CMMC Level 2 Cost in 2026: What Defense Contractors Should Actually Budget

By The Defense Compliance Report Editorial Team — an independent trade publication on CMMC 2.0 and DIB compliance.

Last verified: May 26, 2026

The Defense Compliance Report is not affiliated with, endorsed by, or sponsored by the U.S. Department of Defense, the Cyber AB, DCMA DIBCAC, NIST, or any U.S. Government agency. This article is editorial research, not legal, procurement, cybersecurity, or compliance advice.

Last reviewed: June 2026

In short: for contractors handling Controlled Unclassified Information, CMMC Level 2 cost in 2026 is a $75,000–$300,000+ first-cycle budget once scoping, readiness, remediation, tools, and the assessment are included. The DoD’s narrower three-year estimate is $37,196 for a self-assessment cycle and $104,670 for a C3PAO cycle (small entity).

The fast answer

For most small and mid-sized defense contractors handling Controlled Unclassified Information (CUI), CMMC Level 2 cost in 2026 is a $75,000–$300,000+ first-cycle budget once you account for scoping, readiness, remediation, tools, managed support, and the assessment itself. The Department of Defense’s own three-year estimate is narrower because it assumes you already implemented NIST SP 800-171 Revision 2: $37,196 for a Level 2 self-assessment cycle, $104,670 for a Level 2 C3PAO cycle (small entity), or $117,768 for a Level 2 C3PAO cycle (other-than-small entity) over three years.

If your quote looks nothing like the DoD number, you are not being scammed — and you are not crazy. Three completely different numbers get called “CMMC Level 2 cost,” and unless you separate them, every quote you compare will feel either suspicious or insulting. This page exists to separate them.

We read the Federal Register, the eCFR, the DoD CIO assessment guides, the DFARS final rule, and the Cyber AB Code of Professional Conduct so you can decide your next move with primary sources behind it — not a vendor cost guide that quietly leaves out the parts that hurt them.

CMMC Level 2 cost at a glance

This is editorial guidance, not legal, procurement, or compliance advice. Your solicitation, contract clause, contracting officer, and your actual CUI footprint control what applies to your company. Verify everything against primary sources before you sign anything.

Why the DoD’s estimate looks low (and why your vendor’s quote isn’t necessarily wrong)

Answer capsule:The DoD’s published CMMC Level 2 cost estimate of $37,196 (Self), $104,670 (C3PAO, small entity), or $117,768 (C3PAO, other-than-small entity) over three years covers only assessment-and-affirmation activity. The CMMC Final Rule (32 CFR Part 170) explicitly excluded recurring and nonrecurring engineering costs for Level 2 because it assumed the contractor had already implemented NIST SP 800-171 Revision 2 under DFARS 252.204-7012, which has been in effect since 2016.

The DoD’s number is real. It is also incomplete by design. Read the cost analysis in the Final Rule (89 FR 83092) and you will find a clean line: the cost model covers planning, executing, reporting, and affirming the assessment — full stop. Everything that gets you ready for that assessment was modeled at zero, because the rule assumes those costs were already spent under DFARS 252.204-7012.

A 2020 DoD review of contractor self-attestations found a problem with that assumption. Contractors had submitted Plans of Action and Milestones (POA&Ms) with remediation completion dates extending years into the future — in some cases to 2099. The implementation the cost analysis assumed was finished was, in many cases, still on a wish list. That is the gap between “DoD estimate” and “your real budget.”

That gap is also why a 2025 State of the DIBreport commissioned by CyberSheath and conducted by Merrill Research found that only 1% of surveyed defense contractors considered themselves fully prepared for CMMC audits. And it is why PreVeil, a CUI enclave vendor, reported from its survey of over 2,000 defense contractors that roughly 70% had budgeted less than the DoD’s own Level 2 estimate. Both numbers are vendor-reported; both point in the same direction.

The three numbers people keep confusing

Most of the friction we see in this market comes from contractors comparing column one to column three and feeling cheated. They are reading two different invoices for two different scopes of work.

