Security Questionnaires

CMMC certification costs between $4,000 and $30,000 at Level 1, $30,000 to $300,000 or more at Level 2, and $100,000 to well over $1 million at Level 3. Most contractors expect the audit fee to be the big number. It isn’t. The formal assessment typically accounts for only 25% to 40% of total spend, with preparation, remediation, and technology upgrades consuming the rest. The stakes changed in late 2025. The final 48 CFR acquisition rule took effect on November 10, 2025, which means CMMC requirements now appear directly in Department of Defense (DoD) solicitations and contracts. Starting in November 2026, Phase 2 of the rollout gives contracting officers the authority to require third-party certification for Level 2 work. If you handle Controlled Unclassified Information (CUI), certification is no longer optional, and the cost question becomes a budgeting exercise rather than a hypothetical. This guide breaks down every major cost category, what moves your number up or down, and how to keep the total under control. What Is CMMC Certification and Why Does Cost Vary? The Cybersecurity Maturity Model Certification (CMMC) is the DoD’s framework for verifying that companies in the Defense Industrial Base (DIB) actually protect the sensitive information they handle. The program, codified in 32 CFR Part 170, builds on the security requirements of NIST SP 800-171 and, at the top tier, selected controls from NIST SP 800-172. Costs vary so widely because you can’t buy CMMC off a shelf. Your environment has to reach a certain state and then stay there. A 15-person machine shop with one well-scoped CUI enclave faces a fundamentally different project than a 500-person prime contractor with CUI flowing through a dozen systems. Your starting security posture, the scope of your assessment boundary, and whether you build internally or hire help all move the total by six figures in either direction. Average CMMC Certification Cost at a Glance The DoD’s own published estimates are instructive. A triennial Level 2 certification assessment, including affirmations, is projected at roughly $105,000 for small entities and $118,000 for larger ones. Those figures cover only assessment and affirmation activities, though. The DoD excludes implementation costs from its estimates on the grounds that NIST SP 800-171 compliance has been contractually required under DFARS 252.204-7012 since 2017. Your real budget has to cover both. CMMC Certification Cost by Level CMMC Level 1 (Foundational) Cost: $5,000 – $30,000 Level 1 covers Federal Contract Information (FCI) and requires 15 basic safeguarding practices drawn from FAR 52.204-21. Because Level 1 permits an annual self-assessment with no third-party auditor, the costs are internal labor, basic tooling, and documentation. Small contractors with reasonable IT hygiene often land near the bottom of the range. The DoD estimates annual Level 1 assessment and affirmation activity at around $6,000 for a small entity, with the remainder of the range driven by any remediation needed to attest honestly. CMMC Level 2 (Advanced) Cost: $50,000 – $300,000+ Level 2 is where most of the DIB lands and where budgets get serious. It requires full implementation of all 110 security requirements in NIST SP 800-171, assessed across 320 individual objectives. For most contracts, a C3PAO (Certified Third-Party Assessor Organization) accredited by the Cyber AB has to conduct the assessment every three years. Market data puts C3PAO assessment fees at $30,000 to $100,000 depending on scope, site count, and complexity. Preparation dwarfs that figure for most organizations. Companies starting from a low maturity baseline routinely spend three to four times the assessment fee on readiness work before an auditor ever shows up. CMMC Level 3 (Expert) Cost: $300,000 – $1,000,000+ Level 3 adds 24 enhanced requirements from NIST SP 800-172 on top of a completed Level 2 certification, and the assessment is conducted by the government’s DIBCAC rather than a commercial C3PAO. DIBCAC charges no assessment fee, but don’t mistake free for cheap. The DoD estimated roughly $41,000 in additional implementation cost for the 800-172 controls alone, and total triennial assessment-related costs in the $146,000 to $159,000 range. Real-world totals run far higher once you account for the advanced tooling, threat hunting capability, and organizational changes Level 3 demands. Only contractors supporting the most sensitive programs need this tier. Worth Knowing: You can’t skip to Level 3. You can’t skip to Level 3. A final Level 2 certification with all POA&M items closed is a prerequisite for the same assessment scope, so Level 3 budgets always include a full Level 2 project first. CMMC Certification Cost Breakdown by Expense Category Gap Assessment and Readiness Planning Costs A gap assessment maps your current environment against NIST SP 800-171 and typically costs $1,500 to $20,000 depending on depth and scope. This is the most valuable dollar you’ll spend in the entire project, because everything downstream is priced off what it finds. Documentation and System Security Plan (SSP) Costs The System Security Plan (SSP) is the cornerstone document of any assessment, mapping every control to your specific implementation. Professionally developed SSPs and supporting policies run $12,000 to $60,000. A weak SSP is one of the most common reasons assessments stall or fail, so this is a poor place to economize. Remediation and Security Control Implementation Costs Closing the gaps is usually the largest line item: $20,000 to $150,000 or more. Multi-factor authentication, logging and SIEM deployment, encryption, access control restructuring, and incident response capability all live here. Organizations with mature security postures spend far less than those starting from scratch. Technology and Infrastructure Upgrade Costs Many contractors move CUI into a dedicated enclave rather than securing their entire network. Enclave platforms typically cost $300 to $400 per user per month. Others upgrade endpoint protection, replace unsupported systems, or migrate to government-grade cloud environments, each with its own licensing and migration costs. C3PAO Assessment and Audit Fees The formal Level 2 assessment runs $30,000 to $100,000, driven by assessor-days, number of sites, and evidence quality. Well-organized evidence directly reduces assessor time and therefore your invoice. Consulting and Advisory Fees Specialist consultants, including Registered Practitioners (RPs) and

