CMMC Level 2 Assessment Cost: DoD Puts the C3PAO Fee at $31,234 to $52,056, and the Third-Party Mandate Is Suspended

As of November 5, 2026, the CMMC Level 2 assessment cost in DoD’s own rule is $37,196 to $48,827 over three years for a self-assessment and $104,670 to $117,768 with a C3PAO, of which the assessor’s fee is $31,234 to $52,056. Those figures exclude implementation. New C3PAO requirements have been suspended since July 13, 2026.

Not a quote, not legal advice. Actual C3PAO prices are set by each firm; check your solicitation and contracting officer for what applies to you.

DoD’s table: what each path costs, by phase and company size

These are the figures in Tables 9 and 10 of the regulatory impact analysis inside the October 15, 2024 final rule (89 FR 83178), with the C3PAO line separated using the rule’s own line items at 89 FR 83185 and 83186. They are per assessment of one contractor information system, in 2023 dollars.

Tables 9 and 10 print “Conduct” with the C3PAO engagement included: $76,743 (small) and $80,656 (other). Two stated assessment-plus-affirmation figures differ from the sum of their parts by $1 ($34,277 and $112,345), which DoD calls a “minor rounding difference” in the second case, and the estimator uses the sum. Hours are our sum of DoD’s line items.

Two things stand out once the fee is pulled apart. First, moving from self-assessed to C3PAO costs almost the same at either size, $67,474 or $68,941. Second, the small-entity model pays outsiders more for preparation than for the audit: 176 ESP hours worth $45,809 against 120 C3PAO hours worth $31,234. The rule’s reason is that “small entities are likely to outsource IT and cybersecurity to an External Service Provider”. On a Level 2 (Self), the 88 ESP hours are worth $22,905, or 62% of the total.

The labor rates DoD used

89 FR 83180. In-house rates include a 30% factor for fringe and employee-related expenses. Small entities use MGMT5, IT4-SB and ESP only. DoD’s $260.28 can be set against the contract labor rates in our IT hourly rates report.

What the estimate leaves out

The rule says plainly that “cost estimates are not included for an entity to implement the CMMC Level 1 or 2 security requirements, maintain implementation of these existing security requirements, or remediate a plan of action for unimplemented requirements”. DoD’s reason is that DFARS 252.204-7012 has required NIST SP 800-171 since December 31, 2017. It also assumes “the OSA passes the assessment on the first attempt” and counts one information system per small entity. And DoD warns that its numbers are “representative of average assessment efforts not actual prices of C3PAO services available in the marketplace”.

The model does give a useful sanity test. Split evenly, both C3PAO profiles work out to 40 hours per assessor (120 hours across 3 people, 200 across 5). DoD’s Level 2 Assessment Guide lists 320 assessment objectives across the 110 requirements, by our count, so the budget is 22.5 team-minutes per objective at the small profile and 37.5 at the larger one, including planning and reporting.

One slip to know about: the reaffirmation line for other than small entities prints “IT4 for 8 hours” next to $1,560, but 8 hours at $97.49 is $780. The $2,712 annual figure only adds up at 16 hours, the number used in the same section’s reporting line, so we keep DoD’s dollar figure.

The 48 CFR acquisition rule is a different number

The September 10, 2025 DFARS rule (90 FR 43560) carries its own, far smaller estimate, and it should not be added to the figures above. DoD says that analysis “only includes a cost analysis of the contractual requirements to upload self-assessments and complete affirmations in SPRS”: 5 minutes each to post a score, affirm and retrieve identifiers, across an assumed average of 5 information systems. Its public cost is $38,580,316 a year at a 3% discount rate and $36,271,632 at 7%, over 10 years. The 32 CFR rule’s public cost is $3,989,182,374 a year at 7% over 20 years (Table 11). DoD’s Level 2 (C3PAO) line alone reaches $19.52 billion over its first 10 years (Table 22). Demand counts and assessor capacity are tracked in our CMMC certification statistics.

