Most CMMC cost planning treats the assessment fee as the smallest line in the budget. It ranks below remediation, below the C3PAO invoice, below the security tooling. For four of the five assessment paths, that ranking holds. For Level 3, it is off by a factor of roughly fifty.
Amerifusion Bookkeeping tracks these figures against DoD's own Regulatory Impact Analysis (RIA) for 32 CFR Part 170. We do not track vendor marketing numbers. Levels 1 through 3 carry per-entity cost estimates. They range from $4,042 a year to $44,445 over a three-year cycle.
Here is the number most price pages miss. A forward-pricing rate carries a cost for a CMMC requirement that later gets modified out of your contract. When that happens, you end up billing the government more than your actual cost, not less.
One check before the table. If you hold a cost-reimbursable or time-and-materials contract, look at your indirect rate. If it already carries a line for CMMC, the July 13, 2026 suspension might have turned that line into an over-recovery instead of a future cost. Jump to The Rate Now Running the Wrong Way below.
What follows: DoD's per-level cost table, the citation behind those numbers, the rate-impact math, the over-recovery risk, and where cost recovery lives.
CMMC Assessment Cost by Level: DoD's Own Estimates
DoD's Regulatory Impact Analysis for the CMMC rule models a per-entity cost for each assessment path. The citation is 32 CFR Part 170, 89 FR 83092, Oct. 15, 2024. Level 1 runs $4,042 to $5,977 a year. Level 2 runs $37,196 to $117,768 over a three-year cycle. Level 3 runs $12,802 to $44,445 over the same cycle.
| Level | Assessment Type | Small Entity | Large Entity |
|---|---|---|---|
| Level 1 (Self) | Self-assessment + affirmation | $5,977/year | $4,042/year |
| Level 2 (Self) | Self-assessment + affirmations | $37,196 | $48,827 |
| Level 2 (C3PAO) | Third-party certification + affirmations | $104,670 | $117,768 |
| Level 3 (DIBCAC) | Government-led certification + affirmations | $12,802 | $44,445 |
Figures: DoD modeling estimates, Regulatory Impact Analysis for 32 CFR Part 170 (89 FR 83092, Oct. 15, 2024), Tables 1 and 2.
Every figure above is contractor-borne. Level 1, Level 2 self-assessment, and Level 3 are internal labor only, with no third-party fee. Level 2 (C3PAO) is the exception: the contractor pays the C3PAO directly for the assessment event, while preparation and affirmations remain internal labor. The Level 3 totals are composites rather than single fees. The small-entity $12,802 is a $9,050 assessment and affirmation plus two annual affirmations of $1,876. The large-entity $44,445 is $39,021 plus two annual affirmations of $2,712.
Level 1 is not a three-year figure. Every RIA line item for Level 1, the self-assessment, the report, and the affirmation, repeats annually. Levels 2 and 3 work differently. They front-load the cost into the assessment year, then charge only an affirmation fee for the following two years.
Small entities pay more than large ones at Level 1: $5,977 a year against $4,042. DoD's Table 2 (Small Entities) runs higher than Table 1 (Other Than Small Entities) at this level. A small IT staff spends more hours per dollar of revenue completing the same fifteen FAR 52.204-21 controls. Budget off the small-entity figure unless your revenue puts you outside SBA's size standard.
Level 3's total is not a stand-alone number. The RIA states this directly. A Level 3 Certification Assessment's cost includes the cost of the Level 2 Certification Assessment it requires. Add the increment specific to Level 3 on top of that. Model both together if you are pricing total Level 3 spend, not the DIBCAC increment alone.
The Number the Assessment Fee Doesn't Include
The DIBCAC assessment fee, $12,802 to $44,445 over three years, is not the Level 3 number that matters most. The RIA also prices the engineering work Level 3 requires. Implementing selected NIST SP 800-172 controls costs $490,000 a year in recurring engineering cost, for a small entity, on top of $2,700,000 one-time.
Compare the recurring piece to the assessment fee alone: $490,000 a year runs roughly fifty-four times the $9,050 year-one assessment line. The one-time $2,700,000 is a separate, larger number again. A Level 3 budget built around the $9,050 assessment line, and silent on the engineering cost beside it, has priced the wrong number. Our companion article on the full CMMC compliance cost structure works through that implementation spend and its accounting treatment.
