Ask "what does CMMC Level 1 cost" and you'll get answers from free to $15,000 - and the confusing part is that all of them are honest. The spread comes from what you're actually buying: your own time, documents, guided tooling, or a consultant's hours. Here's the market as it actually prices out, including the option vendors don't advertise.
The real price list
| PATH | TYPICAL COST | WHAT YOU GET - AND DON'T |
|---|---|---|
| Full DIY | $0 + your weekends | Everything is published free: FAR 52.204-21, the DoD's self-assessment guidance, the SPRS entry guides. You translate the federal language, write your own policies, and figure out evidence yourself. Real path; budget a month of spare time. |
| Policy-only generators | ~$80-150 | Auto-generated written policies. Genuinely useful, but policies are one piece - no gap assessment, no remediation order, no evidence checklist, no SPRS walkthrough. Paper alone doesn't survive a prime's questions. |
| Template libraries and doc packages | $500-5,000 | Editable document bundles, sometimes enterprise-grade. You still do the assembly, the tailoring, and the interpreting - the work moves from writing to editing. |
| Guided assessment tools (this is us) | $249-349 one-time | The complete Level 1 job: guided assessment of all 15 requirements, an honest scored gap report, remediation plan, policies written from your answers, evidence checklist, SPRS walkthrough. |
| Consultants and RPOs | $5,000-15,000 for Level 1 | Someone experienced does it with you or for you. Worth it for complex environments, multi-site shops, or when a prime's deadline is next week and you have no hours to give. |
One number for calibration: documentation alone gets quoted at $500-1,500 for template sets, and consultant-market guides put full template packages at $2,000-5,000. The Level 1 market prices like the enterprise market it grew out of, which is exactly why a 10-person shop staring at those quotes feels stuck.
The costs nobody quotes
Remediation is usually near-free - at Level 1. The common fixes are settings and habits: individual logins instead of the shared shop PC, multi-factor authentication that's already included in Microsoft 365, a visitor sign-in sheet, a wipe log for retired drives, a router you've actually logged into. A typical small shop's hard-dollar remediation cost rounds to a router at most. The real spend is two to four weekends of attention.
The recurring cost is rhythm, not money. The affirmation renews annually, evidence should be retained for six years, and the habits that keep you compliant cost about fifteen minutes a quarter plus thirty seconds a month of logging. Cheap - unless nobody does it, in which case next year's re-affirmation is built on air.
SAM registration is free - don't pay for it. Registering in SAM.gov, the step that gets you a CAGE code and lets you submit to SPRS, costs nothing and you do it yourself. The official-looking "registration services" that email and call after you register, offering to handle it for a few hundred dollars, are selling you something the government gives away. Small businesses get caught by this every year. The registration takes patience, not payment.
The expensive path is the shortcut. Your SPRS affirmation is a legally binding statement, and misrepresented cybersecurity compliance has already produced multi-million-dollar False Claims Act settlements. Checking boxes you don't meet isn't the free option - it's the deferred-payment one.
Not sure which tier you actually need? It comes down to which gaps you have - the free 5-question check gives you an honest read in about three minutes, no email to start.
How to pick your path
If you have more time than money and genuinely enjoy federal documentation, DIY works - start with the 15 requirements in plain English. If your environment is complicated - CUI in the mix, multiple facilities, a prime audit already scheduled - pay a professional; that's what the $5,000+ tier is for. And if you're the shop in the middle - one building, a dozen people, FCI in email and a file server, no security team - the middle of the price list exists for you. That's the segment we built for: the whole Level 1 job, one afternoon of your answers, one flat price, and a gap report that tells you the truth even when the truth is "not yet."
Where does your shop stand right now?
Five yes/no questions, instant grade, no email required. Know before you're asked.
Take the free 5-question check