What Does It Actually Cost a C3PAO to Add Assessor Capacity?
The salary is the number everyone prices, and rarely the one that decides it. What an assessor seat costs per assessment it staffs, the months before it staffs any, and the costs that stay with the C3PAO however it adds capacity.
Ask a C3PAO what another assessor would cost and the answer is usually a salary. It's the right place to start and the wrong place to stop. Two other numbers decide whether added capacity pays for itself: how many assessments the new seat actually staffs, and the costs the CMMC rules attach to every person who works on an assessment, whoever employs them.
The short answer, at a public benchmark: a full-time seat runs about $184,500 a year in pay and benefits. That's roughly $15,400 to $61,500 per assessment, depending on whether it staffs 12 assessments a year or 3, plus costs the rules keep with the C3PAO however it adds the seat.
Start with the seat, not the salary
There's no published salary series for CMMC assessors. The closest federal benchmark is information security analysts, whose median annual wage was $129,180 in May 2025 (BLS). On top of pay, benefits, including legally required ones such as the employer's share of Social Security and Medicare, made up 30.0 percent of private-industry employers' compensation costs in June 2026 (BLS). Put the two together and a seat paid at the analyst median costs about $184,500 a year.
That's a benchmark, not a quote. An experienced CCA isn't a median analyst, and your market sets the real figure. The useful part is what happens when you divide it.
- 3 a year$61,500
- 6 a year$30,800
- 9 a year$20,500
- 12 a year$15,400
Pay and benefits per assessment staffed. Seat-year of about $184,500: the BLS median for information security analysts (May 2025) with benefits at 30% of compensation (June 2026). Leaves out quality reviews, travel and everything in the ledger below.
A hire is a fixed cost, spread over however much work arrives. A contract assessor or a borrowed one is a cost you incur only when there's an assessment to staff. So which is cheaper depends almost entirely on the bottom of that fraction, and this year it's hard to forecast. With Phase 2 suspended, new contracts can require only self-assessments (what the suspension changed), even though Level 2 certificates kept climbing through September (the numbers).
The months before the first assessment
A new hire costs money before they cost anything per assessment. We covered why they can't start on day one: your IT, your process, and a Tier 3 background check for anyone who doesn't have one yet. At the benchmark, each of those months is about $15,400 of pay and benefits with no assessment to spread it over.
The longest wait is the Tier 3. The CMMC program sponsors the investigation, but the Cyber AB told its August 2026 Town Hall that DCSA's process "takes exceedingly long to adjudicate" (what the background check involves). If you're growing someone into a CCA rather than hiring one, add the credential path too. ISACA's published fees for the CCP and the CCA come to about US$1,770 before any training, unless the courses include the exam vouchers (the fee breakdown).
Who carries which cost
Some of a seat's cost moves depending on how you add the seat. Some never leaves the C3PAO.
- IT and accounts for every assessor
§ 170.11(b)(7) - The conflict decision, assessor by assessor and client by client
CAP 1.14 - Onboarding to your method, and six years of records
CoPC 2.7(b) · § 170.9(b)(9) - A QA reviewer who isn’t on the team
§ 170.9(b)(13)
The bottom band is what gets missed when a contract rate is compared with a salary. Contracting or borrowing takes the top rows off your books, but never the bottom ones. Every assessor needs your devices and accounts, because assessors may use only IT "provided by the authorized/accredited C3PAO" (32 CFR § 170.11(b)(7)). Every assessor needs a conflict check against every client, and that check "cannot be delegated" (CAP v2.0, 1.14). Every assessment needs a QA reviewer who isn't on its team. How those obligations play out with contractors specifically is in 1099 CMMC assessor contract work.
The Lead seat is priced in years
If the seat you're short is a Lead, money is the smaller part of the cost. The Lead designation takes "at least 5 years of cybersecurity experience, 5 years of management experience, 3 years of assessment or audit experience," plus an Advanced-level qualification (§ 170.11(b)(10)). No budget turns a new CCA into a Lead sooner (the full path).
So a Lead seat can only be bought from the pool that already exists: 681 Lead CCAs nationally as of September 2026, nearly six for every C3PAO. That pool is shared with every other C3PAO trying to grow, which is why the Lead is usually the seat that runs out first.
Pricing it for your firm
Before comparing a salary with a contract rate, put both on the same footing, one seat at a time:
Then price the other side: the assessment you turn away. We don't publish assessment prices, and yours are yours, but an OSC you can't fit in may book that assessment, and the one three years later, somewhere else.
If you can name the assessments, a hire usually earns its salary. If you can only name the busy weeks, pay for the weeks.
Sources: U.S. Bureau of Labor Statistics, Occupational Outlook Handbook, Information Security Analysts (median annual wage, May 2025) and Employer Costs for Employee Compensation, June 2026 (released September 9, 2026); 32 CFR Part 170, §§ 170.9(b)(9) and (13), 170.11(b)(7) and (10); CMMC Assessment Process v2.0, 1.14; Cyber AB Code of Professional Conduct v2.0, § 2.7(b); Cyber AB Town Hall decks, August and September 2026; ISACA CMMC fee schedule, October 2026. Dollar figures are illustrative arithmetic on public benchmarks, not 1st Defense prices or a market rate for assessors.