One more line the table compresses. Affirmation is priced per CMMC UID, a ten-character identifier DoD assigns to each contractor information system under assessment, not per company. A contractor running a separate enclave for CUI, alongside its general environment, holds more than one UID. It pays more than one affirmation.
DFARS 252.204-7021(d)(3) requires the affirmation "for each CMMC UID applicable to each of the contractor information systems" in performance of the contract. Level 1 (Self) and Level 2 (Self) remain permitted designations through the suspension. This affirmation cost keeps running either way. So does any POA&M closeout tied to it, whether or not a C3PAO or DIBCAC event ever happens.
Whose Estimate This Is, and Why the Citation Matters
Every dollar figure above is a DoD modeling estimate. It comes from the CMMC rule's Regulatory Impact Analysis, not from a market quote. You will not find it inside 32 CFR Part 170 itself.
The codified rule defines the levels and the assessment procedures. The RIA, a separate document DoD filed with the rule, carries the cost tables. That distinction matters if you check our numbers.
Open 32 CFR Part 170 looking for "$490,000" or "$44,445." You will not find them. The rule text carries no dollar figures at all. Pull the RIA itself, supporting document DOD-2023-OS-0063-0003, filed with 89 FR 83092.
The Phase 2 suspension is a separate document from the cost rule, and it needs its own citation. DoD suspended new Level 2 (C3PAO) and Level 3 (DIBCAC) designations on July 13, 2026. The authority is CIO memorandum 26-P-1023. It is not the DFARS rule that created CMMC's contract clause (DFARS Case 2019-D041, 90 FR 43560, effective Nov. 10, 2025).
That DFARS rule predates the suspension by ten months. It cannot be the suspension's authority. Further guidance on the program follows the conclusion of the CIO's 60-day review.
One figure on this article is not DoD's. The $31,000 to $75,000 C3PAO assessment-event estimate below comes from industry pricing, not the RIA. Treat it as a planning range. Get a quote from an accredited C3PAO before you build it into a proposal.
What This Does to Your Indirect Rate
Model the CMMC cost on your own G&A base first. Do this before you price a proposal or set a provisional billing rate. A $2 million G&A base absorbing the full small-entity C3PAO triennial estimate, amortized, adds roughly 1.75 percentage points a year. The out-of-pocket piece alone adds far less.
Two ranges answer two different questions. Treating them as one overstates the ceiling, or understates the floor.
The DoD ceiling: $104,670 over three years divides to about $34,890 a year. On a $2 million base, that is roughly 1.75 percentage points. Treat this as the outside number. It includes internal preparation labor that already sits in your G&A pool as salary, not as new cost.
The out-of-pocket range: the $31,000 to $75,000 C3PAO invoice estimate is the genuinely new spend. We divided it by three to amortize it across the three-year cycle the invoice covers: $10,333 to $25,000 a year. On the same $2 million base, that comes to roughly half a point to a little over one point of G&A a year.
Amortize CMMC costs across the years they benefit. Booking a multi-year estimate as a single year's cost overstates the rate impact several times over. Model your own base with our indirect rate calculator. Then update your Forward Pricing Rate Proposal (FPRP) before the change hits live cost-plus and T&M billing.
The Rate Now Running the Wrong Way
Every rate instruction on this article has pointed one direction: add the cost in. So has our CMMC coverage generally. July 13, 2026 reversed that for one group of readers. Suppose your forward-pricing rate already carries a CMMC line for a Level 2 (C3PAO) or Level 3 (DIBCAC) requirement. Suppose that requirement is being modified out of your contract. You are now over-recovering, not under-recovering.
Here is the reader nobody has written to. You hold a cost-reimbursable or T&M contract. Sometime before July 2026, you built a CMMC assessment cost into your FPRP or your provisional billing rate. You followed the standard advice: price it in before the requirement arrives. The government has been paying your bills against that provisional rate all year.
Name the stake plainly. You are billing a provisional rate built for a requirement that is being removed. Your actual indirect cost rate, the one your incurred cost submission settles against, will come in lower than what you billed provisionally. The difference comes back to the government at final settlement, out of cash you already collected.
