CMMC Compliance Costs: Allowable Expenses, FAR Recovery & Contract Accounting

Defense contractors treating CMMC compliance as a pure cost center are leaving recoverable money on the table. The Federal Acquisition Regulation establishes a framework for recovering allowable business costs through government contracts — and CMMC compliance costs, properly structured and documented, fit squarely within that framework for most cost-type and time-and-materials contractors.

This article is written for finance directors, contracts managers, and CFOs who need to understand not just what CMMC costs, but how to account for it, recover it, and quote it. For a breakdown of what CMMC Level 2 actually costs in total, see the companion article: How Much Does CMMC Level 2 Compliance Cost?

FAR allowability: are CMMC costs recoverable?

Under the Federal Acquisition Regulation, costs incurred by a contractor are allowable if they meet four criteria: they are reasonable, they are allocable to the contract, they conform to generally accepted accounting principles, and they are not specifically unallowable under FAR Part 31.

CMMC compliance costs generally satisfy all four criteria. The DoD itself acknowledged the allowability of these costs in the rulemaking record for the CMMC program, noting that cybersecurity compliance costs meeting FAR 31.201-2 criteria are allowable as ordinary costs of doing business with the government.

The reasonableness test

FAR 31.201-3 defines a reasonable cost as one that a prudent person would incur in similar circumstances. Given that CMMC Level 2 certification is a mandatory contract eligibility requirement — you cannot bid on covered contracts without it — the investment required to achieve and maintain certification is inherently reasonable. The reasonableness of specific costs (consultant rates, tool purchases, internal labor) is evaluated against market rates. Rates materially above market require justification.

The allocability test

FAR 31.201-4 requires that a cost be allocable — meaning it benefits the contract(s) to which it is charged, or is necessary to the overall operation of the business. CMMC compliance costs are allocable in two ways: they directly enable performance on CUI contracts (direct cost argument), or they are general and administrative costs of maintaining a defense contractor business (indirect cost argument). Which treatment applies depends on how your cost accounting system is structured and your specific circumstances — more on this below.

Specifically unallowable costs to watch for

Most CMMC compliance costs are allowable, but several categories require attention:

Direct vs. indirect cost treatment

How CMMC compliance costs are classified — direct or indirect — has significant implications for recovery, rate calculations, and contract pricing. The correct treatment depends on your cost accounting practices, your contract portfolio, and the nature of the specific cost.

When CMMC costs are direct

A cost is direct when it can be specifically identified with a particular contract or final cost objective. For contractors where all work is covered by CMMC requirements — where every contract involves CUI — direct charging is technically supportable but practically unusual. More commonly, specific compliance activities that are clearly tied to a single contract's performance may be charged directly: for example, a gap assessment conducted specifically to respond to a new contract requirement, or a system upgrade required to bring a specific program's network into compliance.

The risk of direct charging CMMC costs: if the same compliance infrastructure benefits multiple contracts (which it almost always does), charging it directly to one contract creates an inconsistency problem and potential audit exposure. DCAA auditors will scrutinize direct charges for costs that appear to benefit the business as a whole.

When CMMC costs are indirect

For most defense contractors, CMMC compliance costs are most appropriately treated as indirect costs — specifically as General and Administrative (G&A) expenses. This is the treatment the DoD's own cost modeling assumes, and it reflects the reality that CMMC certification benefits the entire business by maintaining its eligibility to compete for and perform on DoD contracts.

Indirect treatment means CMMC costs flow into your G&A pool, are allocated across your cost base, and are recovered through your G&A rate on all applicable contracts. This is simpler to administer, consistent with how most contractors treat similar business infrastructure costs, and reduces audit risk compared to direct charging.

Overhead vs. G&A

Some contractors maintain both overhead pools and G&A pools. CMMC costs that relate specifically to the operation and security of production facilities or program-specific networks might appropriately reside in overhead. Costs that benefit the entire business — the compliance platform subscription, the C3PAO assessment fee, the compliance manager's salary — belong in G&A. Inconsistent treatment across cost pools will draw DCAA scrutiny; document your rationale and apply it consistently.

Impact on indirect rates

When CMMC compliance costs flow into your G&A pool, they increase your G&A rate — which affects every cost-type and T&M contract where you recover G&A. Understanding the magnitude of that impact, and how to communicate it to customers, matters for contract relationships and re-negotiations.

Estimating the rate impact

The calculation is straightforward: if your annual CMMC-related G&A costs are $80,000 and your G&A allocation base (typically total cost input or total direct labor) is $4,000,000, the CMMC contribution to your G&A rate is 2.0%. For a contract where you're billing $500,000 in direct costs, that represents $10,000 in additional G&A recovery annually.

