Updated September 30, 2026
For a 5 to 50 person shop that holds controlled drawings, plan on $60,000 to $150,000 to get ready and tens of thousands a year to stay ready. The government's own estimate is much lower because it assumes you already did the work. How much of that range you pay depends mostly on one decision: how many people and computers ever touch a controlled drawing.
The fear is real. An owner of a two-to-three person shop on r/CMMC expected "CMMC certification to cost more than your defense contract." For some shops that's true, and the honest answer is to leave CUI work. For most, it's a scoping problem wearing a price tag.
Two terms first. CUI (controlled unclassified information) is the drawings, models, and specs the government marks as sensitive. CMMC is the Pentagon's program that checks suppliers protect it. A shop that holds CUI needs Level 2: 110 security requirements, the same ones the contract clause DFARS 252.204-7012 has required since 2017.
The number DoD published, and what it leaves out
When DoD finalized CMMC in October 2024, it estimated what each assessment costs a small business (89 FR 83092, cost analysis):
| Path | DoD's small-business estimate |
|---|---|
| Level 1 self-assessment (FCI only) | $5,977 a year |
| Level 2 self-assessment | $37,196 over 3 years |
| Level 2 with a certified assessor (C3PAO) | $104,670 over 3 years |
| Each annual affirmation | $1,459 |
Read the fine print. The estimates "do not include the cost to implement" the security requirements, or to maintain them. DoD's reasoning is that those costs belong to the 2016 rule that already required them, so the rule prices only the paperwork of proving it: a director's hours and an outside consultant billed at $260.28 an hour. Every dollar you spend on new licenses, a firewall, laptops, and fixing the gaps sits outside that table.
The Small Business Administration counts it differently. When the Pentagon paused the third-party phase of CMMC in July 2026, SBA put total compliance costs at about $388,600 for a small firm on the self-assessment path and $593,800 on the certified-assessor path (SBA). Those numbers fit a 100-person company better than a 12-person Swiss shop, but they're closer to reality than $37,196.
What shops report sits in between. A two-man shop on Practical Machinist was quoted about $100,000 to implement plus roughly $50,000 for each three-year assessment. Another CNC shop reported about $100,000 over two years plus $30,000 for the audit. A 40-person shop spent $100,000 "and we aren't even ready." Midway Swiss Turn, a 10-person shop in Wooster, Ohio, heard initial estimates around $60,000, and its CEO expected the real number to run "a good bit higher" (Production Machining).
Where the money goes
Five line items make up almost every shop's bill. Here's what each buys and where shops overspend.
Where the drawings live. Your email and file storage have to meet FedRAMP Moderate (the federal cloud security standard) or equivalent once they hold CUI (DFARS 252.204-7012). Microsoft's answer is GCC High. Business Premium for GCC High runs about $35.80 per user per month at reseller planning prices (Secureframe pricing guide), plus migration work from the partner who sells it. The alternative is a separate secure service for drawings only, such as PreVeil, which says its service meets FedRAMP Moderate equivalency (PreVeil). The license is rarely the big number. The big number is moving every mailbox when only six people handle drawings. An assessor on r/CMMC called that the "biggest single mistake." Commercial vs. GCC vs. GCC High →
The MSP. Your managed IT provider does most of the technical work: multi-factor login, disk encryption, patching, logging, the firewall between the office and the shop floor. This is the largest recurring cost, and it's where shops feel burned. One described a provider that "did absolutely nothing other than show us their tools." Ask for a fixed-scope quote that names each requirement they will own and each one you will own. An MSP that never stores or handles your drawings itself doesn't need its own CMMC assessment; its services are assessed as part of yours (89 FR 83092). Who does what with your MSP →
The gap assessment. Someone scores you against the 110 requirements and hands you the list of what's missing. Shops on r/CMMC report quotes of $20,000 to $40,000. The list is worth having. Paying $40,000 for it before you've decided your scope isn't, because half the list changes once you shrink the boundary. What a readiness assessment should cost →
The SSP. The system security plan is the written description of your boundary and how you meet each requirement. It's mandatory, and it's one of the six requirements that can never be deferred to a fix-it plan (32 CFR 170.21). One shop reported a quote of "$110K for CMMC docs." Another said "our SSP alone was 300+ pages." Length isn't the goal. An assessor needs to read how you do each thing, in your shop, on your machines.
