If you handle Controlled Unclassified Information on a DoD contract, CMMC Level 2 is no longer optional, and it is not cheap. Across published 2026 figures, total cost for a small business lands between $75,000 and $300,000, with small firms averaging around $138,000 when you add up preparation, remediation, and the assessment itself. The third-party assessment fee on its own runs $30,000 to $118,000 depending on the assessor and your environment.
That is a wide range, and the spread is the whole story. Two SDVOSB shops with the same headcount can be $200,000 apart because one scoped its network tightly and the other let CUI sprawl across every laptop in the company. Below is the honest breakdown so you can budget before the November 10, 2026 enforcement date, not after you lose a recompete.
Why the Range Is So Wide
The assessment fee is the part everyone quotes, but it is only 25% to 40% of what you will actually spend. The DoD's own estimate for a Level 2 C3PAO assessment is $105,000 to $118,000, while real-world C3PAO quotes for small, well-scoped environments come in closer to $30,000 to $75,000. C3PAOs set their own prices, and with roughly 99% of the defense industrial base still uncertified as of early 2026, demand is going to push those numbers up, not down.
The other 60% to 75% of your budget is preparation and remediation — the work of actually meeting all 110 NIST SP 800-171 controls before an assessor ever shows up. That is where small contractors get surprised.
The Five Cost Buckets
1. Gap assessment / readiness review: $8,000–$30,000. A consultant maps your current state against the 110 controls and tells you what is missing. You can do a lighter version yourself with a free readiness tool, but most small firms hire help here because the scoring methodology is unforgiving.
2. System Security Plan and documentation: $12,000–$60,000. The SSP is the single most-scrutinized artifact in the assessment. It has to describe how every control is implemented across every in-scope system. Outdated or generic SSPs are one of the most common reasons assessments fail.
3. Technical remediation: $20,000–$150,000+. This is the big variable. Standing up multi-factor authentication everywhere CUI lives, deploying FIPS-validated encryption, building centralized log collection, and segmenting your network are all real engineering projects. A shop that already runs Microsoft 365 GCC High with MFA enforced spends far less than one starting from a flat consumer-grade network.
4. Managed services and tooling: $15,000–$50,000/year, recurring. A SIEM for log review, an endpoint detection tool, and often a managed security provider to keep it all running. This is ongoing — it does not stop after you certify.
5. The C3PAO assessment: $30,000–$118,000. The third-party audit itself, scheduled once you believe you are ready.
A Realistic Small-Business Budget
For a 10-to-25-person SDVOSB that already uses a compliant cloud environment and scopes CUI to a single enclave, a defensible first-year budget is $90,000 to $150,000, plus $20,000 to $40,000 a year to maintain it. A firm starting from scratch — shared drives, no MFA, CUI on every machine — should plan for $200,000 to $300,000 in year one. The biggest lever you control is scope: the less of your business that touches CUI, the smaller every one of these buckets gets.
The SDVOSB Budgeting Angle
Service-disabled veteran-owned firms bid DoD work more heavily than almost any other small-business category, which means CMMC hits SDVOSBs disproportionately. The math that matters is not the $138,000 in isolation — it is the $138,000 against the contract pipeline it protects. If certification is the gate to a $2M base-plus-options recompete you have held for six years, the cost is a rounding error. If you are chasing one $80,000 task order, it may not pencil out, and the right move might be subcontracting under a prime who is already certified, or scoping your work so you never touch CUI in the first place.
Treat CMMC as a capital expenditure tied to a specific revenue stream, not a compliance tax you pay into the void. Budget it the way you would budget bonding capacity: as the cost of access to a market segment.
What Drives a Firm to the High End
- CUI everywhere. No enclave, no segmentation — every device is in scope.
- Consumer-grade IT. Starting without MFA, without managed endpoints, without centralized logging.
- No internal IT staff. Everything gets outsourced at consulting rates.
- A rushed timeline. Compressing 12–18 months of work into 4 months means paying premium rates and buying tools you have no time to optimize.
What Keeps a Firm at the Low End
- A tightly scoped CUI enclave (often a single GCC High tenant).
- MFA and FIPS-validated encryption already in place.
- An accurate, continuously maintained SSP.
- Starting early enough to use a POA&M for the last few controls rather than buying your way out under deadline pressure.
The cheapest dollar you will ever spend on CMMC is the one you spend 18 months early, scoping CUI down before it spreads.