For contractors whose CMMC investment is primarily a one-time implementation cost rather than recurring, the rate impact is front-loaded. A $200,000 implementation cost expensed in year one creates a significant rate spike in the implementation year, followed by lower ongoing costs in subsequent years. Some contractors choose to amortize large one-time compliance investments over multiple years to smooth the rate impact — this is acceptable if consistent with your accounting practices and disclosed to your cognizant auditor.

DCAA and forward pricing rate agreements

If your organization has a Forward Pricing Rate Agreement (FPRA) or Forward Pricing Rate Recommendation (FPRR) with DCAA, significant changes to your indirect cost pools — including the addition of substantial CMMC compliance costs — should be disclosed to your cognizant ACO and DCAA auditor. Failure to update forward pricing rates to reflect known cost changes can create problems during incurred cost audits and contract close-out.

Proactively disclosing CMMC cost additions and their rationale puts you in a stronger position than having DCAA discover the rate impact during an audit. The underlying costs are allowable — the documentation and disclosure process is what protects them.

Forward pricing and proposal quoting

For contractors submitting cost proposals on new work, CMMC compliance costs need to appear somewhere in the bid — either embedded in indirect rates, included as a direct cost line item, or explicitly addressed in the cost narrative. How you handle this affects both your recovery and your competitive position.

Including CMMC in indirect rates

The cleanest approach for most contractors: CMMC costs are included in G&A, your forward pricing rates reflect their inclusion, and you apply those rates to your proposals normally. The customer sees the G&A rate, not the individual cost components. You recover the cost across your government business without needing to justify it line-by-line in every proposal.

This approach works well for recurring CMMC costs — annual platform subscriptions, ongoing compliance labor, C3PAO surveillance costs. It's less clean for large one-time implementation costs that would cause a one-year rate spike.

Direct cost line items in proposals

For specific contracts where CMMC compliance is explicitly required in the PWS or SOW, including compliance costs as a direct line item in the proposal is both appropriate and defensible. This is particularly relevant when a new contract requires you to implement controls or tools you don't currently have — the incremental compliance investment is clearly attributable to that work.

When quoting CMMC costs as direct, be specific: tool name, licensing cost, implementation labor hours at loaded rate, and ongoing maintenance. Vague "cybersecurity compliance" line items invite challenge. Specific, documented costs with market rate support hold up to scrutiny.

The equitable adjustment route

For contracts that predate the CMMC rule and where CMMC requirements represent a change in the regulatory environment affecting contract performance costs, contractors may have grounds for a Request for Equitable Adjustment (REA). The argument: CMMC is a new government-imposed regulatory requirement not contemplated at contract formation, creating increased costs of performance recoverable under FAR 52.243-1 or similar clauses.

The REA route is more complex and contested than forward pricing inclusion, and success depends heavily on contract terms, the specific regulatory change timeline relative to contract award, and your contracting officer's disposition. It's worth exploring with contracts counsel for large, long-duration cost-type contracts where the CMMC investment is material. Don't rely on it as your primary recovery mechanism.

Fixed-price contracts

On firm-fixed-price contracts, cost recovery works differently — you don't bill indirect rates, you recover all costs through the contract price. For new FFP proposals, CMMC costs should be included in your price buildup as part of your overhead and G&A load. For existing FFP contracts, recovery through price adjustment is generally not available absent a changes clause trigger. This is one reason CMMC timing matters for FFP contractors: beginning certification before a major FFP re-compete allows you to include the cost in the new bid price.

Accounting treatment by cost category

Different CMMC cost types have different accounting treatments. Understanding the correct treatment for each category prevents audit findings and ensures maximum recovery.

Federal tax treatment

CMMC compliance costs are generally deductible as ordinary and necessary business expenses under IRC Section 162. For defense contractors, these costs satisfy the "ordinary and necessary" test because they are required for maintaining eligibility to do business in your industry.

Expensing vs. depreciation

The distinction between expensing in the current period and capitalizing for depreciation applies for tax purposes as it does for contract accounting. Most consulting fees, software subscriptions, and service costs are fully deductible in the year incurred. Hardware and long-lived assets are depreciated — though Section 179 of the Internal Revenue Code allows immediate expensing of qualifying business property up to $1,160,000 (2023 limit, indexed for inflation), which covers most CMMC hardware purchases for small and mid-size contractors.

Bonus depreciation under IRC Section 168(k) has been phasing down — it was 100% through 2022, dropped to 60% in 2024, and continues to phase down under current law. For significant hardware purchases, the available bonus depreciation percentage in the year of acquisition affects your tax position. Consult your tax advisor on the current applicable rate.

