CMMC cost and timeline are driven by five things: which level your contracts require, how broad your scope is, how far you are from the security requirements today, how long remediation takes, and how soon you can book an assessor. This post gives drivers, not prices, because costs vary widely.
What does CMMC require, by level?
The Department of Defense's rule is 32 CFR Part 170. It applies to DoD contract and subcontract awardees that process, store or transmit Federal Contract Information or Controlled Unclassified Information on contractor systems. The status levels in the rule are:
- Level 1 (Self): a self-assessment for Federal Contract Information.
- Level 2 (Self): a self-assessment against the Level 2 requirements, with results entered in the Supplier Performance Risk System.
- Level 2 (C3PAO): an assessment by a certified third party assessment organization.
- Level 3 (DIBCAC): an assessment performed by the Defense Contract Management Agency's DIBCAC, which requires a Final Level 2 (C3PAO) status first.
The government program office selects the status for a contract, based on the type of information involved, so you do not choose your level. Your contracts do.
Why is the timeline uncertain?
The rule phases CMMC into solicitations over four phases, each beginning one calendar year after the previous one, starting on the effective date of the related acquisition rule. In Phase 1 DoD intends to require Level 1 or Level 2 self status. Phase 2 adds Level 2 (C3PAO) and may add Level 3. By Phase 3 the Level 2 (C3PAO) requirement extends to all applicable solicitations, and Phase 4 is full implementation. DoD keeps discretion in several places. Check the DoD CIO CMMC site for current dates before you plan.
What actually drives cost and time?
1. Scope. The biggest lever. Every system that handles CUI, plus systems that protect it or connect to it, is in the assessment scope. A narrow, well-bounded environment for CUI is smaller to secure and to assess than a company wide network. Many firms isolate CUI work in a defined enclave, though that has its own build and run cost.
2. Starting gap. Level 2 is measured against the NIST SP 800-171 requirements. The rule's own example score is 105 out of 110. A company that already implements most requirements, with documentation, has less work than one starting from nothing.
3. Remediation. Fixing gaps takes engineering time and may need new tools, such as multi-factor authentication, logging, endpoint protection and encryption. Plan for staff time as well as purchases.
4. Documentation and evidence. An assessor expects policies, procedures and proof that they operate. Writing them takes time, and keeping records current takes more.
5. Plan of action and milestones rules. The rule allows a limited plan of action only in line with its conditions. For a Level 2 self-assessment, a conditional status expires if the plan is not closed out within 180 days. Gaps you assumed you could leave open may not be allowed to stay.
6. Assessment type and scheduling. Self-assessment costs staff time. A third party assessment adds the assessor's fees and the wait for a slot. Ask providers about lead times early. Prices vary and are quoted by assessors, so get several quotes rather than relying on figures in articles.
7. Maintenance. Level 2 self-assessments repeat every three years, with annual affirmation of continued compliance. Level 3 assessments repeat every three years, and also need a current Level 2 (C3PAO). Budget for upkeep, not a one time project.
8. Subcontractors. Requirements flow down. If you are a prime, you must manage your suppliers' status. If you are a supplier, expect your primes to ask.
Where does software supply chain evidence fit?
Several requirements concern configuration management, vulnerability handling and system integrity. An inventory of software components and records of dependency scanning support those areas. Safeguard can generate SBOMs and scan dependencies, and its compliance automation can gather evidence, and it offers deployment on premises or air-gapped. These help with evidence. They do not certify you, because only the assessment processes defined in the rule produce a CMMC status.
What to do
- Read your current contracts and clauses to see which information types you handle and which status is expected.
- Define the CUI scope as tightly as you can, and draw it.
- Run a gap assessment against NIST SP 800-171 using the assessment guide NIST SP 800-171A.
- Estimate remediation by gap, with owners, tools and staff time.
- Write and test your policies and procedures.
- Ask several assessors about price and lead time, if your contracts need a third party assessment.
- Map your subcontractors and check what they will need.
- Set a three year calendar for reassessment and annual affirmations.
Quick check
Do I get to choose my CMMC level?
No. DoD program managers or requiring activities select the status for a procurement based on the type of information, FCI or CUI, involved.
How often must a Level 2 self-assessment be repeated?
Every three years, with results submitted to SPRS, and an affirmation of continued compliance each year, per 32 CFR 170.16.
Sources
- 32 CFR 170.3, Applicability (Cornell LII)
- 32 CFR 170.16, Level 2 self-assessment and affirmation (Cornell LII)
- 32 CFR 170.18, Level 3 certification assessment (Cornell LII)
Last reviewed: 18 October 2026.
