Defense contractors have spent years preparing for the Cybersecurity Maturity Model Certification program. For many, the greatest concern has been cost.
But a recent investigation suggests that the industry's financial challenges are more complicated than the price of a certification assessment.
On October 26, 2026, Federal News Network reported on internal Defense Department findings arising from its review of CMMC. According to the reporting, DoD reviewed 997 responses to a request for information concerning the program's costs and implementation difficulties.
The most significant challenges identified by respondents were associated with implementing and maintaining the underlying cybersecurity controls of NIST Special Publication 800-171, rather than paying for the CMMC assessment alone.
Respondents identified recurring software licensing, specialized cybersecurity personnel, segregated computing environments, cloud services, documentation, and inconsistent interpretations of controlled unclassified information requirements as significant cost drivers.
The reporting also described an average third-party assessment cost of approximately $47,000 among a subset of respondents who provided specific cost information. That figure should not be treated as the total cost of achieving and maintaining cybersecurity compliance or as a representative estimate for every contractor.
The distinction is important because CMMC and NIST SP 800-171 serve different functions.
NIST SP 800-171 establishes security requirements for protecting certain controlled unclassified information in nonfederal information systems.
CMMC provides a framework for evaluating and verifying implementation of applicable cybersecurity requirements.
Removing or reducing an assessment requirement would not necessarily remove the underlying contractual obligation to safeguard protected Government information.
For example, DFARS 252.204-7012 imposes safeguarding and cyber-incident reporting obligations involving covered defense information and covered contractor information systems. Those obligations arise from the contract and are not automatically suspended merely because DoD revises the CMMC certification schedule.
The resulting economic issue deserves more attention.
A contractor may need to purchase secure software subscriptions, maintain a dedicated environment, implement identity and access management, protect endpoints, retain security specialists, and document compliance.
Many of those expenses will continue regardless of whether the company undergoes a formal third-party assessment in a particular year.
This suggests that contractors should maintain two distinct financial models.
The first addresses security implementation and ongoing operations: technology, systems, personnel, monitoring, documentation, and recurring maintenance.
The second addresses assessment and verification: preparatory reviews, assessor fees, evidence collection, remediation, and reassessment.
Separating these categories improves budgeting and clarifies which costs might actually change if DoD modifies CMMC requirements.
It also highlights the importance of proper CUI identification.
Overly broad or inconsistent information marking can expand the systems and workflows a contractor believes it must protect. Conversely, inadequate identification can leave legitimately protected information outside necessary safeguards.
Prime contractors and subcontractors should therefore document what protected information they receive, which systems process it, and which contractual clauses apply.
DoD's review remains a policy development, not a legal release from existing cybersecurity obligations.
The practical lesson is straightforward.
Cybersecurity certification may be an episodic expense, but protecting Government information is an ongoing operating responsibility.
Contractors should price and manage those two obligations separately.
Recommended FedContractPros Product: FedClause360
FedClause360 can help contractors identify safeguarding, cybersecurity assessment, information-handling, incident-reporting, and subcontract flowdown requirements across federal agreements.
Disclaimer:
This article is for general educational purposes only and does not constitute legal, cybersecurity, accounting, or government-contracting advice. Reported industry cost figures reflect the underlying sources and may not represent typical contractor costs. CMMC implementation requirements and applicable DFARS obligations should be verified against current agency guidance and individual contracts.