Section 179 and compliance hardware

An on-premises compliance appliance, upgraded servers for a SIEM deployment, or network equipment purchased to support CUI segmentation are all likely eligible for Section 179 expensing. For a small contractor purchasing $150,000 in compliance hardware, immediate expensing versus five-year depreciation is a meaningful cash flow difference. Ensure the asset is placed in service in the tax year you intend to claim the deduction.

R&D tax credits

CMMC compliance activities do not typically qualify for the Research and Development tax credit under IRC Section 41. The R&D credit applies to qualified research activities involving the development of new or improved products or processes through technological experimentation — implementing known security controls to meet a regulatory standard generally does not meet this threshold. Do not conflate CMMC compliance with qualifying R&D activity.

Cost segregation for facility improvements

If your CMMC program includes physical security improvements — access control systems, security cameras, or SCIF-related construction — cost segregation analysis may be worth conducting. Physical security components can often be classified as personal property or land improvements rather than building structure, enabling faster depreciation schedules. For significant facility investments, the tax savings from cost segregation can be material.

Building a recovery strategy

The contractors who recover the most CMMC cost are those who plan the accounting treatment before incurring the costs, not those who reverse-engineer it during close-out. A recovery strategy has three components: documentation before spending, correct cost pool assignment, and rate communication to customers.

Step 1: Establish a CMMC cost tracking structure before you start spending

Set up a dedicated project code or cost element in your accounting system for CMMC compliance costs before any consulting engagements begin. This allows you to capture all CMMC-related costs in one place, produce a complete cost record if DCAA requests it, and calculate the total investment accurately for forward pricing purposes. Retroactively identifying and segregating CMMC costs from general IT spending is difficult and creates documentation gaps.

Step 2: Timecharg all internal labor correctly from day one

Every hour your ISSO, IT director, contracts manager, or any other employee spends on CMMC compliance activities must be timecharged to your CMMC project code. This is the labor cost that most contractors fail to capture — they track consulting invoices but not internal staff time. An ISSO spending 40% of their time on CMMC preparation represents a significant labor cost that is fully recoverable if properly timecharged and not if it's buried in a general overhead labor category with no audit trail.

Step 3: Document the regulatory requirement for each cost

For each significant cost element, maintain documentation linking the expenditure to the regulatory requirement it satisfies. A SIEM purchase tied to AU domain requirements, a FedRAMP Moderate cloud migration tied to CUI handling requirements, a C3PAO assessment fee tied to DFARS 252.204-7021 — each link is a defense against allowability challenges. The FAR allowability analysis is straightforward when the regulatory driver is clear; it becomes contested when costs look like general IT spending that might have happened anyway.

Step 4: Communicate rate impacts proactively

If your G&A rate is increasing materially due to CMMC investment, notify your contracting officers and PCOs before the rate increase affects billing. A brief memo explaining the regulatory driver and expected duration of the elevated rate is far better received than a rate spike that appears without explanation during an incurred cost audit. Most COs understand that CMMC is a government-imposed cost and will not object to reasonable recovery — what they object to is surprises.

Step 5: Revisit recovery at each major compliance milestone

CMMC compliance has distinct phases — gap assessment, remediation, C3PAO assessment, ongoing maintenance — each with different cost profiles. Review your rate and recovery position at each transition. The high-cost implementation phase should not distort your forward pricing rates indefinitely; update your projections as ongoing costs normalize post-certification.

Documentation requirements for cost recovery

DCAA's primary concern when auditing compliance-related costs is whether the costs are what the contractor says they are and whether they benefit the contracts they're charged to. The documentation that protects CMMC costs in an audit is the same documentation that makes a well-run compliance program — which means there's no incremental burden if the compliance program is properly managed.

What DCAA will look for

• *Timekeeping records supporting internal labor charges — hours, dates, employee names, and cost element codes
• *Invoices and contracts for consulting engagements — scope of work, deliverables, and payment terms
• *Software and tool agreements — subscription terms, user counts, and purpose documentation
• *Hardware purchase documentation and asset records — purchase price, placed-in-service date, and depreciation schedule
• *Regulatory nexus documentation — the specific DFARS clause or CMMC requirement each cost satisfies
• *Market rate comparisons for significant consulting engagements — evidence that rates are reasonable
• *Cost pool assignment rationale — documentation explaining why costs were assigned to G&A vs. overhead vs. direct

The compliance platform as documentation infrastructure

An air-gapped compliance platform like 1TEN generates much of the documentation DCAA would look for incidentally to its core function — the Activity Log produces a timestamped record of compliance activities, the POA&M tracker documents remediation work and milestone completion, and the SSP export produces a dated record of your compliance posture at assessment time. This documentation has dual value: it supports your CMMC assessment and it supports your cost recovery position. Organizations using spreadsheet-based programs produce neither efficiently.

