CMMC Level 2 Cost in 2026: What Defense Contractors Should Actually Budget

By The Defense Compliance Report Editorial Team — an independent trade publication on CMMC 2.0 and DIB compliance.

Last verified: August 10, 2026

The Defense Compliance Report is not affiliated with, endorsed by, or sponsored by the U.S. Department of Defense, the Cyber AB, DCMA DIBCAC, NIST, or any U.S. Government agency. This article is editorial research, not legal, procurement, cybersecurity, or compliance advice.

Last reviewed: August 2026

In short: there is no verified single market price for CMMC Level 2. The final-rule model gives small-entity three-year assessment-and-affirmation totals of $37,196 for Level 2 Self and $104,670 for Level 2 C3PAO, with a $117,768 modeled total for other-than-small Level 2 C3PAO. These are regulatory assumptions, not current provider prices, and exclude implementation and ongoing engineering. Build your budget from written quotes for your defined scope.

The fast answer

For most small and mid-sized defense contractors handling Controlled Unclassified Information (CUI), there is no verified single current market price for CMMC Level 2. The Department of Defense’s final-rule model gives small-entity three-year assessment-and-affirmation totals of $37,196 for Level 2 Self, $104,670 for a Level 2 C3PAO cycle (small entity), or $117,768 for a Level 2 C3PAO cycle (other-than-small entity). These are regulatory assumptions, not current provider prices, and exclude Level 2 implementation and ongoing engineering. Request written quotes for your defined scope.

A provider proposal and a regulatory planning model cover different assumptions. Compare costs only after separating assessment and affirmation activity from readiness, implementation, continuing operations, internal labor, and any bundled services.

We read the Federal Register, the eCFR, the DoD CIO assessment guides, the DFARS final rule, and the Cyber AB Code of Professional Conduct so you can decide your next move with primary sources behind it — not a vendor cost guide that quietly leaves out the parts that hurt them.

CMMC Level 2 cost at a glance

This is editorial guidance, not legal, procurement, or compliance advice. Your solicitation, contract clause, contracting officer, and your actual CUI footprint control what applies to your company. Verify everything against primary sources before you sign anything.

Why the DoD’s estimate looks low (and why your vendor’s quote isn’t necessarily wrong)

Answer capsule:The DoD’s final-rule model gives three-year assessment-and-affirmation totals of $37,196 (Self), $104,670 (C3PAO, small entity), and $117,768 (C3PAO, other-than-small entity). The regulatory impact analysis includes modeled contractor labor and outside support, but excludes Level 2 implementation and ongoing engineering costs.

The DoD’s number is real. It is also incomplete by design. Read the cost analysis in the Final Rule (89 FR 83092) and you will find a clean distinction: the model covers assessment and affirmation activities, while Level 2 implementation and ongoing engineering are excluded. Do not treat excluded work as a zero-cost item in your organization’s budget.

A 2020 DoD review of contractor self-attestations found a problem with that assumption. Contractors had submitted Plans of Action and Milestones (POA&Ms) with remediation completion dates extending years into the future — in some cases to 2099. The implementation the cost analysis assumed was finished was, in many cases, still on a wish list. That is the gap between “DoD estimate” and “your real budget.”

That gap is also why a 2025 State of the DIBreport commissioned by CyberSheath and conducted by Merrill Research found that only 1% of surveyed defense contractors considered themselves fully prepared for CMMC audits. And it is why PreVeil, a CUI enclave vendor, reported from its survey of over 2,000 defense contractors that roughly 70% had budgeted less than the DoD’s own Level 2 estimate. Both numbers are vendor-reported; both point in the same direction.

The three numbers people keep confusing

Do not compare a regulatory assessment-and-affirmation model with a complete provider proposal as if they priced the same work. Compare each quote against the same scope and period.

Compare the same costs over the same period

DoD’s regulatory impact analysis is a planning model for assessment and affirmation activity. It includes contractor labor and outside support, and excludes Level 2 implementation and ongoing engineering. It is not a minimum price, current market survey, or amount to add automatically to a provider’s complete proposal.

Source: CMMC Program final rule, October 15, 2024. The three-year totals combine the initial model and subsequent annual affirmations; they do not mean a three-year vendor contract is required.

