What CMMC Level 2 actually costs.

Reviewed October 6, 2026: the planned November 10, 2026 Phase II expansion is suspended. Phase I self-assessment requirements and DFARS safeguarding duties remain. Check your solicitation, contract, and amendments before choosing an assessment path. Sources: official CMMC status and implementation memorandum.

By inDirectIT, Inc. · Planning guidance from our engineering practice.

Stop pricing a product. Start pricing a boundary.

Ask five vendors what CMMC Level 2 costs and you'll get five numbers, because most of them are quoting a product. But NIST 800-171 doesn't care what you bought — it cares what's inside your CUI boundary, how long it takes to make that boundary compliant, and whether you can prove it with evidence an assessor will accept. That's why two companies with identical headcount can have wildly different bills. We covered the short version in our cost breakdown post; this guide expands it into a full planning framework.

The cost stack

Here are the line items in the order they actually hit, with the figures we publish. Sequence matters more than the individual prices — every dollar spent on discovery shrinks every line below it.

Line item	Typical figure	When it hits
Teramis Regulated Data Discovery — find where CUI actually lives, then shrink the boundary	from $4,500/yr (under 100 employees)	First. Delivery and boundary are confirmed during scoping.
Policy & Evidence Accelerator — SSP, policies, and the evidence library assessors expect	$7.5K–25K one-time	After scoping. ~2 weeks.
GCC High Migration + DFARS 7012 Enablement — only if your contracts require it	$25K + $250/user	Remediation phase. ~6 weeks.
CMMC Factory Baseline — full GCC High enclave build	scoped per environment	Remediation phase. ~12 weeks.
Managed Compliance Support (vCISO) — keep the program alive between assessments	from $2.5K/mo	Ongoing, once the boundary is set.
Managed Compliant IT Support — day-to-day IT operated inside the boundary	from $3K/mo	Ongoing.
Third-party C3PAO assessment	obtain a scoped C3PAO quote	Budget separately if third-party certification is needed; the Phase II transition is suspended.

If you're not sure which of these you need, a gap assessment is the cheapest way to find out before you commit to any of them.

What actually drives your number

Company size is a lazy proxy. The variables that actually move the bill are:

• Seats inside the boundary. Every per-user cost — licensing, migration, support — scales with who touches CUI, not who's on payroll.
• Systems in scope. Each server, SaaS app, and file share inside the boundary is a system you must control, monitor, and document.
• CUI sprawl and data maturity. CUI scattered across inboxes and personal drives means a bigger boundary and a longer evidence trail.
• Existing Microsoft licensing. What you already own determines how much of the technical stack is a configuration exercise versus a purchase.
• Whether you need GCC High at all. The single biggest fork in the budget — and it's a contracts question, not an IT preference.

Scope affects the cost model. Discovery identifies the systems, users, data flows, and security dependencies that need protection. Consolidation may reduce licensing and implementation work, but the percentage and savings are engagement-specific. See our scope reduction guide.

Hidden and ongoing costs

The budget killers are rarely the line items above. They're the ones nobody writes down:

• Dual-running during migration. While you move to a compliant environment, you're paying for two — plan for the overlap, not just the destination.
• Evidence upkeep. Screenshots age, policies drift, personnel change. Evidence is a subscription you pay in staff hours, whether or not you budget it.
• Annual affirmations and continuous monitoring. Your SPRS score is a standing legal representation. Keeping it true is an operating cost, not a one-time project.
• The POA&M closeout sprint. Conditional certification requires a minimum score of 88 (0.8×110), only 1-point items on the POA&M, and a hard 180-day closeout. Miss it and you're re-assessing. The POA&M rules post covers what qualifies.
• Plan against confirmed requirements. Keep safeguarding and required self-assessments current. Confirm amendments, modifications, customer expectations, and assessment lead times before committing to third-party certification. See the current-status playbook.

The sequencing that controls cost

Order of operations is the cheapest optimization available. Done right, it looks like this:

• Scope first. Run discovery before buying anything. A verified boundary gives you a defensible basis for licensing and implementation decisions.
• Assess honestly. Score all 110 controls against the boundary you actually have. Remember: no SSP, no score — the SSP gates the entire SPRS submission.
• Remediate by point weight. SPRS weights controls 5, 3, or 1. Close the 5-pointers first; they move the score fastest per dollar.
• Operate. Shift to managed compliance so the evidence stays current and the affirmation stays true.

Model it yourself

You don't have to take our word for any of this. The free CMMC Calculator's Scenario Builder shows these exact packages with live pricing and a time-to-SPRS timeline — pick the pieces you need, drop the ones you don't, and walk into any budget conversation with a number you can defend.

Turn the budget into an implementation plan.

Use the CMMC gap assessment to connect your planned spend to specific implementation gaps. For a completed example, read how inDirectIT prepared its own assessed environment.