What CMMC Level 1 costs a small shop
Level 1 is the least expensive CMMC level because you assess yourself. What you actually spend depends on how close you already are to the 15 requirements.
The short answer
There's no outside assessor at Level 1, so there's no assessor fee. Your costs are your own time, any fixes you need, and outside help if you hire it.
DoD published its own estimate in the final CMMC program rule on October 15, 2024. As summarized by Greenberg Traurig, DoD estimated about $6,000 for a small business's Level 1 self-assessment and about $560 for the annual affirmation. Those figures cover the assessment and affirmation work. DoD didn't count the cost of implementing the security requirements themselves, because those were already required by earlier FAR and DFARS clauses. So if you have gaps to close, that's extra.
Three ways to do it
We won't quote other firms' prices. Here's how the three routes compare in general terms.
Do it yourself
Lowest cash cost. You read the requirements, gather evidence, write policies and enter the result in SPRS. The real cost is hours, and the risk that your affirmation isn't backed by proof.
Consultant
A one-time project to assess, document and prepare the affirmation. Pricing varies by firm and may be fixed or hourly. Ask whether IT work is included.
Managed service provider
An ongoing monthly IT service that can run the technical controls, like patching and antivirus. Whether it includes the written policies, evidence and affirmation varies, so ask.
Many small shops end up mixing these: their existing IT handles the technical settings, and someone handles the paperwork. Whichever route you pick, get the scope and price in writing.
What drives the cost
- Headcount and devices. More people and laptops means more accounts, more settings and more evidence.
- Scope. If FCI is spread across every system you use, everything is in scope. Keeping it in fewer places can shrink the work.
- Your starting point. If antivirus, updates, a firewall and individual logins are already in place, most of the work is documentation.
- Written policies. Starting from zero takes longer than updating what you have.
- Physical setup. Multiple locations mean more doors, keys and visitor logs.
- Fixes that need purchases. A missing firewall or antivirus product is a real cost the DoD estimate leaves out.
- CUI. If you receive Controlled Unclassified Information, you're likely looking at Level 2, which covers 110 NIST SP 800-171 controls and costs more.
Free routes first
Before paying anyone, use what's free. The clause text is public at acquisition.gov, and DoD publishes Level 1 guidance, including an assessment guide and a scoping guide, through its CMMC program. Our FAR 52.204-21 checklist is free too. If you can do it yourself and back every answer with evidence, you may not need us.
Onyx pricing
Fixed prices, agreed up front, no hourly billing:
| # | Service | Price |
|---|---|---|
| 1 | Readiness check: where you stand on all 15 requirements, with a written gap list | $495, credited in full toward setup |
| 2 | Level 1 setup: written policies, evidence binder, guided SPRS affirmation, about 21 days | $3,500 for 1–10 people $4,500 for 11–25 people |
| 3 | Yearly renewal: annual re-assessment, binder update and affirmation | $750 / year |
We handle the written side. If a gap needs new hardware, software or IT work, that's done by your IT person or provider and isn't in our price. You keep everything we build. See pricing on the home page.
Common questions
Is DoD's $6,000 estimate what we'll pay?
Not necessarily. It's DoD's estimate of the assessment work for a small business, and it leaves out the cost of implementing the requirements. Your cost depends on your gaps and whether you hire help.
Is there an assessor fee for Level 1?
No outside assessor is involved at Level 1. Your company assesses itself and affirms the result in SPRS.
Does the yearly renewal cost as much as the first year?
With Onyx, no. The yearly renewal is $750, compared with $3,500 to $4,500 for setup, because the policies and evidence binder already exist.
Is the $495 readiness check wasted if we sign up for setup?
No. It's credited in full toward the Level 1 setup.
Why is Level 2 so much more expensive?
Level 2 covers the 110 controls in NIST SP 800-171 for companies handling CUI, compared with 15 requirements at Level 1.
Find out where you stand in 20 minutes.
Free, no obligation. If you're already covered, we'll tell you.
Sources
- Greenberg Traurig, Recapping CMMC Level 1 considerations (Oct 2025)
- DefenseScoop, CMMC implementation cost estimates (Dec 2023)
- Holland & Knight, Fifteen key takeaways from the final CMMC program rule (Oct 2024)
- FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems (acquisition.gov)
- DoD CIO, About CMMC
- McDermott Will & Emery, CMMC from the bottom up: Level 1
- Morgan Lewis, DoW suspends CMMC Phase II, but cybersecurity obligations remain (July 2026)
General information, not legal advice. Back to Onyx home.