Compare proposals against the same boundary, deliverables, assessment type, term, recurring charges, internal-labor assumptions, and exclusions. A lower assessor fee does not prove a cheaper program, and a provider’s total should not be compared with the assessor-only portion of another quote.

Damaging admission worth saying out loud

No honest CMMC Level 2 cost page can hand you a single number from your employee count. A 30-person firm with CUI confined to five users in a defensible enclave can spend less than a 20-person firm where CUI flows through every mailbox, laptop, and file share. Cost follows scope and maturity, not headcount. Anyone who hands you a flat per-employee price before scoping has either skipped the most important step or hidden it inside an assumption you will pay for later.

That is the most credible thing we can tell you, because it means the path to a defensible Level 2 budget always starts the same way: scope it, score it, then price it.

Do you need Level 2 Self-Assessment or Level 2 C3PAO certification?

Answer capsule: CMMC Level 2 has two paths — self-assessment under 32 CFR § 170.16 and third-party certification by an authorized or accredited C3PAO under 32 CFR § 170.17. Which path applies to your company is set by the solicitation provision and the contract clause (DFARS 252.204-7025 and DFARS 252.204-7021), not by your preference. The original rulemaking projected that a substantial majority of Level 2 organizations would follow the C3PAO assessment path. That was a rulemaking demand projection, not a current Phase II implementation deadline. During the current suspension, new procurement designations are limited to Level 2 (Self); verify your specific solicitation or contract before assuming a C3PAO requirement applies.

The difference is not just price. It is the verification model.

Level 2 Self-Assessmentmeans your organization conducts the assessment of all 110 NIST SP 800-171 Revision 2 security requirements, posts the score to the Supplier Performance Risk System (SPRS), and an “affirming official” (a senior official with authority to attest to the company’s compliance) submits an annual affirmation. Self-assessment applies to a narrow subset of Level 2 contracts where the contract clause specifies CMMC Level 2 (Self).

Level 2 C3PAO Certification means the same 110 NIST SP 800-171 Rev. 2 requirements are assessed by an authorized or accredited Certified Third-Party Assessment Organization (C3PAO — an entity authorized by the Cyber AB, the CMMC accreditation body, to perform certification assessments). C3PAO results post through the CMMC Enterprise Mission Assurance Support Service (eMASS) and into SPRS. Annual affirmation still applies.

The mechanics in DFARS 252.204-7021 are precise: a Final Level 2 (Self) or Final Level 2 (C3PAO) CMMC Status is treated as “current” when it is not older than three years, accompanied by an affirmation of continuous compliance not older than one year. Lose the affirmation cadence, lose the status.

Reading your contract for the answer

Start with the current written solicitation, contract and any amendments or modifications. Under the suspension implementation instructions and Class Deviation 2026-O0025, Revision 3, dated September 3, 2026, new procurement requirements may designate only CMMC Level 1 (Self) or Level 2 (Self). They may not newly designate Level 2 (C3PAO) or Level 3 (DIBCAC) during the suspension. Phase I self-assessment requirements remain in place. Check:

• Which CMMC level and assessment type does the current written instrument specify?
• Has an amendment or modification removed or changed a previously included C3PAO or Level 3 requirement?
• Is DFARS 252.204-7021 incorporated, and what status and affirmation obligations does its actual text impose?
• What requirements does your prime flow down for systems that process, store or transmit FCI or CUI?
• Which version of the safeguarding and assessment clauses is incorporated? Applicable RFO instruments use FAR 52.240-93 and DFARS 252.240-7997; legacy instruments may still contain FAR 52.204-21 and DFARS 252.204-7019 or 252.204-7020. DFARS 252.204-7012 safeguarding and incident-reporting obligations continue where applicable.

November 2025 codified rule — historical reference: DFARS 252.204-7025 identifies four possible designations: Level 1 (Self), Level 2 (Self), Level 2 (C3PAO) and Level 3 (DIBCAC). That historical menu does not override the current self-assessment-only procurement direction during the suspension.

If your instrument is unclear, ask the contracting officer or prime in writing before buying an assessment. A vendor’s interpretation does not amend the contract. See the official implementation instructions, current Revision 3 deviation, and official CMMC status page. Policy sources checked October 3, 2026.

