What CMMC Level 2 actually costs.

Reviewed October 6, 2026: the planned November 10, 2026 Phase II expansion is suspended. Phase I self-assessment requirements and DFARS safeguarding duties remain. Check your solicitation, contract, and amendments before choosing an assessment path. Sources: official CMMC status and implementation memorandum.

By inDirectIT, Inc. · Planning guidance from our engineering practice.

What sets the price is your CUI boundary.

Ask five vendors what CMMC Level 2 costs and you'll get five numbers, because most of them are quoting a product. NIST 800-171 doesn't name products. What matters is what's inside your CUI boundary, how long it takes to make that boundary compliant, and whether you can prove it with evidence an assessor will accept. That's why two companies with identical headcount can have very different bills. Our cost breakdown post has the short version; this guide expands it into a full planning framework.

The cost stack

These are the line items in the order they hit, with the figures we publish. The order matters more than any single price, because every dollar spent on discovery shrinks every line below it.

Line item	Typical figure	When it hits
Teramis Regulated Data Discovery: find where CUI actually lives, then shrink the boundary	from $4,500/yr (under 100 employees)	First. Delivery and boundary are confirmed during scoping.
Policy & Evidence Accelerator: SSP, policies, and the evidence library assessors expect	$7.5K to $25K one-time	After scoping. ~2 weeks.
GCC High Migration + DFARS 7012 Enablement: only if your contracts require it	$25K + $250/user	Remediation phase. ~6 weeks.
CMMC Factory Baseline: full GCC High enclave build	scoped per environment	Remediation phase. ~12 weeks.
Managed Compliance Support (vCISO): keep the program running between assessments	from $2.5K/mo	Ongoing, once the boundary is set.
Managed Compliant IT Support: day-to-day IT operated inside the boundary	from $3K/mo	Ongoing.
Third-party C3PAO assessment	obtain a scoped C3PAO quote	Budget separately if third-party certification is needed; the Phase II transition is suspended.

If you're not sure which of these you need, a gap assessment is the cheapest way to find out before you commit to any of them.

What actually drives your number

Company size is a poor proxy. These are the variables that move the bill:

• Seats inside the boundary. Every per-user cost (licensing, migration, support) scales with who touches CUI, not with who's on payroll.
• Systems in scope. Each server, SaaS app, and file share inside the boundary is a system you must control, monitor, and document.
• CUI sprawl and data maturity. CUI scattered across inboxes and personal drives means a bigger boundary and a longer evidence trail.
• Existing Microsoft licensing. What you already own determines how much of the technical stack is a configuration exercise versus a purchase.
• Whether you need GCC High at all. This is the biggest fork in the budget, and the answer comes from your contract requirements.

Scope affects the cost model. Discovery identifies the systems, users, data flows, and security dependencies that need protection. Consolidation may reduce licensing and implementation work, but the percentage and savings are engagement-specific. See our scope reduction guide.

Hidden and ongoing costs

Budgets usually break on costs nobody writes down:

• Dual-running during migration. While you move to a compliant environment, you pay for two, so budget for the overlap as well as the destination.
• Evidence upkeep. Screenshots age, policies drift, and staff turn over. Keeping evidence current is a recurring cost paid in staff hours, whether or not you budget for it.
• Annual affirmations and continuous monitoring. Your SPRS score is a standing legal representation, and keeping it true is an ongoing operating cost.
• The POA&M closeout sprint. Conditional certification requires a minimum score of 88 (0.8×110), only 1-point items on the POA&M (plus the 3.13.11 encryption exception), and a hard 180-day closeout. Miss the deadline and you're re-assessing. The POA&M rules post covers what qualifies.
• Plan against confirmed requirements. Keep safeguarding and required self-assessments current. Confirm amendments, modifications, customer expectations, and assessment lead times before committing to third-party certification. See the current-status playbook.

The sequencing that controls cost

Getting the order of work right is the cheapest saving available:

• Scope first. Run discovery before buying anything. A verified boundary gives you a defensible basis for licensing and implementation decisions.
• Assess honestly. Score all 110 controls against the boundary you actually have. Without an SSP there is no score, because the SSP gates the entire SPRS submission.
• Remediate by point weight. SPRS weights controls 5, 3, or 1. Close the 5-pointers first; they move the score fastest per dollar.
• Operate. Shift to managed compliance so the evidence stays current and the affirmation stays true.

Model it yourself

The free CMMC Calculator's Scenario Builder shows these packages with live pricing and a time-to-SPRS timeline. Pick the pieces you need, drop the ones you don't, and take a number you can defend into the budget conversation.

Turn the budget into an implementation plan.

Use the CMMC gap assessment to connect your planned spend to specific implementation gaps. For a completed example, read how inDirectIT prepared its own assessed environment.