What Does CMMC Level 1 Actually Cost?
Ask three vendors what CMMC Level 1 costs and you’ll get three numbers, all of them theirs.
Here’s the honest version: the requirement itself has no licence fee. There’s nothing to buy from the government, no certification to purchase, and no mandatory product. What you spend depends almost entirely on how much help you decide to buy.
What’s genuinely free
The standard. The 15 requirements come from a federal contract clause. Reading them costs nothing.
The assessment. Level 1 is self-assessed. No third-party assessor, no assessment fee. That isn’t true at Level 2, which is where the five-figure numbers come from — and it’s why Level 2 pricing gets quoted at people who only need Level 1.
The submission. Recording your score and affirmation in SPRS costs nothing.
Most of the controls. Unique logins, removing former employees’ accounts, turning on automatic updates, using the antivirus already built into Windows, locking the door to the room with the server, wiping drives before disposal. Every one of these is a practice or a setting, not a purchase.
What you’ll actually spend
Your time. This is the real cost and the one nobody quotes. For a small contractor, working through the 15 requirements honestly, finding the gaps, fixing them and documenting it takes somewhere between a day and a week of someone’s attention. If you already know your systems, it’s closer to a day.
Small fixes, sometimes. The gaps that cost money tend to be modest: a password manager if you decide you want one (you don’t need one — see do you need a password manager), a lockable cabinet, a shredder, replacing a shared login with individual accounts on a plan that charges per seat. Most contractors land under a few hundred dollars. Many spend nothing.
Tooling. Something to structure the assessment, keep your answers consistent from one year to the next, and produce a record you can hand to a prime. A few hundred dollars a year at this level. (CMMCheck is one of these.)
Help, if you want it. A consultant for Level 1 typically runs a few thousand dollars. You probably don’t need one, and if you do, how to choose one is worth reading first.
What you’ll get quoted that you don’t need
This is where the money goes, and almost all of it is avoidable.
Government cloud. GCC High, Box for Government, specialised hosting. These solve CUI problems. At Level 1, commercial tools are fine.
Enterprise security platforms. Managed detection and response, SIEM, security operations centres. All legitimate products. None of them Level 1 requirements.
“CMMC-certified” software. There is no such thing. No product carries CMMC certification, because compliance is a property of your organisation, not of a tool.
Level 2 preparation sold as Level 1. The most expensive mistake available to you. If you handle FCI only, the 110-control programme is not your programme.
A realistic budget
For a ten-person machine shop handling FCI, running Microsoft 365 or Google Workspace on reasonably current computers:
- Assessment and documentation: one to three days of the owner’s or office manager’s time
- Fixes: $0 to roughly $300
- Optional tooling: $0 to a few hundred a year
- Consultant: $0, in most cases
The dominant cost is attention rather than money — which is not what most quotes in this market imply.
Where the cost actually lands
The expensive version of Level 1 isn’t the compliant version — it’s the one where somebody is sold a Level 2 solution for a Level 1 problem.
The way to avoid that is to establish which level applies to you before you talk to anyone selling anything. If you’re not certain, FCI vs. CUI settles it in about ten minutes.
The bottom line
Level 1 has no mandatory cost. Budget time rather than money, expect a few hundred dollars of small fixes at most, and treat any five-figure quote as a signal that someone has either misidentified your level or is selling you something else.