,000
- Months 2–8: enclave build and remediation — the largest tranche, $25,000–$70,000
- Months 8–10: SSP, POA&M and evidence preparation — $8,000–$20,000
- Months 10–12: C3PAO assessment — $30,000–$70,000
- After certification: continuous compliance — $1,500–$5,000/month
Check your starting point first: run our free SPRS score calculator — a low score means more remediation budget; a score already near 110 means you are closer (and cheaper) than you think.
CMMC certification cost FAQ
How much does CMMC certification cost for a small business?
A small defense contractor (10–25 CUI users) pursuing Level 2 with an enclave typically spends $45,000–$120,000 in year one, all-in. Level 1-only small businesses usually spend under $10,000.
How much does the C3PAO assessment itself cost?
$30,000–$70,000 for most small-to-mid contractors — roughly 25–40% of the true year-one total. See our C3PAO cost breakdown for fee ranges by company size.
What does CMMC compliance cost per year after certification?
Budget $18,000–$60,000/year for continuous compliance: evidence upkeep, vulnerability management, annual affirmations and preparing for the triennial reassessment.
Can an enclave really cut CMMC costs by half?
Yes — across our modeled profiles an enclave saves 40–60% versus enterprise-wide scope, because 110 controls apply to a handful of users and systems instead of your whole network. The saving is largest when CUI touches fewer than a third of your staff.
Should I still budget for CMMC during the 2026 suspension?
Yes. NIST 800-171, DFARS 7012 and SPRS obligations remain in force, primes are still flowing requirements down, and remediation done during the pause is cheaper than remediation done in a post-suspension rush. Treat the 60-day review as schedule relief, not budget relief.
Get a firm number
Run the free planner for your estimate, then book a free scoping call – we will verify your scope and give you a fixed-fee phase plan.