FAR 42.704(b) (Overhaul 42.504(b), which is where this subpart now sits) sets the standard for a billing rate. It should stay "as close as possible to the final indirect cost rates anticipated" for your fiscal period. FAR 42.704(c) (Overhaul 42.504(c)) gives you the lever: billing rates "may be prospectively or retroactively revised by mutual agreement of the contracting officer… and the contractor at either party's request, to prevent substantial overpayment or underpayment." Do not wait for the reconciliation to surface the gap. Request the revision now.
One check before you ask for that revision, and it matters most if you are a subcontractor. A CMMC requirement that came down through a prime's flowdown clause was not removed by the July memo. The memo tells government contracting officers to amend government instruments. It does not reach a flowdown already in your awarded subcontract 32 CFR 170.23(a).
That changes the answer. The cost is still coming. Your rate is not over-recovering. Cut it, and you under-recover all year for no reason. Confirm with your prime first. Our companion article on CMMC cost recovery works through why the flowdown survives.
This risk is specific to the C3PAO and DIBCAC slice of your rate build-up. Level 1 (Self) and Level 2 (Self) remain designable requirements through the suspension. A government-led DIBCAC assessment still reaches select programs too (see the level table above). Do not strip CMMC out of your rate structure entirely. Pull the specific line that assumed a C3PAO invoice, or a DIBCAC certification, your contract no longer requires.
Which CMMC Level Applies to Your Contract, in Accounting Terms
Your CMMC level is not a number we assign from a table. It is a determination made by the solicitation's Sections L and M, the contract clauses DoD inserts, and your contracting officer. Accounting has a narrower job. Once that determination is made, accounting tells you what each path costs, and where the cost sits on your books.
Route the "which level" question to the solicitation you are responding to and your contracting officer. Involve counsel if the clause language is contested. What accounting tells you in advance: Level 1 and Level 2 (Self) cost internal labor only, with no external invoice. Level 2 (C3PAO) adds a third-party invoice on top of internal labor. Level 3 (DIBCAC) is government-led, so again there is no external invoice. It carries the largest internal cost of any level once implementation is included.
When the Cost Precedes the Requirement
Some contractors incur CMMC costs before any contract requires them. They certify ahead of an anticipated solicitation, or maintain a certification between awards. FAR treats this as a precontract cost question, and two sections answer it directly: FAR 31.205-32 and FAR 31.109.
FAR 31.205-32 is narrower than it looks. The narrowing sits in the definition. Precontract costs are those incurred before the contract starts, and the rule adds three conditions. They must be incurred "directly pursuant to the negotiation." They must be "in anticipation of the contract award." And the spending must be "necessary to comply with the proposed contract delivery schedule." Meet all three, and the costs are allowable to the same extent they would have been after award.
Those qualifiers decide it. A firm certifying ahead of a specific award it is negotiating meets them. A firm certifying speculatively, against no particular solicitation, is further from the definition than the headline sentence suggests. FAR 31.109 lists precontract costs and bid-and-proposal costs among the categories where an advance agreement matters most. An advance agreement is a written understanding with your contracting officer on how a cost will be treated. Negotiate that agreement before you spend the money. FAR 31.109(b) says advance agreements "should be negotiated before incurrence of the costs involved."
Some contractors argue CMMC certification costs qualify as Bid and Proposal costs under FAR 31.205-18. The theory: certification is a condition of contract award. Test that against the definition before you rely on it. FAR 31.205-18(a) defines B&P costs as those "incurred in preparing, submitting, and supporting bids and proposals." Certification is a precondition to being eligible to bid, which is not the same thing as preparing the bid.
The argument is not frivolous, but the definition does not reach it cleanly. DCAA had not, as of the most recently confirmed check, issued guidance endorsing B&P treatment for CMMC assessment costs. Confirm the current status with your CPA before booking a cost this way. A position like this shifts without a press release.
Either path needs a paper trail before the government will honor it. That means a signed advance agreement, or a documented rationale your CPA reviewed before the cost hit the books.
Recovering This Cost: Where That Question Lives
What you pay is one question. Whether this cost is billable to the government is a different question. So is which cost pool it sits in, and what a DCAA auditor wants to see before it survives an incurred cost audit. Those questions deserve their own treatment.