What drives CMMC Level 2 cost the most

Answer capsule: The biggest cost driver in CMMC Level 2 is not company size — it is the size and complexity of the CUI environment, the current state of NIST SP 800-171 Rev. 2 implementation, and the quality of operating evidence. Assessment effort follows the systems and assets that process, store, transmit, or protect CUI. Scope beats headcount, and existing maturity beats tool spend, every time.

The CMMC scoring framework, the DoD CIO assessment guide, and 32 CFR Part 170 make the point clearly: the Level 2 assessment effort tracks the assets and systems in scope, not the size of the org chart.

The 32 CFR Part 170 scoping categories (this is where your budget lives or dies)

The CMMC rule defines five categories of assets, and each one is treated differently in an assessment. The boundary you draw between them is the single most leveraged decision in your entire CMMC budget.

Practical translation: a 200-person firm that contains CUI to a 12-user enclave can be assessed against a far smaller boundary than a 25-person firm where CUI flows through every mailbox, file share, laptop, and shared printer. The first company is buying an assessment of an enclave. The second company is buying an assessment of an enterprise.

Cost driver scorecard

Why scope beats headcount

Consider a hypothetical comparison: a large company confines CUI to a documented enclave, while a much smaller company handles it across email, shared storage, endpoints, and printers. The smaller organization may have the broader assessment boundary. This is an illustration of scope, not a price comparison or a case study we independently verified.

Why existing maturity beats tool spend

Software does not implement controls. Software supports the operation of controls that humans implement, document, and prove. A GRC platform does not write your SSP. A SIEM does not produce assessment-ready evidence by itself. Buy tools to support a program you are running; do not buy tools as a substitute for the program. Assessors test whether the practice is operating — not whether you bought the brochure. See the best CMMC compliance software guide for an evidence-first evaluation framework.

What a real CMMC Level 2 budget includes

Answer capsule:A defensible Level 2 budget separates one-time readiness, one-time assessment, recurring tooling, recurring managed support, internal labor, and annual affirmation maintenance. A quote that only shows “C3PAO assessment” is not a budget — it is the last line item of a budget. Most contractors who run over budget did so because they priced the last line and ignored the first seven.

If a solicitation or contract still says Level 2 (C3PAO), do not assume the requirement is current. For an active solicitation, verify that the contracting officer issued the post–July 13 amendment removing or revising the requirement. For an existing contract, verify the modification required by the suspension memo before the next option period or scheduled administrative modification. Obtain the answer in writing before booking an assessment.

The worksheet below lists cost categories to price, not current market estimates. It can help with voluntary readiness planning or with a current written Level 2 (C3PAO) requirement; it does not imply that the former November 10, 2026 implementation date remains active.

One-time costs

Recurring costs

We have not established representative October 2026 market prices for these line items. Obtain current written proposals for your scope and avoid counting bundled work or licenses twice. The verified government models above explain cost categories; they do not set supplier fees.

Internal labor — the cost everyone underestimates

Internal labor is organization-specific. Identify the affirming official, IT and security owners, contracts staff, and control owners who will prepare for and operate the required controls; estimate their effort from your actual scope and work plan. The DoD model uses standardized labor assumptions, not a forecast of your organization’s hours.

How much does a C3PAO assessment cost by itself?

Answer capsule: A C3PAO sets its assessment fee for the agreed scope. DoD modeled a small-entity C3PAO engagement at $31,234 within a broader $104,670 three-year assessment-and-affirmation total; the other-than-small engagement model is $52,056. Those are regulatory assumptions, not a current provider rate card. Ask independent assessors to quote the same boundary and list travel, reporting, closeout, and exclusions separately.

The C3PAO fee covers a defined scope of professional work, set by the CMMC Assessment Process (CAP) and the Cyber AB’s published requirements for C3PAOs. See our C3PAO directory for how to find authorized assessors on the Cyber AB Marketplace.

What the C3PAO fee usually covers

• Pre-assessment coordination and scope confirmation
• Formal assessment plan
• Document and evidence review
• Personnel interviews
• Examine / Interview / Test verification of the 110 requirements
• Findings report
• eMASS / SPRS posting mechanics

What the C3PAO fee usually does not cover

• Writing your SSP
• Implementing controls
• Operating controls
• Building or licensing your enclave
• Remediating findings
• Guaranteeing certification — guarantees are prohibited under Cyber AB rules

What we actually verified

Frequently asked questions about CMMC Level 2 cost

How much does CMMC Level 2 cost for a small business?