Market anecdotes, kept apart from DoD’s numbers

Where the vendor numbers and DoD’s numbers disagree

1. “$105,000 to $118,000” is not an assessment fee. It is DoD’s three-year, all-in number. cmmc.com lists it under “Assessment fees (per DoD estimates)”, PreVeil under “CMMC Assessment Fees by Level”, and Secureframe says “a Level 2 third-party assessment will cost” that amount (while noting that it includes affirmations). Yet DoD’s fee is 30% of that total for a small entity and 44% for a larger one.
2. DoD’s small-entity fee sits at the bottom of the market claims. Three fee ranges start between $30,000 and $35,000, right beside DoD’s $31,234, and run to $75,000 or $150,000. That spread is 2.4 to 4.8 times DoD’s figure. Divide those prices by DoD’s hours and $35,000 for 120 hours implies $292 an hour, while $75,000 for 120 hours implies $625, against DoD’s $260.28. The rule leaves pricing open: “Market forces of supply and demand will determine C3PAO pricing”.
3. Re-assessment discounts are not in DoD’s model. PreVeil budgets a three-year re-assessment at $15,000 to $50,000+. Workstreet says fees “will be similar” to the first. DoD agrees with Workstreet: in Table 21, Year 4’s 12,675 small-entity assessments are 12,293 new entities plus the 382 from Year 1 repeating, and the year’s $1,301,872,564 total matches the full $101,752 unit price within rounding. No certificate issued under the December 16, 2024 rule reaches its three-year mark before December 2027, so renewal pricing is still mostly theory.
4. A figure attributed to DoD that we cannot find. IBSS writes that “According to Department of Defense estimates, the 3-year cost for small defense contractors averages $487,970”. That number appears nowhere in the text of the 2024 or 2025 final rules, or in Tables 9 and 10. DoD’s small-entity figure is $104,670, so the claim is 4.7 times larger.
5. A second federal agency is far higher. The SBA’s July 13, 2026 release says “total compliance costs can reach approximately $593,800 per CMMC certification” for small firms needing third-party assessment and “about $388,600” for self-assessment: 5.7 and 10.4 times DoD’s three-year figures. These are not like-for-like, since DoD excludes implementation and SBA says “total”, but the release gives no method, so the gap cannot be reconciled from public text. The suspension memo itself now cites “prohibitive compliance costs”.
6. All-in ranges measure something else. Paramify’s $63,000 to $200,000+, Workstreet’s $50,000 to $200,000+, PreVeil’s and IBSS’s $75,000 to $300,000 and a Medium post’s $150,000 to $400,000 over three years include remediation and tools that DoD excludes by design. They cannot be read as evidence that DoD miscounted the assessment.
7. “Small” is not 500 employees in the rule. Vanta’s table labels DoD’s small-entity column “500 or fewer employees”. The rule’s footnote 38 points instead to “the small business criteria and size standards provided in 13 CFR 121.201”, with no flat headcount.
8. Most top-ranking pages do not mention the suspension. Of the 8 top-10 pages we could read, 2 (Paramify and Secureframe) mention it. PreVeil (August 21, 2026) and IBSS (September 9, 2026) were published after it, and the text we could read does not mention it; PreVeil still says organizations handling CUI will need a C3PAO assessment every three years.

Searchers also ask about California and Reddit. DoD’s estimate has no geographic variable at all. IBSS claims West Coast contractors pay up to 28% more than Midwest ones, with no source we could check. The Reddit thread that ranks on page one says, in Google’s snippet, that “the certification audit itself can cost 20-50k”.

What triggers a C3PAO instead of a self-assessment

A company does not pick. Under 32 CFR 170.3(d), DoD program managers or requiring activities select the CMMC Status based on the information the contractor will handle, and under DFARS 204.7502 a contracting officer may not award to an offeror without a current status at the required level for every system that will touch FCI or CUI. The July 13, 2026 memo then narrowed the options to self-assessments.

The detail that changes a budget:

• Active solicitations and contracts. The attachment orders amendments “explicitly removing” C3PAO and DIBCAC requirements from active solicitations, and says contracting officers “are directed to remove them via modification” before the next option period or at the next scheduled administrative modification.
• Subcontractors. Under 170.23, FCI-only subs need Level 1 (Self), and CUI subs need at least Level 2 (Self), or Level 2 (C3PAO) when the prime contract requires it. With the C3PAO designation barred, that last branch has nothing to attach to on new DoW awards.
• Already certified. Under 170.17(a), a Level 2 (C3PAO) status also satisfies Level 1 (Self) and Level 2 (Self) for the same scope, so a current certificate still answers a self-assessment requirement if it is kept alive with annual affirmations.
• Choosing a C3PAO anyway. The rule’s preamble says companies “may elect to complete a self-assessment or pursue a certification assessment at any time”. FAQ C-A11 says paper-only CUI handlers need no third-party assessment but may elect one.
• DIBCAC carryover. Under 170.20, a perfect-score DIBCAC High assessment from before the rule’s effective date converts to Final Level 2 (C3PAO), valid three years from the original assessment date.

Dated status table

Enclave or whole network: what scope does to the bill

DoD’s cost tables have a size variable and no scope variable. Yet the rule says “the size and complexity of the network within the scope of the assessment impacts the costs as well”. So the honest estimator input is how many separately assessed scopes you have, plus which of DoD’s two team profiles fits. The preamble allows either route: a company “can achieve a specific CMMC Level for its entire enterprise network or an enclave(s)”.

