Nobody can quote your CMMC bill from a blog post, and you should distrust anyone who tries. What we can do is give you the honest shape of the numbers — the government’s own estimates, the ranges we see in the market in 2026, and the one decision that swings the total more than everything else combined.
The government’s own estimate
In the CMMC Program Rule, the DoD estimated a Level 2 third-party certification at roughly $105,000–$118,000 per entity — covering the triennial C3PAO assessment plus the two annual affirmations in between. For comparison, it put a Level 2 triennial self-assessment at about $37,000–$49,000 and a Level 1 self-assessment in the $4,000–$6,000 range.
What the market actually charges
Ranges published by assessors and practitioners in 2026 cluster fairly tightly, and they match what we see in Northern Virginia:
- C3PAO certification assessment: roughly $40K–$60K for a sub-50-person company with a tight enclave; $60K–$110K for 50–250 people; $110K–$250K for larger or multi-site environments. Travel is usually billed separately, and a POA&M close-out assessment adds $8K–$20K if you certify conditionally.
- Gap assessment: $15K–$45K depending on size and how much documentation already exists.
- Remediation: the widest band — $20K to well past $150K. Typical line items: identity and FIPS-validated MFA ($10K–$40K), government-cloud licensing premiums (~$10–$35 per user per month), migration labor ($15K–$60K), centralized logging ($10K–$40K per year), endpoint hardening and configuration management ($15K–$50K).
- Ongoing operation: $15K–$50K per year for monitoring, tooling, and keeping evidence current — then recertification at years three at 80–100% of the original assessment fee.
Put together, realistic first-cycle totals land around $90K–$160K for a small contractor with a well-scoped enclave, and $150K–$300K for mid-sized environments. Larger, flatter networks go up from there.
The one lever that matters: scope
Every number above is really a function of one decision: how much of your environment is in the assessment boundary. A properly designed enclave — a contained environment where CUI actually lives, often built on Microsoft 365 GCC High — can remove the majority of your assets from scope. Published analyses put the reduction at 60–90% of assets, and the worked examples are stark: the same 150-person manufacturer might face a $90K–$130K assessment enterprise-wide versus $45K–$60K with an enclave, with remediation differences even larger.
Scoping is also where bad advice gets expensive. An enclave that is drawn wrong — CUI leaking into out-of-scope systems, external providers nobody mapped — fails assessments and burns rework. It is engineering, not paperwork.
Does the Phase 2 pause change the math?
No — it changes the calendar, and the calendar is your friend right now. The obligations that drive most of the spend (DFARS 252.204-7012 and NIST SP 800-171) are untouched by the Phase 2 suspension, and remediation done without deadline pressure is consistently cheaper than remediation done in a certification-season rush. The companies spending smart in 2026 are using the pause to fix the slow, structural items at leisure prices.