The answer in 50 words
CMMC Level 1 costs nothing to file: it is a free self assessment affirmed in SPRS. DoD's own estimate for a small business is $5,977 a year of labor (89 FR 83092). Your cash cost is implementation, from $0 DIY to a $458.34/mo guided platform, officer included to a consultant's project fee. Level 2 by DoD's estimate: $34,277 for a self assessment year (89 FR 83092).
CMMC Level 1 cost, by path
Every path below ends at the same place: a completed self-assessment of the 15 FAR 52.204-21 safeguarding requirements, a System Security Plan, and a senior-official affirmation posted to SPRS. The difference is time, risk, and price.
| Path | Cash cost | Your time | Typical duration |
|---|---|---|---|
| DIY with official guides | $0 | 20 to 40 hours | 1 to 3 months |
| Custodia (platform + officer included) | $458.34/mo | 5 to 10 hours | At your pace, officer reviewing |
| Consultant engagement | A project fee, ask for the exclusions | 10 to 20 hours | On the consultant's schedule |
| CMMC MSP retainer | A monthly retainer, scoped per seat | Low | Ongoing |
| DoD's own estimate, small business labor (89 FR 83092, table 15) | $5,977 a year | About 28 hours | Annual, safeguards already in place |
SPRS and PIEE cost nothing to use. There is no filing fee, no application fee, and no assessor at Level 1.
Why Level 2 numbers are far higher, and why that may not be your problem
When contracts involve Controlled Unclassified Information, CMMC Level 2 means all 110 NIST SP 800-171 requirements, self assessed and scored out of 110. The Department's own estimate for a small business is $34,277 for a self assessment year (89 FR 83092, table 18), and that assumes the requirements are already implemented: remediation, enclaves, and GCC High licensing come on top. Much of the sticker shock in CMMC pricing articles is Level 2 pricing quoted to companies that never see CUI.
As of September 3, 2026, a DFARS class deviation directs contracting officers to remove third party assessment requirements from contracts, and Level 1 and Level 2 may be satisfied by self assessment. The program rule still provides for certification, so the solicitation sets the track. DFARS 252.204-7012, NIST SP 800-171 Rev 2, the SPRS score and the annual affirmation are unchanged. Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way.
Government figures on this page are Cybersecurity Maturity Model Certification (CMMC) Program, final rule, 89 FR 83092 (October 15, 2024), regulatory impact analysis, section 4.1.2, pages 83177 to 83189, in 2023 dollars. DoD's estimates assume the security requirements are already implemented, so they cover planning, the assessment, reporting and the affirmation, not remediation, tooling or a consultant's fee.
The two-minute question worth thousands of dollars: does your work involve CUI, or only Federal Contract Information? If it is FCI only, you are a Level 1 company, and every number in the table above applies instead. The free check sorts this out from your actual contracts.
What moves your number up or down
What information you handle
FCI only means CMMC Level 1 and a self assessment. CUI in scope means Level 2, 110 requirements and a much larger effort, self assessed and scored out of 110. Confirming you are FCI only is the single biggest cost saver available, and most small subcontractors are.
Your current stack
A company already on Microsoft 365 Business Premium or Google Workspace has most Level 1 controls one setting away. A company on personal Gmail and shared logins pays in remediation time before anything else.
How the work gets done
The same 15 requirements cost $0 in software if you DIY with the official guides, $458.34/mo on a guided platform with a compliance officer included, or a project fee through a consultant. The deliverable, a defensible SSP and affirmation, is the same.
Evidence habits
Contractors who keep screenshots and exports as they configure spend hours on their assessment. Contractors reconstructing evidence months later spend days. The habit is free; the reconstruction is not.
CMMC cost: FAQ
How much does CMMC cost?
It depends on the level. CMMC Level 1 has no fee at all: it is a self assessment you affirm in SPRS for free. DoD's own estimate for a small business's Level 1 self assessment and affirmation is $5,977 a year of labor (89 FR 83092, table 15), assuming the 15 safeguards are already in place; a guided platform with a compliance officer included is $458.34/mo, and a consultant bills it as a project. For Level 2, DoD estimates $34,277 for a small business's self assessment year (89 FR 83092, table 18), before remediation and tooling.
How much does CMMC Level 1 cost?
Filing costs nothing: the self assessment and the SPRS affirmation are free. The real cost is doing the work on the 15 FAR 52.204-21 requirements. DoD budgets about 28 hours a year and $5,977 of labor for a small business (89 FR 83092, table 15). Custodia guides the whole cycle for $458.34/mo with a credentialed compliance officer reviewing every step, at your team's pace.
How much does a CMMC Level 2 assessment cost?
The Department's estimate for a small business's Level 2 self assessment is $34,277 in the assessment year (89 FR 83092, table 18): your team's planning, assessment and reporting time across all 110 requirements. Remediation, enclave tooling, and outside help are extra, and the figure assumes the requirements are already implemented. This is why it pays to confirm whether you actually handle CUI before assuming you need Level 2: many small subcontractors only handle FCI and belong at Level 1.
Is CMMC free to file?
At Level 1, effectively yes: there is no assessor, no application fee, and SPRS submission is free. You pay only for whatever help you choose. At Level 2 there is no filing fee either, but the work behind the 110 requirements is real: DoD budgets a small business a full assessment year of labor for it, before any remediation.
How much do CMMC consultants charge?
For Level 1, a consultant led engagement is scoped and billed as a project, with no published government figure. The Department's own labor estimate for the same self assessment is $5,977 a year for a small business (89 FR 83092, table 15). For a 15 requirement self assessment, most small contractors can get to the same defensible outcome with guided software and a credentialed officer reviewing.
Will the government reimburse my CMMC costs?
There is no general DoD reimbursement program for CMMC compliance costs. Costs are typically treated as ordinary business expenses, and for many contractors they are allowable as indirect costs in rates. Some primes assist key suppliers, but do not plan on outside money: plan on the cheapest legitimate path for your actual level.
Get the Level 1 outcome without the Level 1 markup
Guided self-assessment, evidence review, an SSP drafted from your record for you to read and approve, the affirmation, SPRS walkthrough, and a credentialed compliance officer included. $458.34/mo, cancel anytime, 30 day free trial with no credit card.