With only about a week to go before the Cybersecurity Maturity Model Certification (CMMC) is set to go into effect on December 16, if you’re among the businesses that haven’t started preparing for CMMC certification, you don’t have any more time to delay.
The Department of Defense (DoD) adopted updated regulations that tighten and streamline cybersecurity requirements for companies handling sensitive physical, technical, or administrative federal information.
It also establishes a system to verify that organizations have met and continue to maintain compliance.
You may be wondering, how much does CMMC certification cost?
We’ll be frank: there is no one-size-fits-all answer to this question. The total cost depends on a number of factors, including: your CMMC level, the size of your organization, your planning and preparation, and the IT security measures you’ve already implemented (if any).
Related Article: What Is CMMC Compliance? 5 Key Steps To Help With CMMC Certification
After reading this article, you’ll have a better understanding of the estimated costs for large and small organizations to get certified. You’ll also learn about factors that can influence your costs, including recurring and non-recurring expenses.
How Much Does CMMC Certification Cost By Level?
For background, if your business handles controlled unclassified information (CUI) or Federal contract information (FCI), then you’ll need to become CMMC certified.
While FCI refers to any information that is not intended for the public, CUI involves data that is either created, stored, or shared by, for, or with the federal government.
Defense contractors or subcontractor in the Defense Industrial Base (DIB) must meet the mandatory CMMC certification requirements in order to continue doing business with the DoD.
The CMMC Final Rule was approved October 15 and is set to go into effect on December 16.
Related Article: CMMC Rule Approved: Next Steps For Compliance
Under the new regulation, businesses are categorized by CMMC level and assessment types, depending on their DoD contract and the type of data they handle.
CMMC Cost Estimates For Levels 1, 2, and 3:
The DoD has provided an updated cost estimate for obtaining CMMC certification within the CMMC Rule published in the Federal Register in October.
For reference, the agency labels small entities as those businesses with fewer than 500 employees or less than $7.5 million in revenue; large entities are identified as companies with 500+ employees or more than $7.5 million in revenue.
Small businesses at Level 1 handling FCI can expect to pay an estimated $6,000 for self-assessments and affirmations; large enterprises at this level can expect to pay slightly less, about $4,000.
These companies would need to complete an annual self-assessment and report the results to the DoD.
At this foundational level, companies are required to show compliance with 15 basic safeguarding measures spelled out in Federal Acquisition Regulation (FAR, clause 52.204-21) to protect FCI.
Level 2 is split into two different groups, again, depending on the type of CUI the business handles.
Small businesses that handle less critical CUI at this level will need to self-assess every 3 years (for select programs). They can expect to pay about $34,000 the first year ($37,000 over three years with reaffirmation costs).
For small entities, these costs include: planning and preparing for the self-assessment at an estimated $14,400, self-assessment costs of $15,500, reporting of assessment results at an estimated $2,800, and affirmation costs at almost $1,500 a year for three years ($4,500).
Large companies at this level will pay around $49,000 over three years.
Other Level 2 companies that handle CUI will need to hire a certified third-party assessment organization (C3PAO) to perform their assessment.
These companies can expect CMMC certification costs ranging from approximately $105,000 to $118,000 over three years, including spending about $46,000 for the C3PAO assessment.
Businesses at this advanced level must satisfy the 110 NIST 800-171 (National Institute of Standards and Technology) security requirements to protect CUI, get assessed by C3PAO every three years, and annually reaffirm compliance.
Level 3 organizations that process, store, or transmit the most sensitive federal CUI information can expect to pay as much as $4.1 million.
The CMMC certification costs for small entities includes an estimated $2.7 million for one-time engineering costs, $490,000 for recurring engineering costs, $9,000 for CMMC certification, and $1,900 for annual affirmation of ongoing compliance.
These companies (expert level) must meet the most stringent security requirements: all of NIST 800-171 controls and an additional 24 security controls from NIST 800-172 to protect CUI, get assessed directly by DoD assessors every three years, and annually reaffirm continued compliance.
What Factors Go Into The Cost of CMMC Certification?
CMMC certification costs are dependent on many different variables, including your CMMC level, as well as fixed, recurring, and one-time expenses.
Those expenses can include CMMC audit costs, certification processing fees, C3PAO assessment fees, CMMC assessment costs, required licensing fees, remediation expenses, and managed IT service provider costs.
Related Article: What Is A NIST 800-171 POAM (Plan Of Action & Milestones) & Key Steps
Keep in mind that the DoD’s cost estimates do not factor in the implementation costs for any necessary remediation non-recurring engineering costs (NRE) or maintenance costs (recurring engineering costs, or RE).
So, whatever software or equipment investments you need to make to become compliant, and the personnel necessary to implement the security measures and maintain compliance are additional expenses.
The Bottom Line On CMMC Certification Costs: Next Steps For Businesses
After reading this article, you should have a more complete understanding of the estimated cost of getting CMMC certified and the factors that can influence those figures.
For Level 1 companies, the process of getting ready for certification can take a few months. Larger businesses can expect to spend a minimum of 12 to 18 months preparing for certification, depending on the complexity of their IT infrastructure and established security measures.
That’s why it’s critical that you act now.
If you have a large enough internal IT staff with the time capacity and know-how to implement all of the security controls needed to meet CMMC compliance, then you likely do not need the help of a managed services IT provider (MSP).
If not, and you haven’t started the certification process or don’t know how to proceed, you may benefit from working with a managed IT services company.
At Kelser, we have an experienced team of IT and cybersecurity professionals who can expertly guide you through the CMMC certification process, avoiding common mistakes that can cost you even more money and further delay your CMMC certification.
Kelser has helped businesses like yours become compliant with various security frameworks over the years, including FAR, NIST, CMMC, HIPAA, and others. Our staff knows what you're going through and how to get you to your goal of compliance.
Use the button below to start a conversation with us about any questions you have about NIST 800-171, CMMC certification, or other compliance topics.