The DoD-vs-real-world reconciliation

This is the table the Federal Register left out — and it is the single most useful piece of context we can give you before you read another quote.

“Planning band” means: industry-reported ranges drawn from public vendor cost guides, market surveys, and editorial analysis. These are not binding quotes — your scoped quote against your scoped boundary is the only number that matters for a contract.

Editorial takeaway: The DoD number is a defensible floor for the visible assessment cost. It is not, and was never claimed to be, your total cost. Your real Level 2 budget is the DoD assessment figure plus whatever distance you still have to NIST SP 800-171 Rev. 2 — and unless someone has measured that distance against your environment, no quote can be accurate.

Damaging admission worth saying out loud

No honest CMMC Level 2 cost page can hand you a single number from your employee count. A 30-person firm with CUI confined to five users in a defensible enclave can spend less than a 20-person firm where CUI flows through every mailbox, laptop, and file share. Cost follows scope and maturity, not headcount. Anyone who hands you a flat per-employee price before scoping has either skipped the most important step or hidden it inside an assumption you will pay for later.

That is the most credible thing we can tell you, because it means the path to a defensible Level 2 budget always starts the same way: scope it, score it, then price it.

Do you need Level 2 Self-Assessment or Level 2 C3PAO certification?

Answer capsule: CMMC Level 2 has two paths — self-assessment under 32 CFR § 170.16 and third-party certification by an authorized or accredited C3PAO under 32 CFR § 170.17. Which path applies to your company is set by the solicitation provision and the contract clause (DFARS 252.204-7025 and DFARS 252.204-7021), not by your preference. DoD’s published projection is that of the entities required to reach Level 2, approximately 35% of all entities will need C3PAO certification and approximately 2% will be eligible to self-attest, with the program office or requiring activity — not the contracting officer — determining the required level for each procurement.

The difference is not just price. It is the verification model.

Level 2 Self-Assessmentmeans your organization conducts the assessment of all 110 NIST SP 800-171 Revision 2 security requirements, posts the score to the Supplier Performance Risk System (SPRS), and an “affirming official” (a senior official with authority to attest to the company’s compliance) submits an annual affirmation. Self-assessment applies to a narrow subset of Level 2 contracts where the contract clause specifies CMMC Level 2 (Self).

Level 2 C3PAO Certification means the same 110 NIST SP 800-171 Rev. 2 requirements are assessed by an authorized or accredited Certified Third-Party Assessment Organization (C3PAO — an entity authorized by the Cyber AB, the CMMC accreditation body, to perform certification assessments). C3PAO results post through the CMMC Enterprise Mission Assurance Support Service (eMASS) and into SPRS. Annual affirmation still applies.

The mechanics in DFARS 252.204-7021 are precise: a Final Level 2 (Self) or Final Level 2 (C3PAO) CMMC Status is treated as “current” when it is not older than three years, accompanied by an affirmation of continuous compliance not older than one year. Lose the affirmation cadence, lose the status.

Reading your contract for the answer

You do not have to guess. The DFARS final rule requires the contracting officer to insert the required CMMC level into the solicitation provision at DFARS 252.204-7025 using one of four explicit options: CMMC Level 1 (Self); CMMC Level 2 (Self); CMMC Level 2 (C3PAO); or CMMC Level 3 (DIBCAC). Check for:

• Does the solicitation specify Level 2 (Self) or Level 2 (C3PAO) explicitly?
• Is DFARS 252.204-7021 present in the contract? If yes, the status requirement is contractual.
• Does the prime contractor flow down a CMMC requirement to your subcontract for information systems that process, store, or transmit FCI or CUI?
• Does any information system in scope process, store, or transmit FCI or CUI during contract performance?

If your solicitation does not specify the required level explicitly, ask the contracting officer in writing — not your IT vendor. The clause is the binding document. DoD has stated that, in general, CUI categories from the DoD Organizational Index group would necessitate a C3PAO assessment at minimum, but the contractual status still needs to be identified in the solicitation provision and contract clause.

