What does CMMC readiness actually cost a small machine shop?

The numbers DoD itself published

When DoD finalized the CMMC program rule (32 CFR Part 170, published October 15, 2024 — 89 FR 83092), it included its own cost analysis. For a small entity: a Level 1 self-assessment and affirmation runs $5,977 a year. A Level 2 self-assessment runs $34,277 for the assessment event — $37,196 over the three-year cycle once the two annual affirmations are added. A Level 2 certification assessment, the kind a C3PAO conducts, runs $101,752 for the assessment event and $104,670 over the three-year cycle. Inside that figure DoD models the C3PAO engagement itself at $31,234 — a three-person team for 120 hours.

Two honesty notes, both from the rule itself. First, DoD says plainly that its estimates are “not actual prices of C3PAO services available in the marketplace” — “market forces of supply and demand will determine C3PAO pricing.” Second, the estimates assume the work is already done: the rule states there are no engineering costs in its model “since it is assumed the contractor or subcontractor has implemented the NIST SP 800-171 R2 security requirements.” In other words: this is the cost of taking the test, not of studying for it.

The part nobody can quote you sight-unseen

Implementation — actually meeting the 110 security requirements of NIST SP 800-171 that Level 2 demands — is where the real money goes, and it depends on facts about your shop that no article can know: how many machines and users touch controlled information, what your current environment looks like, and what you can honestly answer today. The CyberSheath/Merrill Research 2025 survey found the median defense contractor’s SPRS score is 60 against the required 110, and a Kiteworks–Coalfire study found 57% of surveyed defense-industrial-base leaders hadn’t completed a NIST SP 800-171 gap analysis at all — so most shops genuinely don’t know their own starting point yet.

Scoping is the lever you control

This part is our analysis, not DoD’s: the single biggest implementation-cost decision a small shop makes is scope — whether controlled unclassified information touches your whole environment or a deliberately small, separated part of it. The rule itself notes that “the size and complexity of the network within the scope of the assessment impacts the costs.” Ten machines in scope cost less to secure, document, and assess than fifty. Scoping before spending is the order of operations that keeps small shops solvent.

The clock

CMMC became contractual on November 10, 2025, when the DFARS acquisition rule took effect. The schedule beyond that changed after this article first ran: on July 13, 2026, DoD announced the immediate suspension of Phase 2 — which would have expanded C3PAO certification requirements starting November 10, 2026 — pending a comprehensive review of the program, while stating that all Phase 1 self-assessment requirements “remain firmly in place.” A suspension is not a repeal: the acquisition rule stays on the books, and the 110 requirements a gap assessment measures against haven’t changed. Only 1% of defense contractors surveyed by CyberSheath/Merrill Research call themselves fully prepared. The math above is why waiting is still expensive: the gap assessment that tells you your real number costs a fraction of guessing wrong.