If you handle Controlled Unclassified Information (CUI) on a DoD contract, CMMC Level 2 is the level to plan for; since July 13, 2026, with Phase 2 suspended, a DoW CIO memorandum allows requiring activities to designate only Level 1 (Self) or Level 2 (Self). Cost figures published without a source cannot be checked. There is a better number to plan against: the Department of Defense published its own per-entity cost estimates in the CMMC Program Regulatory Impact Analysis. Those are the figures we use here.
What the DoD's Own Estimates Say
In its Regulatory Impact Analysis, the DoD modeled the three-year cost of a Level 2 Certification assessment (the path that requires a third-party assessor) at $104,670 for a small entity and $117,768 for a larger entity. The self-assessment path, where eligible, is modeled lower at $37,196 small and $48,827 larger over three years.
These are estimates, not quotes, and your actual spend depends heavily on scope and starting posture. The model assumes the requirements are already implemented, so it does not include the cost of implementing or remediating them. But they are sourced numbers you can take to your board.
Source: DoD CMMC Program Regulatory Impact Analysis (docket DoD-2023-OS-0063), page 14; the same figures appear in the final rule, 89 FR 83092 (Oct. 15, 2024), at 83182 to 83186.
Where the Money Goes
The DoD's small-entity breakdown for the Level 2 Certification path shows where the modeled budget lands:
| Cost component | Small entity (3-yr) |
|---|---|
| Plan & Prepare | $20,699 |
| Conduct Assessment (your staff and outside support) | $45,509 |
| Report Results | $2,851 |
| Annual Affirmations (3-yr) | $4,377 |
The C3PAO assessor engagement itself is modeled separately at $31,234 for a small entity and $52,056 for a larger one. Notice what dominates: the assessor fee is real, but your own side of the work, staff time plus the external service provider hours the DoD's small-entity model includes, is the larger share.
Source: DoD CMMC Program Regulatory Impact Analysis, pages 14 and 25-26.
Want a directional read on your Level 2 readiness before you commit a budget? The free 10-question gap check gives you a starting picture; it is a self-assessment, not an official SPRS score.
Run the free gap check →Why Scope Drives Everything
CMMC Level 2 covers all 110 NIST SP 800-171 controls. Scope is a direct lever on your cost: it sets how much of your environment those controls have to cover (32 CFR 170.19). A flat network where CUI can land anywhere puts the whole organization in scope. An enclave that isolates CUI keeps the boundary, and the bill, narrow. The scoping decision is made early and it shapes everything that follows. For the full sequence, see our CMMC certification process walkthrough.
The Cost Nobody Itemizes: Time to Award
Dollar line items are not the whole story. DoD includes the required CMMC Status as a condition of contract award (32 CFR 170.3(e)), so every month you lack the status a solicitation requires is a month of that work you cannot win. During the Phase 2 suspension that status is Level 1 (Self) or Level 2 (Self), not third-party certification. Treating CMMC as a revenue-enablement project, rather than a compliance tax, helps keep a contractor bidding.
Where AaaS Fits
Look back at where the money goes: your own side of the work is the labor-heavy share, and an Agent-as-a-Service (AaaS) provider can take on part of it. Instead of copying configuration screenshots into a Word document by hand, Enclave AI's read-only connectors re-read your connected cloud and identity configuration about every 7 days and map what they observe to the 110 controls, and each tier cycle re-issues SSP and POA&M sections from that observed state, with controls no connected source can observe answered from your recorded evidence. The configuration data behind each measured finding is kept on file with a SHA-256 hash.
The point is operational leverage, not headcount cuts. Documents ship on schedule; your designated executive can approve or disapprove each one before your organization presents it, and your Affirming Official owns the affirmation. The platform does the assembly.
Building Your Budget
Start from the DoD's sourced figures, adjust for your scope and starting posture, and decide early whether an enclave shrinks your boundary. Then get an honest read on where you are today. You can compare paths in our self-assessment vs. C3PAO guide, or see how AI-native tooling stacks up against legacy GRC in compliance software vs. AI compliance platform.