What drives CMMC Level 2 cost the most

Answer capsule: The biggest cost driver in CMMC Level 2 is not company size — it is the size and complexity of the CUI environment, the current state of NIST SP 800-171 Rev. 2 implementation, and the quality of operating evidence. Assessment effort follows the systems and assets that process, store, transmit, or protect CUI. Scope beats headcount, and existing maturity beats tool spend, every time.

The CMMC scoring framework, the DoD CIO assessment guide, and 32 CFR Part 170 make the point clearly: the Level 2 assessment effort tracks the assets and systems in scope, not the size of the org chart.

The 32 CFR Part 170 scoping categories (this is where your budget lives or dies)

The CMMC rule defines five categories of assets, and each one is treated differently in an assessment. The boundary you draw between them is the single most leveraged decision in your entire CMMC budget.

Practical translation: a 200-person firm that contains CUI to a 12-user enclave can be assessed against a far smaller boundary than a 25-person firm where CUI flows through every mailbox, file share, laptop, and shared printer. The first company is buying an assessment of an enclave. The second company is buying an assessment of an enterprise.

Cost driver scorecard

Why scope beats headcount

We have read public quotes where a 12-person company exceeded the budget of a 150-person company at the same Level 2 target. It is not unusual. The 150-person company had isolated CUI to a managed enclave with twelve users; the 12-person company had let CUI propagate everywhere. The assessor was pricing the boundary, not the org chart.

Why existing maturity beats tool spend

Software does not implement controls. Software supports the operation of controls that humans implement, document, and prove. A GRC platform does not write your SSP. A SIEM does not produce assessment-ready evidence by itself. Buy tools to support a program you are running; do not buy tools as a substitute for the program. Assessors test whether the practice is operating — not whether you bought the brochure. See the best CMMC compliance software guide for an evidence-first evaluation framework.

What a real CMMC Level 2 budget includes

Answer capsule:A defensible Level 2 budget separates one-time readiness, one-time assessment, recurring tooling, recurring managed support, internal labor, and annual affirmation maintenance. A quote that only shows “C3PAO assessment” is not a budget — it is the last line item of a budget. Most contractors who run over budget did so because they priced the last line and ignored the first seven.

One-time costs

Recurring costs

All planning bands are industry-reported and editorial. A scoped quote against your scoped boundary is the only binding number.

Internal labor — the cost everyone underestimates

Internal labor is not free. Your affirming official, IT lead, security owner, contracts team, and individual control owners all spend real hours preparing for and operating CMMC controls. The DoD’s own cost analysis modeled internal labor at standardized rates. Yours will too. Plan for 200–800+ hours of internal effort in the first cycle for most small DIBs, and budget the affirming official’s recurring time forever.

How much does a C3PAO assessment cost by itself?

Answer capsule: Public market data places C3PAO assessment fees in a wide band — commonly $30,000 to $150,000 per certification cycledepending on scope, organization size, and assessor capacity. The DoD’s published model places the modeled C3PAO engagement at $31,234 inside a broader $104,670 three-year small-entity total, but the modeled rate and the market rate are different things. The assessment fee is also not the same thing as the cost of becoming ready for assessment.

The C3PAO fee covers a defined scope of professional work, set by the CMMC Assessment Process (CAP) and the Cyber AB’s published requirements for C3PAOs. See our C3PAO directory for how to find authorized assessors on the Cyber AB Marketplace.

What the C3PAO fee usually covers

• Pre-assessment coordination and scope confirmation
• Formal assessment plan
• Document and evidence review
• Personnel interviews
• Examine / Interview / Test verification of the 110 requirements
• Findings report
• eMASS / SPRS posting mechanics

What the C3PAO fee usually does not cover

• Writing your SSP
• Implementing controls
• Operating controls
• Building or licensing your enclave
• Remediating findings
• Guaranteeing certification — guarantees are prohibited under Cyber AB rules

What we actually verified

Frequently asked questions about CMMC Level 2 cost

How much does CMMC Level 2 cost for a small business?

