Every small defense contractor runs the same buy-vs-build math when CMMC Level 1 lands on their desk. DIY looks free, the consultant quote is alarming, and the SaaS option seems too cheap to be real. Below is the actual math, founder hours, invoice dollars, ongoing burden, and the risk profile of each path, for a typical 10-person defense-tech company in 2026.
TL;DR, the real numbers
| Path | Year-1 cash | Year-1 founder hours | Year-2 cost | Risk profile |
|---|---|---|---|---|
| DIY with templates | $0, or the price of a template pack | 80 to 120 hours | 20 to 40 hours | High, FCA exposure on errors |
| vCISO / consultant | A project fee | 20 to 40 hours | A retainer + 10 hours | Medium, depends on consultant |
| Custodia (platform + officer) | $5,500 a year monthly, or $5,000/yr annual | 10 to 20 hours | $5,000/yr + 5 hours (re-affirmation included) | Low, officer included and reviewed |
| Cheap checklist tool | A low monthly fee | 60 to 100 hours | The same fee + 30 hours | High, tool only, no support |
For most small contractors, the deciding factor isn't the cash, it's the founder hours and the risk. Read on.
Path 1: DIY with templates
The honest version of DIY: download a free SSP template, read NIST SP 800-171 and FAR 52.204-21, attempt to interpret the language, build the seven required artifact CSVs, write narratives for each of the 15 safeguarding requirements, sign and file in SPRS.
What it actually costs
- Cash: $0, or the price of a template pack
- Founder time: 80 to 120 hours over 4 to 8 weeks. About 30 hours of reading, 40 hours of artifact building, 20 hours of SSP narrative writing, 10 hours of SPRS submission and corrections.
- Year-2: 20 to 40 hours to re-affirm, assuming nothing changed.
Where it goes wrong
Most DIY packages we audit have one or more of: an inflated SPRS score (controls marked “met” that aren't), missing evidence behind a met-status control, an SSP narrative copied verbatim from a template (the prime notices), or a senior official signing without actually verifying. Any of those is a problem; an inflated score is the one that triggers False Claims Act exposure.
Path 2: vCISO / compliance consultant
The traditional path. You hire a fractional CISO or a small compliance consultancy to scope, build, and file your CMMC L1 package. Engagements typically run 6 to 10 weeks.
What it actually costs
- Cash: billed as a project. No government figure exists for a consultant's fee, and quotes vary with scope and document quality, so get the exclusions in writing.
- Founder time: 20 to 40 hours (interviews, document gathering, review, sign-off).
- Year-2: a retainer for re-affirmation and ad-hoc questions.
Where it goes wrong
The good consultants are excellent. The bad ones produce cookie-cutter SSPs (we've seen identical narratives across unrelated companies, just with the company name find/replaced), bill for “continuous monitoring” that doesn't run continuously, and ghost when a prime calls with a tough question. The market is bimodal: pay a premium for a great firm or accept variance below that.
Path 3: Custodia (or other SaaS)
SaaS compresses the engagement model into software. You sign in, a gov safe AI guide (Charlie, in our case) walks you through the 15 safeguarding requirements in plain English with prompts tailored to your exact tech stack, evidence is auto-reviewed as you upload, the SSP is drafted from your own answers and proof for you to read and approve before your senior official signs, and a real human compliance officer is one ticket away when something needs judgment.
What it actually costs (Custodia)
- Cash: $5,000/yr on annual, or $458.34/mo if you prefer monthly, with a credentialed compliance officer reviewing your account. 30 day free trial, no credit card to start.
- Founder time: 10 to 20 hours over the trial. Most users complete a defensible package in 3 to 5 business days.
- Year 2: Same $5,500 a year monthly (or $5,000/yr on annual). Annual re-affirmation is included, no extra fee. Continuous monitoring and your officer run all year.
What about the cheap checklist tools?
They exist. The category includes products that have been around since 2018 with UIs to match. They're fundamentally checklist tools, you do the work, they store the artifacts. No AI guidance, no plain-English walkthrough, no officer support, no weekly opportunity sourcing, no continuous monitoring, no challenge resolution. If “a place to put my files” is what you need, that's a real product. If you want the work done with you, it's not.
Side-by-side comparison
| Capability | DIY | Consultant | Cheap checklist tool | Custodia |
|---|---|---|---|---|
| Plain-English walkthrough of 15 safeguarding requirements | Self-led | Yes | No | Yes |
| Tailored to your tech stack (M365/Google/AWS/Okta) | No | Yes | No | Yes |
| AI evidence auto-review | No | No | No | Yes |
| SSP drafted from your record, read and approved by you | No | Yes (manual) | No | Yes |
| Senior-official affirmation memo generated | Manual | Yes | Manual | Yes |
| Year-round posture monitoring | No | Sometimes | No | Yes |
| SAM.gov opportunity radar | No | No | No | Yes |
| Annual re-affirmation included | Self | Extra fee | Self | Yes |
| Custodia Compliance Officer on call | No | Hourly | No | Included |
| Officer-led prime challenge resolution | No | Hourly | No | Included |
The hidden costs nobody quotes
- Re-do cost when a prime rejects your package. DIY: another 40 hours. Consultant: another invoice. Custodia: $0 (officer review of the rebuild is included).
- Annual re-affirmation. DIY: 20 to 40 hours every Oct. Consultant: a retainer. Custodia: $0 incremental.
- Evidence freshness drift. Most DIY packages rot inside 6 months, expired scans, stale screenshots, off-boarded users still on rosters. Re-cleanup before a prime audit: 10 to 30 hours minimum.
- FCA settlement risk. The DOJ's Civil Cyber-Fraud Initiative has produced settlements ranging from $1M to $9M+ since 2022. The expected value of a single mis-attested practice on a sub-$1M contract is real money.
Which path is right for you
Pick DIY if
- You have an in-house compliance person or an obsessive founder with the bandwidth.
- You enjoy reading NIST documents at 10pm.
- You're comfortable signing the SPRS affirmation yourself.
Pick a consultant if
- You have CUI in scope and need CMMC Level 2 (we'll refer you).
- You have a complex, hybrid environment that needs custom architecture work.
- You have the budget and prefer a single human throat to choke.
Pick Custodia if
- You handle FCI on a DoD contract or sub.
- You want to be bid ready at your own pace, with a credentialed officer reviewing.
- You want year-round posture monitoring and annual re-affirmation handled.
- You'd rather spend $458.34/mo, officer included, than an hourly rate.
Start with the free 4-minute SPRS quiz to see where you stand, then if you like what you see, start the 30 day trial and complete your package before you ever need a credit card.
FAQ
Does CMMC Level 1 cost more in year 2?
With Custodia: no, same $458.34/mo, officer included (or$5,000/yr on annual). With a consultant: usually a retainer. DIY: about 30 hours of your time.
Is there an annual plan?
Yes. The CMMC Level 1 plan is $5,000/yr on annual, against$5,500 at the $458.34/mo monthly rate, with the compliance officer included either way.
What's the lock-in?
Month-to-month. Cancel anytime. Your data and artifacts are exportable on cancellation.
Does Custodia replace a vCISO?
For CMMC Level 1, yes. For broader information-security program-building (Level 2, ISO 27001, SOC 2), no, you still need a real vCISO for those scopes.
“The cheapest CMMC Level 1 package is the one that's actually defensible the day a prime asks you to defend it.”, The Custodia Compliance Team