Enclaves can shrink what is assessed, but they are not a free pass. A certificate “applies only to the assessed CMMC Assessment Scope”. An enclave can draw on enterprise controls, yet “it cannot inherit the enterprise certification”, and “Enclaves beyond the certified CMMC Assessment Scope must be assessed separately”. DoD’s scoping guide adds “There is no established metric for inherited implementations”, and all requirements inside the enclave must still be MET. Two FAQ answers help: encrypted CUI crossing enterprise network gear does not pull that gear into scope if the enclave is otherwise logically separated (F-A4), and an endpoint limited to keyboard, video and mouse with a VDI session is out of scope when configured that way (F-A1).

MSPs and ESPs: the 32 CFR 170.19 rules that decide your role

Under 170.4, an External Service Provider must have “CUI or Security Protection Data (e.g., log data, configuration data)” processed, stored or transmitted on its assets. If it has neither, it is not an ESP for CMMC purposes. Security Protection Data includes configuration data, log files, “data related to the configuration or vulnerability status of in-scope assets” and passwords. Read against that wording, a tool that stores patch status, EDR logs or admin credentials for a client’s scope is hard to place outside it.

Table 4 to 32 CFR 170.19(c)(2)(i), paraphrased. Current to November 3, 2026.

What this means for MSPs

For a small client that would have needed a C3PAO under Phase 2, the suspension moves the near-term bill from $104,670 to $37,196 in DoD’s model, and that self-assessment model still assumes 88 ESP hours from someone like you, worth $22,905 at $260.28. It lowers paperwork pressure, not the underlying duty: the affirming official still attests every year that requirements are implemented, and DIBCAC retains the right to assess.

Three things are worth doing this quarter. Write the service description and customer responsibility matrix now, because 170.19(c)(2)(ii) requires both whenever you qualify as an ESP, and a client’s SSP has to refer to them. Map which of your tools hold SPD, since that one test decides whether you are in the client’s scope. Do not pitch a C3PAO engagement for your own firm as a requirement: the FAQ says it is optional, DoD published no price for it, and the program’s next shape is unknown. If you want it anyway, run the estimator with your own size to see DoD’s figure. DoD’s ESP line is paid work for a sector whose jobs, wages and establishments we track in our MSP industry statistics.

What you have to pass: 110 requirements, 88 points, 180 days

CMMC Level 2 is the 110 security requirements in NIST SP 800-171 Rev. 2, in 14 families, with 320 assessment objectives in DoD’s guide. Each is scored MET, NOT MET or not applicable (which counts as MET); the maximum is 110 and every NOT MET subtracts its value, which by our sum of the 170.24 point values can drive a score to -203. A conditional status needs at least 88 points (a ratio of 0.8), so at most 22 points can be open.

Only 47 of the 110 can sit on a plan of action and milestones. Under 170.21(a)(2), nothing worth more than 1 point qualifies except FIPS-unvalidated encryption, and six requirements are barred by name: the SSP (3.12.4), external connections (3.1.20), public information control (3.1.22) and visitor escort, physical access logs and physical access management (3.10.3 to 3.10.5). That leaves 63 requirements that must be MET on assessment day.

Requirements counted from NIST SP 800-171 Rev. 2. Objectives counted from DoD’s CMMC Level 2 Assessment Guide, version 2.13. Points from 32 CFR 170.24. Rows may not sum to the requirement count, because MFA (3.5.3) and FIPS encryption (3.13.11) score 3 or 5 and the SSP (3.12.4) has no point value.

• Closeout. NOT MET items on the POA&M must be fixed and closed out within 180 days of the Conditional CMMC Status Date. A C3PAO must perform the closeout for a certification assessment; a company performs its own for a self-assessment. DoD’s Level 2 tables carry $0 for this.
• One shot. FAQ C-A8: a closeout “can only be finalized” in eMASS “one time”. If anything is still NOT MET, the conditional status terminates and the company “will have to begin again with a new assessment”. The estimator’s rerun box prices that case.
• Re-evaluation. In a certification assessment, a NOT MET can be re-evaluated during the assessment and for 10 business days afterward if the findings report has not been delivered (170.17(c)(2)).
• Validity. Three years from the CMMC Status Date (Table 1 of the rule). The conditional date stays the status date after a successful closeout, so a closeout does not extend it.
• Affirmations. After each assessment, after any closeout, and annually. Table 1 of the rule says the assessment “will lapse upon failure to annually affirm”. DoD prices each at $1,459 (small) or $2,712 (other).
• Records. Assessment artifacts must be kept six years from the status date.

Frequently asked questions

How much does a CMMC Level 2 assessment cost?