The DoD estimates a three-year Level 2 Self cycle at $37,196 and a Level 2 C3PAO cycle at $104,670 for a small entity (32 CFR Part 170, 89 FR 83092). Industry data show real-world first-cycle planning bands for most small DIBs running $75,000–$130,000 when gap analysis, remediation, technology, and the assessment are included. The variance between the official number and the market number is the implementation cost the rule excluded by assumption.

Is the C3PAO fee the same as total CMMC Level 2 cost?

No. The C3PAO fee covers planning, executing, and reporting the certification assessment. It does not usually include scoping, SSP work, remediation, tools, enclave licensing, or managed security operations. Across industry surveys, C3PAO fees account for roughly 25%–40% of total first-cycle Level 2 spend.

Can I self-assess for CMMC Level 2?

Sometimes. Level 2 has both a Self-Assessment path (32 CFR § 170.16) and a C3PAO Certification Assessment path (32 CFR § 170.17). DoD’s published projection is that the substantial majority of Level 2 entities will require C3PAO certification, with a narrow band eligible to self-attest. The contract clause — DFARS 252.204-7021, via the solicitation provision at DFARS 252.204-7025 — controls which path applies, not your preference.

Does CMMC Level 2 use NIST SP 800-171 Rev. 2 or Rev. 3?

CMMC Level 2 currently incorporates NIST SP 800-171 Revision 2. NIST has published Revision 3, but the CMMC rule remains tied to Rev. 2 unless and until DoD formally amends the rule. Watch the Federal Register and the DoD CIO CMMC page for any future change.

How often do I need to reassess and affirm?

CMMC status is valid for three years from the CMMC Status Date, provided an annual affirmation of continuous compliance is posted in SPRS by the designated affirming official. The status and the affirmation are separate requirements; both must be current.

Can I use a POA&M for CMMC Level 2 gaps?

Only in limited circumstances. Your assessment score divided by 110 must be at least 0.8, certain requirements may not be on a POA&M, and POA&M closeout must occur within 180 days of the Conditional Level 2 CMMC Status Date. If closeout fails, the Conditional Level 2 status expires.

Is GCC High required for CMMC Level 2?

Not universally. 32 CFR Part 170 does not name a specific commercial product as a Level 2 requirement. Your environment must support your CUI, FedRAMP, DFARS 252.204-7012, and shared-responsibility obligations — that may or may not require GCC High depending on your CUI categories, contract terms, and ESP arrangements. Verify before you buy.

How long does CMMC Level 2 take?

Most defense contractors need 6 to 18 months from kickoff to a final Level 2 outcome (Self or C3PAO). Compressing the timeline is the single most reliable predictor of higher cost and conditional outcomes.

When does CMMC Level 2 become required in contracts?

CMMC requirements began appearing in DoD contracts under DFARS 252.204-7021 on November 10, 2025 (Phase 1, which runs through November 9, 2026). Phase 2 begins November 10, 2026. Phase 3 begins November 10, 2027. Full implementation is scheduled one calendar year after Phase 3.

Why do CMMC Level 2 vendor quotes vary so much?

Three reasons. First, the DoD’s official estimate excludes implementation costs that most contractors actually still need. Second, the authorized C3PAO population is below the DoD’s projected assessment demand, which produces upward pricing pressure. Third, vendors scope different things under the same words — “Level 2 readiness” means very different work at different firms. The fix is to insist on apples-to-apples scoped quotes against the same defined CUI boundary.

What to do next

You are making one decision: how to spend the next 6 to 18 months and somewhere between $75,000 and $300,000+ on the most expensive cybersecurity decision your company will make in this contract cycle. You are not buying a product. You are buying a defensible Level 2 posture, on the contract clause your customer cares about.

