The CMMC picture in 2026 looks different from 2024 and 2025. The rule is final (32 CFR Part 170, published at 89 FR 83092 on October 15, 2024), and Phase 2, which would have brought Level 2 (C3PAO) requirements into solicitations (32 CFR 170.3(e)(2)), is on hold.
Status note, September 2026. On July 13, 2026 the Department of War suspended the November 2026 Phase 2 transition. During the suspension, solicitations may designate only CMMC Level 1 (Self) or Level 2 (Self), and Level 2 (C3PAO) requirements are to be removed from active solicitations and existing contracts (DoW CIO memorandum, Attachment 1, cleared for open publication July 13, 2026). This guide describes the Level 2 (C3PAO) path as written in 32 CFR Part 170. See what the suspension changed and what still applies.
This article covers what has changed, where the durable cost anchors are, and where preparation cost can come down without cutting compliance corners.
Start From the Published Numbers, Not the Rumors
Before reacting to any market chatter, anchor on what the DoD itself published. The regulatory impact analysis in the CMMC final rule put three-year figures on each path. They assume the NIST SP 800-171 requirements are already implemented, so remediation cost is on top.
| Path (3-year cycle) | Small entity | Larger entity |
|---|---|---|
| Level 2 Certification (C3PAO) | $104,670 | $117,768 |
| C3PAO assessor engagement alone | $31,234 | $52,056 |
| Level 2 Self-Assessment | $37,196 | $48,827 |
Source: DoD regulatory impact analysis in the CMMC Program final rule, 89 FR 83092 (October 15, 2024), at 83182 to 83186.
What Has Changed Since 2024 and 2025
Two shifts matter for the cost equation this year.
- The final rule defined the requirements. 32 CFR Part 170 fixes the Level 2 requirement set at the 110 requirements of NIST SP 800-171 Rev 2 (32 CFR 170.14(c)(3)), the scoring methodology (32 CFR 170.24) and the POA&M rules (32 CFR 170.21), so a quote can be checked against a written standard.
- The Phase 2 transition is suspended. Since July 13, 2026, solicitations may designate only CMMC Level 1 (Self) or Level 2 (Self). The NIST SP 800-171 Rev 2 requirements and the DFARS 252.204-7012 safeguarding clause remain in effect, so the preparation work does not go away; the assessment path in your contracts is what changed.
The Deadline Effect on Cost
Whatever assessment path a solicitation designates, a contractor who starts late has less time to compare quotes and less buffer for remediation. Delayed readiness can mean contract eligibility gaps when a solicitation requires a status you do not yet hold.
The strategic takeaway: starting early gives you negotiating room on price, time to choose help with the right sector experience, and a buffer for remediation.
Get a directional read before a solicitation timeline sets your price for you. The free gap check is a first read: ten questions on ten of the 110 requirements, a directional self-assessment, not an official SPRS score.
Run the free gap check →Where Preparation Cost Can Come Down in 2026
Four habits can keep cost down, and none of them depend on company size.
- Define the CUI boundary tightly before engaging anyone. Every asset removed from scope reduces the gap work, remediation, and assessment effort that follow.
- Use AaaS for the hours-heavy phases: gap assessment, documentation generation and maintenance, and ongoing monitoring. In the DoD small-entity estimate, planning, assessment-support and reporting labor (the organization’s own staff plus external service provider hours) comes to $69,059 of the $104,670 three-year figure, against $31,234 for the C3PAO (89 FR 83092, at 83185 to 83186).
- Select an assessor deliberately rather than defaulting to the biggest name or the lowest sticker, and confirm scope with them in writing.
- Budget for total cost of compliance, including three years of maintenance, not just the initial push. The published Level 2 certification figures are three-year totals for a reason.
The AaaS Cost Advantage Is Predictability
The platform economics are straightforward: AI agents perform scheduled gap analysis and documentation work, and your team reviews the output. Your Affirming Official decides what is affirmed.
The advantage is predictability. An hourly engagement can grow as findings and scope change; a published subscription price, billed annually with a month-to-month option on every tier, fixes the platform side of the preparation budget. Remediation work and your own team’s time are still yours to plan. For the small-business view, see our CMMC cost for small business breakdown, and for the line-item budget, the small-business certification cost guide. For the certification path itself, see CMMC Level 2 certification cost.