Only one of these three vendors sells a FedRAMP-authorized identity platform you can buy today as a defense contractor, one sells two of them, and one sells none. Whether that matters for your CMMC Level 2 assessment depends entirely on whether your identity provider stores, processes, or transmits Controlled Unclassified Information (CUI), or provides security protections for the systems that do. That second condition is where most contractors get the analysis wrong. The IdP question is arguably the most argued-about scoping decision in CMMC 2.0 Level 2 preparation, because an identity provider almost never holds CUI directly, yet it controls access to everything that does. This article works through the regulatory requirement, the actual FedRAMP status of JumpCloud, Okta, and Microsoft Entra ID, and how to choose based on your CUI architecture rather than vendor marketing. Understanding the CMMC Level 2 + FedRAMP Requirement What CMMC Level 2 Requires for Cloud Services Handling CUI CMMC 2.0 Level 2 requires contractors to implement the 110 security requirements of NIST SP 800-171 Rev. 2 and, for most contracts, pass a third-party assessment by a Certified Third-Party Assessor Organization (C3PAO). The 48 CFR acquisition rule took effect on November 10, 2025, which means CMMC clauses now appear in new Department of Defense (DoD) solicitations, with third-party assessment requirements expanding through the phased rollout in 2026 and beyond. The cloud piece comes from the CMMC program rule at 32 CFR Part 170. If an Organization Seeking Certification uses a Cloud Service Provider (CSP) to process, store, or transmit CUI, that cloud service offering must be either FedRAMP Authorized at the Moderate baseline or higher or must meet security requirements equivalent to the FedRAMP Moderate baseline. Your C3PAO verifies this during the assessment. If your in-scope CSP fails the test, you fail the assessment. The DFARS 252.204-7012 “FedRAMP Moderate or Equivalent” Clause The requirement predates CMMC. DFARS 252.204-7012 has required since 2016 that any external CSP used to store, process, or transmit covered defense information meet security requirements “equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline.” For years, “equivalent” was undefined, and contractors interpreted it loosely. The DoD CIO closed that door with its December 2023 equivalency memo. To be FedRAMP Moderate Equivalent, a CSP must now demonstrate 100% compliance with the FedRAMP Moderate baseline, validated by a FedRAMP-recognized Third-Party Assessment Organization (3PAO), and hand over a full Body of Evidence to the contractor. No open Plans of Action and Milestones (POA&Ms) against the baseline are permitted. In some ways, it’s stricter than authorization itself, since authorized CSPs are allowed to carry POA&Ms. Important: A vendor telling you they are “NIST 800-171 compliant” or “aligned to FedRAMP controls” does not satisfy DFARS 7012 or the CMMC rule. Either the offering appears on the FedRAMP Marketplace at Moderate or higher, or the vendor gives you a 3PAO-attested Body of Evidence demonstrating full equivalency. Anything else is a gap your C3PAO will find. When an Identity Provider Falls Under This Requirement An IdP is a cloud service. The question is whether it processes, stores, or transmits CUI. In a typical SSO flow, the IdP handles credentials, authentication tokens, session data, and directory attributes. None of that is CUI in most environments. So a literal reading says the FedRAMP mandate doesn’t apply. The complication is the CMMC scoping guidance, which defines Security Protection Assets (SPAs): assets that provide security functions to the CMMC assessment scope even if they never touch CUI. An IdP enforcing multi-factor authentication (MFA), conditional access, and session policy over your CUI enclave is the textbook SPA. SPAs are in scope for your assessment and get evaluated against the relevant NIST SP 800-171 requirements they help satisfy. Let Axipro help you build a business continuity plan that’s practical, compliant, and audit-ready. Schedule Your Free Assessment Today Schedule A Consultation Does Your Identity Provider Actually Need to Be FedRAMP Authorized? When the IdP Processes, Stores, or Transmits CUI Some architectures do push CUI through the identity layer. If usernames or directory attributes contain CUI (think program names or export-controlled project identifiers), if your IdP proxies application traffic through a gateway that carries CUI payloads, or if CUI-bearing documents get attached to identity workflows, the IdP is now a CSP handling CUI. FedRAMP Moderate or equivalent becomes non-negotiable. When the IdP Provides Security Protections for CUI (SPA Role) This is the common case, and it’s genuinely gray. The FedRAMP requirement in the rule text attaches to CSPs that process, store, or transmit CUI. A pure-play authentication service that does neither is an SPA, not a CUI-handling CSP. Under the final CMMC rule, External Service Providers (ESPs) that handle only Security Protection Data, such as configuration data, logs, and credentials, do not themselves require FedRAMP authorization or a separate CMMC certification. Their services get assessed as part of your assessment. In practice, C3PAOs are not uniform on this. Some accept a well-documented System Security Plan (SSP) showing the IdP never touches CUI. Others take a conservative view that authentication data for CUI systems is sensitive enough that they want FedRAMP-grade assurance behind it, and they will probe hard. DIBCAC’s historical position, given publicly by officials as far back as 2020, is that clouds with management access to CUI systems don’t need FedRAMP unless CUI actually moves into them. That position helps, but you carry the burden of proving CUI never transits the service. Cases Where a Commercial IdP May Be Acceptable A commercial, non-FedRAMP IdP can survive a CMMC Level 2 assessment when all three of the following are true: CUI demonstrably never touches the IdP, the IdP is documented as an SPA with the specific 800-171 requirements it supports, and the data flows in your SSP prove the boundary. This is exactly how many contractors run enclave strategies, keeping a commercial identity stack for the corporate network while the CUI enclave uses its own FedRAMP-authorized identity. The “External Service Provider” (ESP) Classification Under CMMC The final