The next move is not “ask another vendor for a quote.” The next move is to figure out what your contract actually requires, where your CUI actually lives, and how far that environment is from NIST SP 800-171 Rev. 2 today. Those three answers determine your provider sequence and your budget band — and they are far cheaper to answer than to guess wrong about.

Which provider category fits your situation

• An RPO/RP (Registered Provider Organization / Registered Practitioner) fits if you need readiness help — CUI scoping, an SSP, a NIST SP 800-171 Revision 2 gap assessment, and remediation planning before any assessment.
• An MSP/MSSP (Managed Security Service Provider) fits if you need the Level 2 controls implemented and operated; if it touches CUI it is in your assessment scope as an External Service Provider.
• A GRC platform fits if you want a system of record to track requirements, evidence, and remediation tasks.
• A C3PAO (Certified Third-Party Assessment Organization) fits if your contract requires Level 2 (C3PAO) and your scope, SSP, and evidence are ready for the official assessment.
• You don't need a C3PAO yet if your contract allows Level 2 self-assessment, or you haven't finished scoping, the SSP, and remediation — readiness comes first.

Related guides

• CMMC cost calculator: estimate your Level 1, Level 2, C3PAO & 3-year budget
• CMMC Level 1 cost guide (2026)
• CMMC consulting cost: hourly rates, project bands, and quote guide
• C3PAO assessment cost: $35K–$125K+ quote guide
• C3PAO directory: how to find and verify authorized assessors
• CMMC MSP guide: what to look for and what to avoid
• CMMC managed enclave: scope reduction and provider options
• GCC High and CMMC: when it’s required and when it isn’t
• Best CMMC consultants: by type and buyer profile
• Best CMMC compliance software: an evidence-first comparison
• FCI vs. CUI: what the difference means for your contract level
• CMMC provider categories explained
• Who to hire first: C3PAO, RPO, MSP, or consultant?
• CMMC readiness checklist (mapped to NIST SP 800-171 Rev. 2)

Sources

• 32 CFR Part 170, CMMC Program Final Rule, 89 FR 83092 (Federal Register, October 15, 2024)
• eCFR live text of 32 CFR Part 170, including § 170.16, § 170.17, § 170.19, § 170.21
• DFARS 252.204-7021, Contractor Compliance with the CMMC Level Required by the Contract (acquisition.gov)
• DFARS 252.204-7025, CMMC Level Requirement (acquisition.gov)
• DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (acquisition.gov)
• DFARS final rule, 90 FR 43560 (Federal Register, September 10, 2025)
• NIST SP 800-171 Revision 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (csrc.nist.gov)
• DoD CIO CMMC Assessment Guide – Level 2 (dodcio.defense.gov)
• Cyber AB Code of Professional Conduct, Version 2.0 (cyberab.org)
• DoD OIG Report DODIG-2025-056, Audit of the DoD’s Process for Authorizing Third Party Organizations to Perform CMMC 2.0 Assessments (January 10, 2025)
• Cyber AB Marketplace — authoritative source for current C3PAO listings (marketplace.cyberab.org)
• FAR Case 2017-016, proposed FAR CUI rule, 90 FR 4278 (Federal Register, January 15, 2025)
• Granite Construction (NYSE: GVA), December 8, 2025 press release (graniteconstruction.com) — company disclosure, treated as such
• CyberSheath / Merrill Research, 2025 State of the Defense Industrial Base on CMMC Compliance — vendor-commissioned survey, treated as such
• PreVeil CMMC Certification Costs survey, 2,000+ defense contractors — vendor-reported, treated as such
• Reuters, February 2026, “New cybersecurity rules for US defense industry create barrier for some small suppliers”

The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. We are not affiliated with, endorsed by, or sponsored by the U.S. Department of Defense, the Cyber AB, DCMA DIBCAC, NIST, or any U.S. Government agency. This article is editorial research and does not constitute legal, procurement, cybersecurity, or compliance advice. Verify all regulatory citations against the primary sources listed above before relying on them in a contract context. Last verified: May 26, 2026. Editorial corrections policy: corrections.