Recovering CMMC costs in the current year — not next year

The standard G&A rate mechanism recovers costs in the year after they're incurred — you build your forward pricing rates based on prior-year actuals, submit them for the coming year, and recover the CMMC investment twelve to twenty-four months after you spent it. For a $200,000 compliance investment hitting your books this fiscal year, that lag is a real cash flow problem, not a theoretical one.

Three mechanisms allow recovery in the current period rather than the following year. Which one is available to you depends on your contract type, your relationship with your ACO, and how your accounting system is structured.

Mechanism 1: Provisional billing rate adjustment

For contractors billing under provisional indirect rates — which applies to most cost-type and T&M contractors pending final rate negotiations — a mid-year provisional rate revision is the cleanest and most direct recovery tool available.

The process: you submit a revised Forward Pricing Rate Proposal to your Administrative Contracting Officer (ACO) reflecting the CMMC costs now in your G&A pool. Your cognizant DCAA auditor reviews the submission and issues a revised rate recommendation. Your ACO approves new provisional billing rates. You begin billing at the higher rate immediately, recovering the CMMC cost across all applicable contracts in the current period rather than waiting for the annual rate cycle.

The key to making this work is framing. Your rate revision submission should explicitly identify CMMC compliance as the driver, cite the specific regulatory requirements (DFARS 252.204-7021, 32 CFR Part 170), document the costs with invoices and timekeeping records, and project the duration — distinguishing one-time implementation costs from ongoing recurring costs. A well-documented submission reduces DCAA review time and reduces the probability of a challenge to allowability.

Timing matters: submit your revised rates before the costs are fully incurred, not after. A provisional rate revision request accompanied by cost projections and a regulatory explanation is received differently than one submitted after the fact to explain a rate spike that's already appeared in billings.

Mechanism 2: Bilateral modification on existing cost-type contracts

For contractors with active cost-type contracts, a bilateral modification to update the contract's provisional rate ceiling or to add a contract line item for CMMC compliance costs can accelerate recovery on that specific contract. This requires your PCO's agreement and is more likely on larger programs where the contracting officer has flexibility and recognizes the regulatory driver.

The argument that moves PCOs: CMMC is a government-imposed requirement that did not exist when the contract was awarded, and its costs are directly attributable to maintaining the security posture required to perform the work. This is the same argument structure as an equitable adjustment — the government changed the rules mid-contract, creating additional costs of performance. Frame it that way, not as a general cost increase request.

The bilateral mod route is contract-by-contract and requires more negotiation than a provisional rate revision. It's most useful when you have one or two large cost-type contracts that dominate your revenue base, making a targeted contract-level adjustment more practical than a portfolio-wide rate revision.

Mechanism 3: Direct cost charging on eligible contracts

Where CMMC compliance work is explicitly called for in a contract's Performance Work Statement or Statement of Work — or where you can make a defensible case that the work is contract-specific — direct charging allows immediate recovery without waiting for rate cycles. You invoice the cost directly against the contract in the period incurred.

The constraint: the cost must genuinely benefit the specific contract it's charged to more than it benefits the business as a whole. Because CMMC certification covers your entire government business, this argument is difficult for general compliance infrastructure. It is more supportable for specific remediation work triggered by a new contract requirement — a system upgrade required to bring a new program's network into compliance, or a gap assessment conducted specifically to respond to a new solicitation.

Direct charging a cost that appropriately belongs in G&A creates an audit exposure under FAR 31.201-4. If DCAA determines the cost benefits multiple contracts, the direct charge will be disallowed on the contract where it was charged — potentially requiring repayment plus interest. Only use direct charging where the contract nexus is genuinely defensible, not as a rate-avoidance mechanism.

The ACO conversation: have it before you spend

The single highest-leverage action available to a contractor facing a significant CMMC investment is a proactive conversation with their ACO before costs are incurred. Not a formal submission — a conversation. Explain that you are undertaking CMMC compliance in response to a mandatory regulatory requirement, that you anticipate material costs in the current fiscal year, and that you intend to submit a revised provisional rate proposal. Ask whether the ACO has any concerns or preferences about how you structure the submission.

