What a C3PAO Assessment Costs, and Why You Are Not Paying It Yet

What does a C3PAO assessment cost?

DoD publishes its own per-assessment estimate in the CMMC final rule (32 CFR Part 170, 15 October 2024) under the heading "CMMC Level 2 Certification Assessment and Affirmation Costs", and that is the number to read, because any figure a vendor quotes is a guess about a market that is currently paused. For now you are not paying a C3PAO at all: the DFARS class deviation of 3 September 2026 removes the third-party assessment requirement from solicitations and contracts, with no end date and no repeal.

So the honest answer to the headline question is two answers. The government's estimate is in the rule. Your invoice is zero until a contract says otherwise.

Why no one should quote you a C3PAO figure today

Three reasons.

First, the fee was never a list price. C3PAOs are independent firms that set their own rates, and the rule estimates cost from assessor labor hours against a scoped boundary. A supplier with CUI in a six-user enclave and a supplier with CUI on every device are different jobs with different fees, even at the same firm.

Second, the market stopped. Phase 2 third-party assessments were suspended on 13 July 2026 while the Department reviews cost and assessor capacity. Rates quoted before that date describe a market that no longer exists; rates quoted after it describe one that has not restarted.

Third, there is a readiness vendor's temptation to use a scary assessor number to sell a readiness package. We would rather you read the rule.

Where the program stands

Phase 1 self-assessments have appeared in solicitations since 10 November 2025. Phase 2 third-party assessments were suspended on 13 July 2026, and the class deviation of 3 September 2026 removes the C3PAO requirement from contracts for now, with no end date and no repeal. DFARS 252.204-7012, NIST SP 800-171 Rev 2, SPRS scores and the 72-hour incident report still apply. AccuSights is not a C3PAO.

What the class deviation changed, line by line

Item	Before 3 September 2026	Now
C3PAO certification requirement in Level 2 contracts	Expected to phase in	Removed from contracts for now, per the class deviation
NIST SP 800-171 Rev 2 under DFARS 252.204-7012	Required	Required
SPRS score under DFARS 252.204-7019 and 7020	Required before award	Required before award
Level 1 and Level 2 self-assessment and affirmation	Required where the solicitation says so	Required where the solicitation says so
72-hour cyber incident report	Required	Required

The deviation moved one line. Every other line is a cost you already carry.

The costs you are paying instead

The self-assessment path has no assessor fee at either level, per the DoD CIO's FAQ and the rule's own cost section. What a Level 2 supplier pays for is the work of becoming true: scoping, the gap assessment against 110 requirements, the system security plan, the POA&M, the fixes and the evidence behind an honest score. That is where the money goes, and it is money you would have spent before any C3PAO walked in.

For a small supplier with contained CUI, our CMMC gap readiness package starts at $6,000, according to the AccuSights pricing page, and covers scoping, the 110-requirement gap assessment, the SSP, the POA&M and the SPRS score worksheet. Fixes are priced by what the gaps are. Some are settings. Some need a purchase, usually MFA, logging or encryption, and we list those with the gap so you can budget them.

The CMMC cost page goes through the seven drivers that move a quote. The short version: shrink the boundary before you count anything else.

Why readiness now is cheaper than readiness later

When certification returns, every supplier that waited will want the same assessors in the same quarter. The DoD rule estimates assessment cost from labor hours, and a supplier arriving with an SSP that matches reality, a POA&M with nothing on it that the rule forbids, and evidence filed by requirement is a shorter job. What can stay open on a POA&M sets out those limits.

There is also the score. DFARS 252.204-7019 requires a current SPRS score before award, and an inflated one is a False Claims Act exposure rather than a shortcut. How to calculate your SPRS score honestly covers the arithmetic and the risk. A true score posted now is the cheapest insurance you can buy against a certification date you do not control.

If you are still unsure which level you are at, Level 1 vs Level 2 settles that first. The NIST SP 800-171 framework page covers the requirements themselves.

Where AccuSights fits

We prepare you for the assessment and do not perform it; we are not a C3PAO and never mark up an assessor's fee. You get a named engineer, implementation and remediation included, and a fixed fee in writing within 24 hours of the intake form. Start on the CMMC framework page or book a free Risk Diagnosis and we will tell you what you are actually paying for this year.