Every small defense contractor runs the same buy-vs-build math when CMMC Level 1 lands on their desk. DIY looks free, the consultant quote is alarming, and the SaaS option seems too cheap to be real. Below is the actual math — founder hours, invoice dollars, ongoing burden, and the risk profile of each path — for a typical 10-person defense-tech company in 2026.
TL;DR — the real numbers
| Path | Year-1 cash | Year-1 founder hours | Year-2 cost | Risk profile |
|---|---|---|---|---|
| DIY with templates | $0–$500 | 80–120 hours | 20–40 hours | High — FCA exposure on errors |
| vCISO / consultant | $9,000–$30,000 | 20–40 hours | $3K–$8K + 10 hours | Medium — depends on consultant |
| Custodia SaaS | $2,988 ($249 × 12) or $2,496/yr annual | 10–20 hours | $2,988 + 5 hours (re-affirmation included) | Low — officer-backed |
| Cheap checklist tool ($97/mo) | $1,164 | 60–100 hours | $1,164 + 30 hours | High — tool only, no support |
For most small contractors, the deciding factor isn't the cash — it's the founder hours and the risk. Read on.
Path 1: DIY with templates
The honest version of DIY: download a free SSP template, read NIST SP 800-171 and FAR 52.204-21, attempt to interpret the language, build the seven required artifact CSVs, write narratives for each of the 15 safeguarding requirements, sign and file in SPRS.
What it actually costs
- Cash: $0–$500 if you buy a template pack
- Founder time:80–120 hours over 4–8 weeks. About 30 hours of reading, 40 hours of artifact building, 20 hours of SSP narrative writing, 10 hours of SPRS submission and corrections.
- Year-2:20–40 hours to re-affirm, assuming nothing changed.
Where it goes wrong
Most DIY packages we audit have one or more of: an inflated SPRS score (controls marked “met” that aren't), missing evidence behind a met-status control, an SSP narrative copied verbatim from a template (the prime notices), or a senior official signing without actually verifying. Any of those is a problem; an inflated score is the one that triggers False Claims Act exposure.
Path 2: vCISO / compliance consultant
The traditional path. You hire a fractional CISO or a small compliance consultancy to scope, build, and file your CMMC L1 package. Engagements typically run 6–10 weeks.
What it actually costs
- Cash:$9,000–$30,000 for the initial engagement. Median for a 10-person company is around $15,000–$18,000.
- Founder time:20–40 hours (interviews, document gathering, review, sign-off).
- Year-2:$3,000–$8,000 retainer for re-affirmation and ad-hoc questions.
Where it goes wrong
The good consultants are excellent. The bad ones produce cookie-cutter SSPs (we've seen identical narratives across unrelated companies, just with the company name find/replaced), bill for “continuous monitoring” that doesn't run continuously, and ghost when a prime calls with a tough question. The market is bimodal: pay $25k+ for a great firm or accept variance below that.
Path 3: Custodia (or other SaaS)
SaaS compresses the engagement model into software. You sign in, an AI compliance officer (Charlie, in our case) walks you through the 15 safeguarding requirements in plain English with prompts tailored to your exact tech stack, evidence is auto-reviewed as you upload, the SSP is auto-drafted from your inputs, and a real human compliance officer is one ticket away when something needs judgment.
What it actually costs (Custodia)
- Cash: $249/mo Self Service or $2,496/yr on annual (two months free). 7-day free trial, no credit card to start. Officer plan with a credentialed Custodia Compliance Officer assigned to your account is $397/mo or $3,996/yr.
- Founder time:10–20 hours over the trial. Most users complete a defensible package in 3–5 business days.
- Year-2:Same $2,988/yr (or $2,496/yr on annual). Annual re-affirmation is included — no extra fee. Continuous monitoring runs all year.
What about the $97/mo checklist tools?
They exist. The category includes products that have been around since 2018 with UIs to match. They're fundamentally checklist tools— you do the work, they store the artifacts. No AI guidance, no plain-English walkthrough, no officer support, no weekly opportunity sourcing, no continuous monitoring, no challenge resolution. If “a place to put my files” is what you need, that's a real product. If you want the work done with you, it's not.
Side-by-side comparison
| Capability | DIY | Consultant | $97 checklist tool | Custodia |
|---|---|---|---|---|
| Plain-English walkthrough of 15 safeguarding requirements | Self-led | Yes | No | Yes |
| Tailored to your tech stack (M365/Google/AWS/Okta) | No | Yes | No | Yes |
| AI evidence auto-review | No | No | No | Yes |
| Auto-drafted SSP narratives | No | Yes (manual) | No | Yes |
| Senior-official affirmation memo generated | Manual | Yes | Manual | Yes |
| Year-round posture monitoring | No | Sometimes | No | Yes |
| SAM.gov opportunity radar | No | No | No | Yes |
| Annual re-affirmation included | Self | Extra fee | Self | Yes |
| Custodia Compliance Officer on call | No | Hourly | No | Included |
| Officer-led prime challenge resolution | No | Hourly | No | Included |
The hidden costs nobody quotes
- Re-do cost when a prime rejects your package. DIY: another 40 hours. Consultant: another $3K–$8K. Custodia: $0 (officer-led resolution is included).
- Annual re-affirmation.DIY: 20–40 hours every Oct. Consultant: $3K–$8K retainer. Custodia: $0 incremental.
- Evidence freshness drift.Most DIY packages rot inside 6 months — expired scans, stale screenshots, off-boarded users still on rosters. Re-cleanup before a prime audit: 10–30 hours minimum.
- FCA settlement risk.The DOJ's Civil Cyber-Fraud Initiative has produced settlements ranging from $1M to $9M+ since 2022. The expected value of a single mis-attested practice on a sub-$1M contract is real money.
Which path is right for you
Pick DIY if
- You have an in-house compliance person or an obsessive founder with the bandwidth.
- You enjoy reading NIST documents at 10pm.
- You're comfortable signing the SPRS affirmation yourself.
Pick a consultant if
- You have CUI in scope and need CMMC Level 2 (we'll refer you).
- You have a complex, hybrid environment that needs custom architecture work.
- You have $20k+ budget and prefer a single human throat to choke.
Pick Custodia if
- You handle FCI on a DoD contract or sub.
- You want to be bid-ready in a week, not a quarter.
- You want year-round posture monitoring and annual re-affirmation handled.
- You'd rather spend $249/mo than $200/hr.
Start with the free 4-minute SPRS quiz to see where you stand, then if you like what you see, start the 7-day trial and complete your package before you ever need a credit card.
FAQ
Does CMMC Level 1 cost more in year 2?
With Custodia: no — same $249/mo Self Service (or $2,496/yr on annual). With a consultant: usually a $3K–$8K retainer. DIY: about 30 hours of your time.
Is there an annual SaaS plan?
Yes. Self Service is $2,496/yr (two months free vs. the $249/mo monthly rate). The Officer plan is $3,996/yr (two months free vs. $397/mo).
What's the lock-in?
Month-to-month. Cancel anytime. Your data and artifacts are exportable on cancellation.
Does Custodia replace a vCISO?
For CMMC Level 1, yes. For broader information-security program-building (Level 2, ISO 27001, SOC 2), no — you still need a real vCISO for those scopes.
“The cheapest CMMC Level 1 package is the one that's actually defensible the day a prime asks you to defend it.”— The Custodia Compliance Team