How Much Will CMMC Certification Cost?

For most organizations there are likely to be three primary costs to getting CMMC certified:

1. Soft costs to prepare for the audit (e.g., internal resourcing or external consulting costs)
2. Hard costs to prepare for the audit (e.g., expenditures to achieve a particular requirement such as a SIEM or two-factor authentication)
3. Hard costs for the CMMC Audit itself (e.g., the cost for the Certified Auditor, which potentially will be an “allowable expense”)

Soft costs for getting prepared for the audit

Your actual costs will depend on a number of factors, including but not limited to the maturity of your current NIST SP 800-171 program, the size of your organization, whether you require external support, how many locations are involved, the CMMC Level you’re looking to achieve and the scope of your Controlled Unclassified Information (CUI). CUI scope is how many geographic locations, systems, databases, applications and networks store, process or transit CUI. To simplify, let’s break the above into two buckets and assume CMMC Level 3, which is likely to be the most common target:

1. Organizations that have a reasonably mature SP 800-171 compliant environment
   • Consulting Costs: You will likely want to employ a CMMC Gap Assessment (may be called a Readiness Assessment). For a typical 250-person engineering/manufacturing firm with multiple locations whose 800-171 program is managed centrally, a reasonable estimate is $15,000-$35,000. That pricing is comparable to an ISO 27002 Gap Assessment, which is a reasonable proxy in terms of size and approach to CMMC Level 3 (130 controls) as ISO 27002 covers 114 controls. Differences between the upper and lower ends of the range have to do with sampling rates and whether technical testing is included in the work effort. If you require support for Gap Remediation that can range considerably based on the findings. In a more mature environment, $0-$10,000 is a reasonable estimate. If you are less mature than you thought, $0-$25,000 is a reasonable estimate. Pro-tip – If you don’t have an up-to-date Risk Assessment and System Security Plan then you don’t have a reasonably mature environment.
   • Hard Costs for Prep: If you are reasonably mature you likely will need to spend very little in hard costs to get prepped. It’s entirely reasonable to assume $0. You are not reasonably mature if you have not made notable investments in the last five years for items like endpoint protection, multi-factor authentication, log monitoring/SIEM, etc.
   • Hard Costs for Audit:  This one is harder to estimate given that there is not yet any guidance for the audit process. If I were designing the audit program I would set it up like the Standardized Control Assessment from Shared Assessments. It is essentially a fully defined audit program including the questions to ask, artifacts to gather, sampling rates and a prescribed reporting format. Assuming the audit program follows a model of this nature the pricing across auditors should be fairly consistent.  Best guess: $20,000-$40,000.
2. Organizations without a mature SP 800-171 compliant environment
   • Consulting Costs: You will likely want to start with a CUI Scoping Exercise (to try to minimize the scope and associated costs) and a Risk Assessment (a requirement of CMMC) first. This will ensure you have the proper context for the Gap Assessment. For a typical 250-person engineering/manufacturing firm with multiple locations a good estimate is $30,000-$50,000. That pricing is comparable to establishing the foundation of an ISO 27001 or SOC 2 information security program, which is a reasonable proxy in terms of size and approach. Differences between the upper and lower ends of the range have to do with current maturity, CUI scope and project approach. If you require support for Gap Remediation that can range considerably based on the findings. In a less mature environment, $10,000-$40,000 is a reasonable estimate. Taking this approach generates the required Risk Assessment and builds the foundational Scope Statement that is integral to the required System Security Plan.
   • Hard Costs for Prep: Cost here depends on the technology you have implemented in your environment. CMMC level 3 ostensibly requires mobile device management, log monitoring/SIEM, security awareness training, multifactor authentication, data backups, code review and advanced email protection. Most viable organizations are going to have a fair number of these tools in place. Best case: $0. Typical case: $20,000-$60,000. Worst case: $100,000. As an example, a conversation was recently had with a client at a 100-person firm that has a very mature NIST SP 800-171 compliant environment, which cost approximately $170,000 to achieve from scratch. This is consistent with the ranges floated.
   • Hard Costs for Audit:  As above, best guess: $20,000-$40,000.

Summary

The takeaway here is that the organization seeking CCMC certification needs to:

1. Conduct or have an assessment completed using NIST 800-171 guidelines. This will establish a cyber security baseline and give the organization an idea of what it needs to do and/or how much it may need to budget for various level certifications.
2. Work with an ETHICAL, independent assessor that understands it will need to complete training/examination and work with an approved C3PAO. In 21CT’s case this will be its relationship with ACS/Canon and its own independent certification to be achieved in 3Q 2020.
3. Be patient. The CMMC is an evolving process. The first Request For Information (RFI) is not due to the CMMC hierarchy until June 12, 2020 so the groups responsible for providing training, conducting examinations and providing the actual CMMC certifications to assessors is not completed. This is all a work in progress.