DoD’s own estimate is $37,196 (small) to $48,827 (other) over three years for Level 2 (Self), and $104,670 to $117,768 for Level 2 (C3PAO). The C3PAO’s share is $31,234 to $52,056. Those are 2023 dollars and exclude implementing the 110 requirements. C3PAOs set their own prices: third-party claims run from about $30,000 to $150,000 for the fee.

Can you self assess CMMC Level 2?

Yes, when the solicitation designates Level 2 (Self). Since the July 13, 2026 suspension it is the only Level 2 designation Department of War program managers may use. The company self-assesses every three years against all 110 requirements, posts the score in SPRS and affirms annually. DoD’s estimate is $37,196 to $48,827 over three years, and its small-entity model assumes 88 hours of outside ESP help.

How long does it take to become CMMC Level 2 certified?

DoD publishes no end-to-end timeline for a C3PAO certification in the rule or its FAQ. Its cost model budgets a C3PAO team 120 hours (3 people) or 200 hours (5 people), which is 40 hours per assessor. A NOT MET item can be re-evaluated for 10 business days after the active assessment, and a plan of action must be closed within 180 days. Third-party claims range from six months to one year (Medium) to 12 to 18 months (IBSS); we could not verify them.

Is CMMC Level 2 still required?

Yes, as a self-assessment. On July 13, 2026 the Department of War suspended the move to Phase 2, so C3PAO and DIBCAC requirements may not be designated, but it said Phase 1 self-assessment requirements remain in place and DFARS 252.204-7012, which requires NIST SP 800-171, stays in effect. As of November 5, 2026 no replacement guidance is posted on the DoW CIO CMMC page.

Does an MSP need its own CMMC certification?

No. The DoW FAQ says an MSP is not required to have its own CMMC assessment, even when it stores CUI on a non-cloud system. Its services are instead assessed inside the client’s scope. An MSP may choose to get assessed to shorten client assessments, but the level and type must match or exceed the client’s contract requirement. DoD publishes no cost figure for that choice.

How much does CMMC Level 1 cost compared with Level 2?

DoD estimates Level 1 (Self) at $5,977 a year for a small entity and $4,042 a year for others. It covers 15 FAR requirements and allows no plan of action. Level 2 (Self) is $37,196 to $48,827 every three years and covers 110 NIST SP 800-171 Rev. 2 requirements.

Methodology

References

1. Federal Register, Cybersecurity Maturity Model Certification (CMMC) Program, 89 FR 83092, October 15, 2024. Accessed November 2026.
2. GovInfo PDF of the same rule (Tables 9 to 13 at pages 83178 to 83180, Tables 20 to 22 at pages 83185 to 83187). Accessed November 2026.
3. Federal Register, DFARS: Assessing Contractor Implementation of Cybersecurity Requirements, 90 FR 43560, September 10, 2025. Accessed November 2026.
4. eCFR, 32 CFR Part 170 (sections 170.3, 170.4, 170.16, 170.17, 170.19, 170.20 to 170.24), current to November 3, 2026. Accessed November 2026.
5. U.S. Department of War, “Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements,” July 13, 2026. Accessed November 2026.
6. DoW CIO memo, “Removing Barriers to Defense Industrial Base Expansion,” July 13, 2026. Accessed November 2026.
7. DoW CIO, Implementing Suspension of CMMC Phase II, with Attachment 1, July 13, 2026. Accessed November 2026.
8. DoW CIO, Cybersecurity Maturity Model Certification page. Accessed November 5, 2026.
9. DoW CIO, CMMC Frequently Asked Questions (revision history through 2.4, July 13, 2026). Accessed November 2026.
10. DoD CIO, CMMC Scoping Guide Level 2, version 2.13. Accessed November 2026.
11. DoD CIO, CMMC Assessment Guide Level 2, version 2.13. Accessed November 2026.
12. NIST SP 800-171 Rev. 2. Accessed November 2026.
13. U.S. Small Business Administration, news release 26-73, July 13, 2026. Accessed November 2026.
14. Covington, Inside Government Contracts, “CMMC Reform Task Force Updates September 2026,” September 21, 2026 (secondary, for report status only). Accessed November 2026.
15. The Cyber AB, Terms of Use (bots and automated data gathering prohibited; marketplace not scraped). Read October 2026.
16. cmmc.com, September 22, 2025 (third-party claim); Paramify (third-party claim); Workstreet, January 23, 2026 (third-party claim); PreVeil, August 21, 2026 (third-party claim); Secureframe (third-party claim); Vanta (third-party claim); IBSS on LinkedIn, September 9, 2026 (third-party claim); Tyson Martin on Medium, December 6, 2025 (third-party claim). Accessed November 2026.