CMMC Certification Cost: Department of War's Estimate and What Sellers Quote

The Department of War estimates the cost of a CMMC Level 2 C3PAO certification assessment at $101,752 for a small entity and $112,345 for an entity that is other than small. Over three years, with two further annual affirmations, the totals are $104,670 and $117,768. The estimate assumes the contractor already meets all 110 NIST SP 800-171 requirements, so it leaves out the cost of implementing them. It prices the C3PAO’s work at 120 hours for a small entity and 200 hours for a larger one, at $260.28 an hour. Sellers headline the C3PAO fee alone at $15,000 to $100,000 or more. Scrut and IBSSCORP say $35,000 to $75,000, though both of their tables run to $125,000, Huntress says $40,000 to $80,000 or more and Kiteworks says $15,000 to $60,000. Sellers put a full first cycle, with remediation, at $50,000 to $300,000 or more.

Each seller range below comes from a company that sells compliance software, security tools or services, and the tables name the seller. The Department of War’s figures come from the rule behind the CMMC program, 32 CFR Part 170. The Department of War leaves C3PAO pricing to the market: “Market forces of supply and demand will determine C3PAO pricing for CMMC Level 2 certification assessments.”

The Department of War suspended Phase II on July 13, 2026. Phase 1 self-assessment stays in force, and the Department of War may still ask for a Level 2 (C3PAO) status in a solicitation at its discretion. Where a solicitation asks only for a Level 2 self-assessment, the Department of War’s figure is $34,277 for a small entity and $43,403 for a larger one. A C3PAO assessment is a cost only where a solicitation calls for one.

The Department of War’s estimate by level

The Department of War publishes a cost per entity for each assessment type, split by company size.

Assessment	Small entity	Other than small entity
Level 1 self-assessment, every year	$5,977	$4,042
Level 2 self-assessment	$34,277 first, $37,196 over three years	$43,403 first, $48,827 over three years
Level 2 C3PAO certification	$101,752 first, $104,670 over three years	$112,345 first, $117,768 over three years
Level 3 DIBCAC certification	$9,050 first, $12,802 over three years	$39,021 first, $44,445 over three years

Source: 32 CFR Part 170 final rule, Federal Register, October 15, 2024.

The Department of War states the assumptions behind these numbers:

• Implementation is excluded. For Levels 1 and 2, the Department of War counts only the assessment, certification and affirmation activities. It says the requirements were already mandatory under FAR clause 52.204-21 and DFARS clause 252.204-7012.
• Small entities outsource IT. the Department of War assumes a small entity uses an external service provider and that a larger entity has full-time cybersecurity staff.
• Affirmation is annual. A Level 2 affirmation costs $1,459 for a small entity and $2,712 for the other group. The three-year totals above add two of them.
• Level 3 sits on top of Level 2. A Level 3 contractor must hold a Level 2 C3PAO status first, and the Department of War lists Level 3 engineering costs separately from the assessment figures.

Where the Department of War’s $101,752 goes

The Department of War splits the Level 2 C3PAO estimate into five lines.

the Department of War’s Level 2 C3PAO estimate by line, from the 32 CFR Part 170 final rule. The Department of War states $112,345 for the other-than-small entity, and its lines add to $112,344.

The C3PAO engagement is $31,234 for a small entity, which is 120 hours for a 3-person team. The other four lines are the contractor’s own labor and external service provider hours, and they add to $70,518. Planning and conducting the assessment alone come to $66,208, more than twice the C3PAO’s share. For an other-than-small entity the C3PAO engagement is $52,056, a 5-person team for 200 hours, and the other four lines add to $60,288.

What sellers quote by cost line

Sellers also price pieces the Department of War excludes, such as remediation and the enclave. The ranges below run from the lowest to the highest figure in the named sources, with no midpoint.

Cost line	Spread	Sources
Gap assessment	$3,500 to $40,000	Encompass Consultants from $3,500; Scrut $5,000 to $25,000; Kiteworks $5,000 to $40,000
Documentation: SSP, policies, POA&M	$10,000 to $70,000	Kiteworks $10,000 to $50,000; Scrut $10,000 to $35,000; Workstreet $12,000 to $60,000; Paramify $12,000 to $70,000
Remediation of the 110 requirements	$10,000 to $500,000	PreVeil $10,000 to $250,000+; Paramify $20,000 to $150,000; Espresso Labs $150,000 to $500,000 for technology
Consultant or RPO	$250 to $400 an hour	Secureframe and PreVeil
C3PAO assessment fee	$15,000 to $100,000+, tables to $125,000	Kiteworks $15,000 to $60,000; Workstreet $30,000 to $75,000; Paramify $31,000 to $75,000; IBSSCORP $35,000 to $75,000, table to $125,000; Scrut $35,000 to $75,000, table to $125,000; Huntress $40,000 to $80,000+; Espresso Labs $30,000 to $100,000+
CUI enclave	$300 to $400 per user a month, or $3,000 to $4,000+ a month	Secureframe and PreVeil
Annual affirmation	$1,459 to $35,000	The Department of War $1,459 and $2,712; IBSSCORP $8,000 to $12,000 at 1 to 50 employees, $25,000 to $35,000 at 500+
Triennial reassessment	$10,000 to $50,000+	Kiteworks $10,000 to $50,000; PreVeil $15,000 to $50,000+
Internal staff time	$10,000 to $100,000+	PreVeil, 200 to 800+ hours

IBSSCORP’s table ties the C3PAO fee to headcount. It runs $35,000 to $45,000 over 3 to 5 days at 1 to 50 employees, and $55,000 to $125,000 over 10 to 15 days at 500 or more.

