DoD puts CMMC Level 2 cost at $101,752 for a small entity certification assessment. See where every dollar goes and what the estimate leaves out. DoD's own figures put a CMMC Level 2 certification assessment at $101,752 for a small entity, and $104,670 across three years. Here is the full build-up, and the costs the estimate leaves outside its boundary. The CMMC Level 2 cost that DoD published for a small entity is $101,752 for one certification assessment. Over three years the figure reaches $104,670, because two annual affirmations add $1,459 each. Roughly a third of that total pays the third-party assessor. The rest pays your own director and your external service provider for the hours the assessment consumes. Those figures come from the regulatory analysis behind the CMMC Program final rule of 15 October 2024. They are planning estimates rather than quotes, and DoD says market forces set what an assessor charges. The Department has also paused the program in Phase 1, so Level 2 runs today as a self-assessment. Treat the number as a budget line you will need later, not an invoice you owe now. CMMC Level 2 Cost DoD built the small entity estimate from three assessment phases, one assessor fee and one affirmation. The lines in the final rule (https://www.govinfo.gov/content/pkg/FR-2024-10-15/html/2024-22905.htm) add to the published total exactly. | Line item | Small entity estimate | |---|---| | Phase 1, planning and preparing | $20,699 | | Phase 2, conducting the assessment | $45,509 | | Phase 3, reporting results | $2,851 | | C3PAO engagement, 120 hours | $31,234 | | Initial affirmation | $1,459 | | Per assessment total | $101,752 | Two more affirmations fall inside the three-year window, which turns $101,752 into $104,670. The cost then repeats, because a Level 2 certification status lasts three years under 32 CFR 170.17 (https://www.ecfr.gov/current/title-32/part-170/section-170.17) and the affirming official files every year under 32 CFR 170.22. Three assessments and seven affirmations across a decade come to $315,469 on these unit costs. A 50-person firm with one enclave sits squarely inside DoD's assumptions. A firm with three business units and a flat network does not. Where The Money Goes Read one line of DoD's own analysis before you read the total. The rule books "no nonrecurring or recurring engineering costs" for a Level 2 certification assessment. Its stated reason is an assumption. DoD expects the contractor or subcontractor to have implemented the NIST SP 800-171 R2 security requirements already. That assumption does the real work. The estimate prices proof, not protection. DFARS 252.204-7012 has required the 110 requirements in NIST SP 800-171 for years, so DoD treats that spending as a commitment you already made. Your actual bill therefore has two halves. The first half closes whatev
DoD's own figures put a CMMC Level 2 certification assessment at $101,752 for a small entity, and $104,670 across three years. Here is the full build-up, and the costs the estimate leaves outside its boundary.
The CMMC Level 2 cost that DoD published for a small entity is $101,752 for one certification assessment. Over three years the figure reaches $104,670, because two annual affirmations add $1,459 each. Roughly a third of that total pays the third-party assessor. The rest pays your own director and your external service provider for the hours the assessment consumes. Those figures come from the regulatory analysis behind the CMMC Program final rule of 15 October 2024. They are planning estimates rather than quotes, and DoD says market forces set what an assessor charges. The Department has also paused the program in Phase 1, so Level 2 runs today as a self-assessment. Treat the number as a budget line you will need later, not an invoice you owe now. CMMC Level 2 Cost DoD built the small entity estimate from three assessment phases, one assessor fee and one affirmation. The lines in the final rule (https://www.govinfo.gov/content/pkg/FR-2024-10-15/html/2024-22905.htm) add to the published total exactly. | Line item | Small entity estimate | |---|---| | Phase 1, planning and preparing | $20,699 | | Phase 2, conducting the assessment | $45,509 | | Phase 3, reporting results | $2,851 | | C3PAO engagement, 120 hours | $31,234 | | Initial affirmation | $1,459 | | Per assessment total | $101,752 | Two more affirmations fall inside the three-year window, which turns $101,752 into $104,670. The cost then repeats, because a Level 2 certification status lasts three years under 32 CFR 170.17 (https://www.ecfr.gov/current/title-32/part-170/section-170.17) and the affirming official files every year under 32 CFR 170.22. Three assessments and seven affirmations across a decade come to $315,469 on these unit costs. A 50-person firm with one enclave sits squarely inside DoD's assumptions. A firm with three business units and a flat network does not. Where The Money Goes Read one line of DoD's own analysis before you read the total. The rule books "no nonrecurring or recurring engineering costs" for a Level 2 certification assessment. Its stated reason is an assumption. DoD expects the contractor or subcontractor to have implemented the NIST SP 800-171 R2 security requirements already. That assumption does the real work. The estimate prices proof, not protection. DFARS 252.204-7012 has required the 110 requirements in NIST SP 800-171 for years, so DoD treats that spending as a commitment you already made. Your actual bill therefore has two halves. The first half closes whatev