What CMMC Level 2 really costs, and where the money actually goes.

Reviewed October 6, 2026: the planned November 10, 2026 Phase II expansion is suspended. Phase I self-assessment requirements and DFARS safeguarding duties remain. Check your solicitation, contract, and amendments before choosing an assessment path. Sources: official CMMC status and implementation memorandum.

The cost stack, line by line

A realistic Level 2 budget has five layers, and they come in order. First is CUI discovery and scope reduction: our Teramis-driven discovery runs from $4,500/yr for organizations under 100 employees. Second is documentation. The Policy & Evidence Accelerator costs $7.5K to $25K one-time, depending on how much already exists. Third is ongoing operations, with Managed Compliance Support from $2.5K/mo, or Managed Compliant IT from $3K/mo if you also want the IT stack run compliantly. Fourth, if your contracts push you to GCC High, the Migration + DFARS 7012 package is $25K + $250/user.

Fifth is a C3PAO assessment, if you pursue third-party certification for a confirmed requirement or business objective. Obtain a scoped quote directly from an authorized assessment organization. Treat its fees and scheduling separately from readiness services; the suspended Phase II transition is not a fixed November 2026 certification deadline.

Scope is the biggest cost lever

Cost depends on boundary size and complexity, existing controls, evidence quality, and delivery requirements. Discovery identifies what needs protection and which security dependencies remain in scope. A smaller enclave can reduce some costs, but it does not remove applicable security requirements or automatically improve an SPRS score.

The most common way to waste money is buying tools before scoping. A security platform licensed for 200 users protects a boundary you haven't drawn yet, and when discovery puts the enclave at 60 users, the surplus seats don't come back. The CUI Scope Reduction Field Guide lays out the method.

Spend in this order

• Start with scope. Find where CUI actually lives and shrink the boundary before you price anything else.
• Then assess the gap by scoring the boundary you actually have against all 110 requirements (see our gap assessment).
• Remediate by point impact, closing the 5-point gaps before the 1-pointers. The order matters more than the effort.
• Move into managed support so evidence stays current instead of decaying until the next fire drill.

In this order, each step is priced from the output of the one before it: the gap assessment scores a boundary that discovery already shrank, remediation targets the gaps the assessment ranked, and managed support operates only the systems that survived scoping. Run the steps out of order and each one is priced from a guess, which is how the terrifying quotes get built.

The costs that never stop

Spending continues after certification. Annual affirmations, evidence upkeep, and continuous monitoring go on after the assessor leaves, and that ongoing work is what the monthly managed-support figures above pay for. Budgeting Level 2 as a one-time project is how companies end up compliant for exactly one audit cycle, then scrambling to reassemble evidence when the affirmation comes due.

To run the arithmetic on your own numbers, use the Scenario Builder in the free CMMC Calculator. It shows package pricing live: set your headcount and scope assumptions and watch the stack reprice as the boundary shrinks. It's the fastest way to see why a scoping engagement that costs thousands routinely saves tens of thousands.

For most SMBs, Level 2 costs five figures or more, and the boundary decides where in that range you land. The cheapest control is the one you never have to implement because the system it would have protected is out of scope.