IBSSCORP prices an annual affirmation at $8,000 and up, against the Department of War’s $1,459 and $2,712.

Quoted first-cycle totals

Totals carry different scopes, so each stays on its own row.

Source	Scope as stated	Total
Kiteworks	Level 2	$50,000 to $300,000
Huntress	C3PAO assessment plus preparation and remediation	$50,000 to $150,000+
Workstreet	Level 2 certification	$50,000 to $200,000+
Paramify	Level 2: documentation, assessment, remediation	$63,000 to $200,000+
Scrut	First year, Level 2 C3PAO track	$70,000 to $250,000+
PreVeil	Level 2 with tools, consulting, remediation and assessment	$75,000 to $300,000+
IBSSCORP	Average first certification cycle with preparation and technology	$138,000 to $285,000
Espresso Labs	Three years, what it calls the traditional model	$450,000 to $750,000+

Vanta shows $104,500 and $117,500 in its cost guide. Secureframe, cmmc.com and Scrut show $105,000 to $118,000. The final rule gives $104,670 for a small entity and $117,768 for another, so the two ends of that range belong to different company sizes. Vanta and Scrut link the December 2023 proposed rule, and cmmc.com links a December 2023 news report.

What moves the price

• CUI scope and enclave. the Department of War says a certification covers only the assessed scope: “An enclave may be able to leverage some elements of the enterprise assessment by inheriting some requirements from the enterprise network, but it cannot inherit the enterprise certification.” Scrut says limiting CUI to an isolated enclave is the single most effective way to reduce implementation and assessment costs.
• Assets and locations. the Department of War’s team grows from 3 people for 120 hours to 5 people for 200 hours with company size, and IBSSCORP’s assessment lasts 3 to 5 days at 1 to 50 employees and 10 to 15 days at 500 or more.
• SPRS score and POA&M items. A Conditional status needs a minimum score of 80 percent and only permitted gaps on the POA&M. Every POA&M item must close within 180 days, verified by a second assessment. The Department of War’s Level 2 estimate has no POA&M closeout line.
• Cloud. DFARS 252.204-7012 requires an external cloud provider that holds covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline.
• Starting position. the Department of War assumes the 110 requirements are met. Scrut says organizations already compliant with ISO 27001 or SOC 2 face lower cost through overlapping controls.

Compliance platform cost

The subscription is billed apart from the assessment. These are the starting prices for the six platforms in the CMMC compliance software ranking, in rubric order, from the pricing study.

Platform (rubric total)	Published starting price	Covers	Where
Sprinto (84)	$9,500 a year with a first framework	Up to 100 employees	AWS Marketplace
Vanta (82)	$14,000 a year, Essentials	1 to 20 employees	AWS Marketplace
Drata (76)	$15,000 a year, Foundation Package	1 to 50 employees	AWS Marketplace
Secureframe (75)	$7,500 a year, Fundamentals	Up to 100 employees	secureframe.com
Scrut (72)	$15,000 a year	Up to 20 employees	AWS Marketplace
Thoropass (52)	$8,700 a year with a first framework	No band stated	AWS Marketplace

All of these are general plans; none of the six publishes a CMMC-specific price. The rubric credits pricing transparency only for prices on the vendor’s website, so Secureframe earns 2 of 5, Sprinto, Vanta and Drata earn 1, and Scrut and Thoropass earn 0.

Secureframe sells a Defense plan on request. Its pricing page lists an SPRS Score Tracker, an SSP, a POA&M, a Managed CUI Enclave and Managed Virtual Desktops, with a “Get a quote” button in place of a price.

Secureframe’s pricing page.

Thoropass’s CMMC product is built for Level 1, which a contractor self-assesses without a C3PAO. The evidence, SSP and POA&M tooling in these platforms is compliance automation work, and the Level 2 assessment itself belongs to a C3PAO. All six are also scored in the compliance management software ranking.

POA&M closeout, affirmation and reassessment

A contractor that scores at least 80 percent with only permitted gaps gets a Conditional status and a POA&M. The Department of War’s Level 2 breakdown lists planning, conducting, reporting, affirmation and the C3PAO engagement, and no closeout assessment. A Final status lasts three years, the contractor affirms every year in SPRS, and a missed affirmation lapses the status.

The Department of War counts the affirmation at $1,459 or $2,712 a year. Kiteworks and PreVeil put the next triennial reassessment at $10,000 to $50,000 or more.

For SOC 2, Linford and Co puts SOC 1 and SOC 2 audit fees together at $20,000 to $150,000.