CMMC cost estimator

What the Phase 2 suspension changes for your budget

DoD wrote its estimates for a program that would add the third-party Level 2 (C3PAO) assessment to contracts in Phase 2. That step is suspended, so the two paths marked “Suspended today” in the estimator are what a contract would have asked for, not what contracts are adding now (a shop can still price a C3PAO it books by choice; see the FAQ). Here is what binds as of the date on the box:

For budgeting, that leaves two live lines: the Level 1 (Self) or Level 2 (Self) assessment a contract may still require, and the NIST SP 800-171 Rev 2 work DFARS 252.204-7012 has required all along. The second one is the line DoD's estimate does not cover. If you are not sure which level your contracts carry, the CMMC level finder walks the clauses, and the CMMC status page tracks the reform.

What DoD counted, and what it left out

DoD's numbers price four things: getting ready for the assessment, sitting it, reporting the result into SPRS, and the senior official's affirmation. They do not price becoming compliant. For Levels 1 and 2 DoD treated that as money already spent:

So the estimator has one line DoD left blank, “Implementing the requirements”. That is where a shop that has not finished its 110 requirements puts its enclave, its tools and its remediation quotes. Score where you stand first with the SPRS score calculator; the gap list it gives you is what that line has to pay for.

Three more assumptions sit under every figure:

• You pass first time. “Assessment costs assume the OSA passes the assessment on the first attempt (conditional--with an allowable POA&M or final)” (89 FR 83179). A failed assessment and a second visit are not in the number.
• A small shop buys help. DoD assumed small entities “are likely to outsource IT and cybersecurity to an External Service Provider (ESP)” and priced that outside help at $260.28 an hour, the same rate it used for an assessor (Table 13).
• Staff time is loaded. “A factor estimate of 30 percent was added to the labor rate per hour” for fringe and employee-related expenses (89 FR 83180). The director's hour is $190.52.

Level 3 is the exception: it is the one level where DoD did price the security work, because the NIST SP 800-172 requirements it adds were new. Even then, the rule is plain that the bill stacks:

The estimator adds the Level 2 (C3PAO) cycle to every Level 3 figure for that reason.

How to use the cost estimator

1. 01Pick your size. Small means you meet the SBA size standard for your industry under 13 CFR 121.201; DoD used Table 10 for small entities and Table 9 for everyone else.
2. 02Pick the path your contract names. DFARS 252.204-7021 states it as Level 1 (Self), Level 2 (Self), Level 2 (C3PAO) or Level 3 (DIBCAC). A subcontractor that handles CUI needs at least Level 2 (Self); one that handles only FCI, Level 1 (Self) (32 CFR 170.23).
3. 03Count your assessment scopes. DoD priced one contractor information system per company. Most small shops have one enclave or one network; enter more only if you run separately assessed systems.
4. 04Type your quotes. Put each quote you hold beside DoD's line: a consultant's prep fee, an assessor's quote, your own hours. The difference column shows where you sit against DoD's assumption.

Every figure is DoD's, in 2023 dollars, from the cost analysis published with the CMMC Program final rule. The page shows no vendor, consultant or assessor price; those are yours to collect and type in.

Worked example: a 40-person machine shop, six years

A small shop machines brackets for a prime and keeps the drawings in one enclave. Its prime has asked about CMMC Level 2. Here is what DoD's own tables say the two Level 2 paths cost that shop over two 3-year cycles.

The certified path costs $134,948 more over six years. Only $62,468 of that is the assessor: DoD priced the C3PAO engagement at 120 hours of a 3-person team at $260.28, or $31,234 a cycle. The other $72,480 is the shop's own extra preparation, the director's hours and the outside help it buys to get through a third-party visit. DoD's narrative rounds the self-assessment year to $34,277; the table's phases add to $34,278.

What DoD assumed a C3PAO costs

DoD did not survey assessor prices. It priced the engagement as hours at one rate, $260.28 an hour for a “Cyber Subject Matter Expert” with four years' experience, a rate that includes “the labor rate, overhead expense, G&A expense, and profit” (Tables 12 and 13):

Treat the figure as a yardstick for a quote, not a price list. The estimator shows it under its “Conduct the assessment” row; the rest of that row is your own staff and outside help during the visit, so set an assessor's quote against the C3PAO part, not the whole row. Who may assess you, and who may not because they helped you prepare, is covered in what a C3PAO is and the CMMC consultants compare.

DoD's two tables, as published

These are the per-assessment tables the estimator reads, from the cost analysis DoD printed with the CMMC Program final rule on 2024-10-15 (89 FR 83092). DoD costed everything in 2023 dollars and counted one assessed system per company. Table 9 prints the Level 3 total as $44,444; the narrative beside it adds the same parts to $44,445.

Questions about CMMC cost

Small shop working out where to start? The CMMC requirements for small business guide lays out the order, and the scoping worksheet shrinks what an assessment has to cover. In DoD's words, “the size and complexity of the network within the scope of the assessment impacts the costs as well” (89 FR 83152).