More than three in five defense contractors in our survey budgeted under $50,000 for CMMC, less than half the government’s estimated certification cost. The Department of War has since suspended Phase II requirements, citing cost and burden on small business.
Executive Summary
We recently surveyed more than 700 defense industry professionals at the PreVeil CMMC Summit about where their compliance work actually stood. We asked how far along they were, what they had budgeted, and who they planned to have do the work. It was the second consecutive year we asked the same questions, enabling year-over-year comparisons.
The results reveal a market where most SMBs have yet to achieve certification, have underbudgeted for the process, and are increasingly turning to do-it-yourself (DIY) approaches to close the gap.
On July 13, 2026, the Department of War suspended CMMC Phase II requirements. Among the reasons the Department gave were a need to lower costs and barriers for small businesses. Our data was collected before that announcement. It is a record of the cost pressure the Department later cited.
Key Findings:
- A third of the market had not begun their compliance journey, and that share grew. 34% of respondents were still “just getting started” up from 30% the prior year.
- Budgets fell while the cost of certification held. The share of contractors budgeting under $50,000 grew from 49% to 62% in one year, even though the DoW estimates achieving CMMC Level 2 will cost twice that amount.*
- Priced out of the services market, contractors absorbed the work themselves. DIY rose from 46% to 55%. Managed service provider engagement fell from 26% to 18%. 77% intended to handle documentation work internally.
*Cybersecurity Maturity Model Certification (CMMC) Program, 89 FR 83092 (Oct. 15, 2024): “It is estimated that the cost to support a Level 2 certification assessment and affirmation for a small entity is $101,752.”
Finding 1
A third of the DIB is at the earliest stage of their compliance journey, and that share grew year over year.
Where are you in your CMMC compliance journey?
2025 figures rounded to the nearest whole number and sum to 101%.
The share of contractors at the earliest stage grew rather than shrank, from 30% to 34%. New entrants are still arriving faster than existing ones are finishing, which is not what a maturing compliance market looks like.
At the other end, progress stayed thin. Only 18% had completed a self-attestation and 9% had completed all documentation, despite CMMC requirements appearing in contract language for years. A contractor who has not finished the work is not behind the pack; they are the pack.
Finding 2
Contractor budgets fell while the cost of certification did not.
How much have you budgeted for CMMC compliance?
The share of contractors budgeting under $50,000 grew from 49% to 62% in one year, even though the DoW estimates achieving CMMC Level 2 will cost twice that amount. We believe this is compositional: smaller companies are entering the market later and bringing smaller budgets.
The DoW estimate for achieving Level 2 certification as a small entity is $101,752. Against that figure, 83% of respondents budgeted below $100,000.
We call this distance the affordability gap: the difference between what contractors have set aside and what the government’s own analysis says the work costs. It is the single measured quantity that best explains the state of the market, and it widened over the year we observed.
Finding 3
Priced out of the traditional services market, contractors moved compliance work internally.
How do you plan to approach CMMC compliance?
How do you plan to approach CMMC documentation? (2025)
A stated plan to handle documentation internally is not the same as completing it internally — this survey captures intent, not outcome.
These numbers suggest that contractors did not stop buying help entirely, instead they cut back on MSP investment due to the recurring costs. When budgets are tight, SMBs will attempt the DIY route. But CMMC documentation is the component of the compliance journey with the least tolerance for a wrong answer.
Working from pre-filled, C3PAO-validated templates and structured tooling (the approach 34% of respondents chose) is a fundamentally different exercise than writing an SSP and supporting artifacts from a blank page, which 43% intend to do.
Using pre-filled, assessment-ready documentation can save contractors hundreds of hours (if internal) or tens of thousands of dollars (if outsourced).
Note: A stated plan to handle compliance internally is not the same as completing it internally. This survey captures intent, not outcome.
Where PreVeil Fits
More than 3,000 small and mid-sized defense contractors protect CUI and ITAR technical data in PreVeil today (to our knowledge the largest such footprint of any provider). More than 100 of them have already achieved CMMC Level 2 certification.
We offer end-to-end encrypted file storage, file sharing, and email, which are all resilient against AI-era attacks. Our platform holds FedRAMP Moderate Equivalent status for storing and processing CUI in the cloud, FIPS 140-3 validated encryption, and support for DFARS 252.204-7012 requirements.
PreVeil’s Compliance Accelerator provides C3PAO-validated baseline documentation like a System Security Plan, standard operating procedures, worksheets, network diagrams, and assessment checklists, along with implementation guidance.
No single platform makes an organization compliant. But PreVeil can help close the Affordability Gap by covering the necessary technology and documentation for under $10,000 a year.
Methodology
This benchmark study draws from survey data collected at PreVeil’s 2024 and 2025 CMMC Summits. Data was collected through live polling during Summit sessions.
This report is educational and is not legal advice. For guidance on specific contracts and compliance exposure, consult an attorney.