The final-rule regulatory impact analysis modeled Level 2 Self for a small entity at $34,277 for the initial assessment and affirmation and $37,196 over three years. Its Level 2 C3PAO model is $101,752 initially and $104,670 over three years; the other-than-small three-year model is $117,768. These are government planning assumptions, not current provider prices, and the model excludes Level 2 implementation and ongoing engineering. We have not established representative October 2026 market prices; request written quotes for your defined scope.

Is the C3PAO fee the same as total CMMC Level 2 cost?

No. The government model includes a $31,234 small-entity C3PAO engagement within its broader $104,670 three-year assessment-and-affirmation total. That is a regulatory assumption, not a current rate card. Readiness, remediation, environment changes, and continuing operations may need separate quotes; compare the same scope and avoid counting bundled work twice.

Can I self-assess for CMMC Level 2?

Yes. The rule defines Level 2 (Self) and Level 2 (C3PAO). During the current suspension, new procurement designations are limited to Level 2 (Self); Level 2 (C3PAO) may not be newly designated. If existing paperwork still names Level 2 (C3PAO), verify the required solicitation amendment or contract modification in writing before scheduling an assessment. The contract clause — DFARS 252.204-7021, via the solicitation provision at DFARS 252.204-7025 — controls which path applies, not your preference.

The original rulemaking projected that a substantial majority of Level 2 organizations would follow the C3PAO assessment path. That was a rulemaking demand projection, not a current Phase II implementation deadline.

Does CMMC Level 2 use NIST SP 800-171 Rev. 2 or Rev. 3?

CMMC Level 2 currently incorporates NIST SP 800-171 Revision 2. NIST has published Revision 3, but the CMMC rule remains tied to Rev. 2 unless and until DoD formally amends the rule. Watch the Federal Register and the DoD CIO CMMC page for any future change. For every authority mapped with primary sources, see our NIST 800-171 Rev 2 vs Rev 3 comparison.

How often do I need to reassess and affirm?

CMMC status is valid for three years from the CMMC Status Date, provided an annual affirmation of continuous compliance is posted in SPRS by the designated affirming official. The status and the affirmation are separate requirements; both must be current.

Can I use a POA&M for CMMC Level 2 gaps?

Only in limited circumstances. Your assessment score divided by 110 must be at least 0.8, certain requirements may not be on a POA&M, and POA&M closeout must occur within 180 days of the Conditional Level 2 CMMC Status Date. If closeout fails, the Conditional Level 2 status expires.

Is GCC High required for CMMC Level 2?

Not universally. 32 CFR Part 170 does not name a specific commercial product as a Level 2 requirement. Your environment must support your CUI, FedRAMP, DFARS 252.204-7012, and shared-responsibility obligations — that may or may not require GCC High depending on your CUI categories, contract terms, and ESP arrangements. Verify before you buy.

How long does CMMC Level 2 take?

There is no universal current duration. Timing depends on the contract path, scope, readiness, provider availability, evidence, and whether conditional-status POA&M closeout is needed. Request dated milestones for your boundary. When conditional status applies, the rule provides a 180-day POA&M closeout window.

When does CMMC Level 2 become required in contracts?

CMMC requirements began appearing in DoD contracts under DFARS 252.204-7021 on November 10, 2025 (Phase 1). The July 13, 2026 implementation suspension left Phase 1 active, limited new procurement designations to Level 1 (Self) and Level 2 (Self), and suspended new Level 2 (C3PAO), Level 3, and later-phase designations with no replacement Phase II date announced. Verify the specific written solicitation amendment or contract modification for any existing requirement.

Why do CMMC Level 2 vendor quotes vary so much?

Proposals can cover different boundaries, deliverables, assessment types, terms, recurring charges, internal-labor assumptions, and exclusions. The DoD regulatory model is not a current provider price and excludes Level 2 implementation and ongoing engineering. Compare written proposals against the same scope and period, and count bundled work only once.