This conversation accomplishes three things: it creates a paper trail establishing that your CMMC investment was disclosed proactively rather than discovered during an audit; it gives the ACO advance notice that a rate revision is coming, reducing processing time; and it surfaces any contract-specific concerns before they become disputes. ACOs who are informed in advance are dramatically more cooperative than ACOs who discover an unexplained rate spike during close-out review.

What FFP contractors can do

Firm-fixed-price contractors have no mid-contract cost recovery mechanism. The CMMC investment is absorbed in the year incurred and recovered only through future contract pricing. The practical implications:

• *Time major CMMC expenditures to align with re-compete cycles where possible — incurring costs immediately before a re-compete allows you to include them in the new bid price
• *Include CMMC cost projections in all new FFP proposals — the investment is a cost of doing business and should be in your price buildup
• *Explore whether any of your FFP contracts contain changes clauses (FAR 52.243-1) that could support an equitable adjustment for the regulatory change — this is a long shot but worth reviewing with contracts counsel on large, long-duration contracts
• *Use Section 179 to accelerate the tax deduction for hardware purchases into the year of acquisition, partially offsetting the cash flow impact

Frequently asked questions

Are CMMC compliance costs allowable under government contracts?

Yes, for most cost types. CMMC compliance costs meet the FAR 31.201-2 criteria for allowability — they are reasonable (required for contract eligibility), allocable (benefit government contracts), consistent with GAAP, and not specifically unallowable under FAR Part 31. Fines, penalties, and FCA defense costs are unallowable; the underlying compliance investment is not.

Should CMMC costs be direct or indirect?

For most contractors, indirect — specifically G&A. CMMC certification benefits your entire government contracting business, making it a general and administrative cost rather than a cost specific to any one contract. Direct charging is appropriate only where you can make a genuine, auditable case that the cost specifically benefits a single contract more than it benefits the business as a whole. Incorrect direct charging creates audit exposure and potential repayment obligations.

How do I recover CMMC costs this year instead of waiting for next year's rates?

The primary mechanism is a mid-year provisional billing rate revision. Submit a revised Forward Pricing Rate Proposal to your ACO reflecting CMMC costs in your current G&A pool, with documentation of the regulatory driver. DCAA reviews it, your ACO approves revised provisional rates, and you begin billing at the updated rate immediately. On specific cost-type contracts, a bilateral modification is an alternative. Have the ACO conversation before costs are incurred — proactive disclosure accelerates the process and reduces audit risk.

What documentation does DCAA require for CMMC cost recovery?

Timekeeping records for all internal labor charged to CMMC activities, invoices and statements of work for consulting engagements, software and tool agreements, asset purchase records with placed-in-service dates, and documentation linking each cost to the specific regulatory requirement it satisfies. A compliance platform's activity log and milestone records provide much of this documentation incidentally — which is one reason automated compliance infrastructure reduces audit exposure compared to spreadsheet-based programs.

Can I recover CMMC costs on firm-fixed-price contracts?

Not mid-contract. FFP contracts recover all costs through the contract price — there is no mechanism to pass through cost increases once the price is set. Your options are forward-pricing CMMC costs into new FFP proposals, exploring whether a changes clause supports an equitable adjustment on long-duration contracts, and using Section 179 to accelerate hardware deductions for tax purposes. The core strategy for FFP contractors is timing: align major CMMC expenditures with re-compete cycles so the investment can be priced into the next contract.

Is CMMC compliance cost tax-deductible?

Yes. CMMC compliance costs are deductible as ordinary and necessary business expenses under IRC Section 162. Consulting fees, software subscriptions, and service costs are fully deductible in the year incurred. Hardware is depreciated over its useful life, though Section 179 allows immediate expensing of qualifying property up to the annual limit. The tax deduction is separate from — and in addition to — contract cost recovery through indirect rates.

What happens if I don't disclose CMMC costs to my ACO?

The costs may still be recoverable through your annual incurred cost submission and rate negotiation, but without proactive disclosure you lose the ability to recover them in the current period, risk a rate spike that requires explanation at close-out, and miss the opportunity to frame the costs favorably before an auditor reviews them. There is no regulatory obligation to proactively disclose G&A cost changes mid-year — but the practical cost of not doing so is delayed recovery and a more adversarial audit interaction than necessary.

Can I amortize a large one-time CMMC implementation cost over multiple years?

Yes, if consistent with your accounting practices and disclosed to your cognizant auditor. Amortizing a significant one-time implementation cost over two or three years smooths the rate impact and avoids a spike year that triggers DCAA scrutiny. The amortization period and method must be reasonable, consistently applied, and documented in your accounting policies. Do not adopt amortization treatment for CMMC costs without confirming it is consistent with how you treat similar costs elsewhere in your accounting system.