The organization or the contractor will have to pay for the upfront cost for compliance and certification. However, the costs required to meet CMMC compliance and certification are “allowable costs.”