What to do next

You are deciding which contract path applies, what boundary must be assessed, what work remains, and which costs belong in your budget. A generic duration or market-price band cannot answer those organization-specific questions.

The next move is not “ask another vendor for a quote.” The next move is to figure out what your contract actually requires, where your CUI actually lives, and how far that environment is from NIST SP 800-171 Rev. 2 today. Those three answers determine your provider sequence and the proposals you need to request. Resolve them before comparing prices or buying services.

Which provider category fits your situation

• An RPO/RP (Registered Provider Organization / Registered Practitioner) fits if you need readiness help — CUI scoping, an SSP, a NIST SP 800-171 Revision 2 gap assessment, and remediation planning before any assessment.
• An MSP/MSSP (Managed Security Service Provider) fits if you need the Level 2 controls implemented and operated; if it touches CUI it is in your assessment scope as an External Service Provider.
• A GRC platform fits if you want a system of record to track requirements, evidence, and remediation tasks.
• A C3PAO (Certified Third-Party Assessment Organization) fits if your contract requires Level 2 (C3PAO) and your scope, SSP, and evidence are ready for the official assessment.
• You don't need a C3PAO yet if your contract allows Level 2 self-assessment, or you haven't finished scoping, the SSP, and remediation — readiness comes first.

Related guides

• CMMC cost calculator: estimate your Level 1, Level 2, C3PAO & 3-year budget
• CMMC Level 1 cost guide (2026)
• CMMC consulting cost: hourly rates, project bands, and quote guide
• C3PAO assessment cost: $35K–$125K+ quote guide
• C3PAO directory: how to find and verify authorized assessors
• CMMC MSP guide: what to look for and what to avoid
• CMMC managed enclave: scope reduction and provider options
• GCC High and CMMC: when it’s required and when it isn’t
• Best CMMC consultants: by type and buyer profile
• Best CMMC compliance software: an evidence-first comparison
• FCI vs. CUI: what the difference means for your contract level
• CMMC provider categories explained
• Who to hire first: C3PAO, RPO, MSP, or consultant?
• CMMC readiness checklist (mapped to NIST SP 800-171 Rev. 2)

Sources

• 32 CFR Part 170, CMMC Program Final Rule, 89 FR 83092 (Federal Register, October 15, 2024)
• eCFR live text of 32 CFR Part 170, including § 170.16, § 170.17, § 170.19, § 170.21
• DFARS 252.204-7021, Contractor Compliance with the CMMC Level Required by the Contract (acquisition.gov)
• DFARS 252.204-7025, CMMC Level Requirement (acquisition.gov)
• DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (acquisition.gov)
• DFARS final rule, 90 FR 43560 (Federal Register, September 10, 2025)
• NIST SP 800-171 Revision 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (csrc.nist.gov)
• DoD CIO CMMC Assessment Guide – Level 2 (dodcio.defense.gov)
• Cyber AB Code of Professional Conduct, Version 2.0 (cyberab.org)
• DoD OIG Report DODIG-2025-056, Audit of the DoD’s Process for Authorizing Third Party Organizations to Perform CMMC 2.0 Assessments (January 10, 2025)
• Cyber AB Marketplace — authoritative source for current C3PAO listings (marketplace.cyberab.org)
• FAR Case 2017-016, proposed FAR CUI rule, 90 FR 4278 (Federal Register, January 15, 2025)
• Granite Construction (NYSE: GVA), December 8, 2025 press release (graniteconstruction.com) — company disclosure, treated as such
• CyberSheath / Merrill Research, 2025 State of the Defense Industrial Base on CMMC Compliance — vendor-commissioned survey, treated as such
• PreVeil CMMC Certification Costs survey, 2,000+ defense contractors — vendor-reported, treated as such
• Reuters, February 2026, “New cybersecurity rules for US defense industry create barrier for some small suppliers”

The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. We are not affiliated with, endorsed by, or sponsored by the U.S. Department of Defense, the Cyber AB, DCMA DIBCAC, NIST, or any U.S. Government agency. This article is editorial research and does not constitute legal, procurement, cybersecurity, or compliance advice. Verify all regulatory citations against the primary sources listed above before relying on them in a contract context. Last verified: August 10, 2026. Editorial corrections policy: corrections.