The C3PAO, if your contract requires one. A C3PAO is the certified third-party assessment organization that issues a Level 2 certificate. Shops report quotes of $28,000 to $60,000. Since July 13, 2026, new DoD contracts may only require Level 1 or Level 2 self-assessments while the program is under review (DoW memo implementing the suspension). That defers this line, not the other four. The 110 requirements, the SSP, and your score in SPRS (the DoD database where suppliers post their self-assessment score) all still apply, and some primes still require a certificate in their purchase orders. What the pause changed →
Scoping is the biggest lever
Every cost above scales with the number of people, computers, and systems in scope. Scope is everything that stores, processes, or sends a controlled drawing. Take a 20-person shop where six people receive, program, and quote from drawings.
| Whole company in scope | Six-person enclave | |
|---|---|---|
| GCC High Business Premium seats | 20, about $8,592 a year | 6, about $2,578 a year |
| Laptops and PCs held to all 110 requirements | Every office and shop PC | The six that open drawings |
| Front office, accounting, ERP | In scope | Out, if drawings can't reach them |
| CNC controllers and CMM | Specialized Assets either way | Specialized Assets either way |
The license math is the smallest part. The MSP's monthly fee, the hours to harden and document each computer, and the length of the SSP all follow the same curve. A shop owner on r/CMMC put it plainly: scoping "can make or break you."
The shop floor is cheaper than most owners fear. CNC controllers and inspection equipment count as Specialized Assets: you list them, isolate them on their own network segment, and describe them in your SSP, but they aren't tested against all 110 requirements (32 CFR 170.19). Nobody expects you to replace a working Okuma to pass. Following one drawing through the shop →
The enclave has one rule that makes or breaks it: drawings arrive in the enclave and never leave it. The estimator who forwards a drawing to his regular inbox to quote it just put that inbox, and his laptop, back in scope. Enclave vs. whole company →
The free help
Three programs cost nothing, and a shop should use all three before signing a consulting contract.
- APEX Accelerators are the DoD-funded small business centers (formerly PTACs) in every state. Most offer free CMMC counseling, help with SPRS, and referrals. Find yours at napex.us.
- MEP centers are NIST's manufacturing extension network, with more than 450 service locations (NIST MEP). Many run subsidized cybersecurity projects. New Hampshire MEP paired Baron Machine, a 44-person Laconia shop, with a provider for a full gap analysis and policy work, partly paid for by a grant (NIST). Midway Swiss Turn used Ohio's MEP center, Magnet, and government funding as well.
- Project Spectrum is a DoD Office of Small Business Programs initiative that offers its training, readiness check, and tools at no cost (Project Spectrum). Use it to learn the requirements before you pay someone to explain them.
Free help won't do the work for you. It will stop you from paying $40,000 for advice that was available at no charge.
Getting the money back
Most of your defense work is firm-fixed-price purchase orders from primes. There's no line on those POs for cybersecurity, and no prime we know of pays for a supplier's enclave. You recover the cost the way you recover the cost of a new CMM: through your rates.
Put it in overhead. If your run-rate cost is $60,000 a year and your shop bills 32,000 direct hours (16 people at 2,000 hours), that's $1.88 an hour on your shop rate. If only defense work uses the enclave and it's 40 percent of your hours, charge it to those jobs: $4.69 an hour. Both are defensible. What isn't defensible is absorbing it and watching your margin on defense work fall by the same amount.
If you ever hold a cost-type contract or your rates get audited, these costs are allowable when they're reasonable and allocable (FAR 31.201-2). Keep the invoices and a one-page note on how you allocated them.
Stay or go: a rule you can run
A longtime contractor wrote in a CMMC forum: "26 years of contracting and we've shifted to almost all commercial." That can be the right call. It's a business decision, and it should be made with arithmetic.
Start with two numbers. The year-one cost to get ready, and the run-rate cost per year after that (licenses, MSP, the annual affirmation, your own hours). Then look at your defense revenue share and the gross profit it earns.
| Defense share of revenue | What we'd do |
|---|---|
| Under 10%, CUI jobs occasional | Leave CUI work. Keep FCI-only work under Level 1, which is 15 basic safeguards and an annual self-assessment (FAR 52.204-21). Tell your primes you'll quote only jobs without controlled data. |
| 10% to 30% | Stay only if a tight enclave (under 10 people) works and the math below passes. If it doesn't pass, go FCI-only. |
| Over 30% | Stay and build it properly. At this share, CMMC is a cost of the business you're in. |
The math test: stay in CUI work if your annual run-rate cost is under 15 percent of the gross profit your defense work earns, and the year-one cost pays back within 24 months. A shop with $400,000 in defense gross profit and a $50,000 run rate passes easily. A shop with $80,000 in defense gross profit and the same run rate is paying more than 60 percent of its defense profit to keep the right to do defense work. That shop should go FCI-only or leave, and it isn't a failure to say so. Staying in without doing the work is the expensive option: an Illinois shop paid $421,234 over drawing security it never had.
Going FCI-only is legal and common. A subcontractor that handles only FCI (federal contract information, the non-public contract details that aren't marked CUI) needs Level 1, not Level 2, at every tier (32 CFR 170.23). Build-to-print work almost always arrives with a controlled drawing, though, so FCI-only means turning down those jobs.
If you stay, do the scoping first, the free help second, and the paid work third. The shops that spend $150,000 usually spent it in the reverse order.