Our companion article, CMMC Compliance Costs: What's Allowable and How to Recover It, works through two things. First, the FAR 31.201-2 five-part allowability test and the G&A-versus-overhead pool decision. Second, what changes between a firm-fixed-price contract and a cost-reimbursable one. Start there once you know which level applies and what it costs.
Frequently Asked Questions
How much does a CMMC assessment cost?
CMMC assessment cost ranges by level. Level 1 runs $4,042 to $5,977 a year. Level 2 runs $37,196 to $117,768 over a three-year cycle. Level 3 runs $12,802 to $44,445 over three years. These are DoD's own modeling estimates from the CMMC rule's Regulatory Impact Analysis (32 CFR Part 170, 89 FR 83092), not C3PAO market quotes. Get an actual quote before pricing a proposal.
Why does Level 1 cost more for a small business than a large one?
DoD's Regulatory Impact Analysis prices Level 1 at $5,977 a year for small entities against $4,042 for larger ones. A small IT staff spends more labor hours completing the same fifteen FAR 52.204-21 controls. The RIA's cost model runs on labor hours, not company size. Budget off the small-entity figure unless your revenue exceeds SBA's size standard.
Is the CMMC Phase 2 suspension still in effect?
Yes. DoD suspended new Level 2 (C3PAO) and Level 3 (DIBCAC) designations on July 13, 2026, through CIO memorandum 26-P-1023. During the suspension, Program Managers and requiring activities are limited to designating Level 1 (Self) or Level 2 (Self). Further guidance follows the conclusion of the CIO's 60-day review.
My forward-pricing rate already includes a CMMC line item. Do I need to change it?
Possibly, and in the opposite direction from what you would expect. Suppose that line covers a Level 2 (C3PAO) or Level 3 (DIBCAC) requirement now being modified out of your contract. Your provisional rate might be over-recovering. FAR 42.704(c) (Overhaul 42.504(c)) lets you request a revision from your contracting officer to prevent the overpayment before it settles against you.
What does DIBCAC certification cost if there's no C3PAO invoice?
A Level 3 DIBCAC assessment carries no third-party invoice. The cost is entirely internal labor. DoD estimates $12,802 over three years for a small entity, $44,445 for a larger one, for the assessment and affirmations alone. That figure excludes the $490,000 a year in engineering cost the RIA prices for implementing Level 3's NIST SP 800-172 controls.
Which CMMC level does my contract require?
That determination comes from the solicitation's Sections L and M, and from the specific DFARS clauses DoD inserts into your contract. It does not come from a cost estimate. Check your solicitation, and route a contested clause to your contracting officer or counsel. What accounting tells you in advance is what each level costs once determined, covered above.
Key Takeaways
- Level 1 costs more for small entities than large ones $5,977 a year against $4,042. Budget off the small-entity figure.
- Level 3's real number isn't the assessment fee DoD prices $490,000 a year in recurring engineering cost for implementation, roughly fifty-four times the $9,050 year-one assessment line, plus a separate $2,700,000 one-time cost on top.
- Every dollar figure on this article traces to DoD's Regulatory Impact Analysis Not the bare CFR text, and not a market quote. Cite the RIA for the numbers. Cite CIO memo 26-P-1023, not the September 2025 DFARS rule, for the suspension.
- A provisional rate that still carries a cost for a C3PAO or DIBCAC requirement now being modified out is over-recovering Request a rate revision under FAR 42.704(c) (Overhaul 42.504(c)) before it settles against you at final reconciliation.
- Which level your contract requires is a solicitation and contracting-officer question Not a table on this article. Use this article for what each answer costs. Route the determination to the solicitation, the CO, and counsel.
- Whether this cost is billable to the government is a separate question See our recovery guide.
Get Your CMMC Cost Structure Reviewed
Amerifusion Bookkeeping pairs CPA credentials with CISSP cybersecurity expertise. We map your CMMC costs to the right level. We check whether a forward-pricing rate still carries a line for a requirement the suspension modified out of your contract. Then we hand the recovery question, cost pool placement and FAR allowability, to our companion guide.
Our Compliance Readiness Check takes 30 seconds and flags where your CMMC cost structure stands today. When you are ready to go deeper, see our DCAA compliance services or book a discovery call.
