CMMC Level 2 assessment cost

Level 2 means implementing the 110 security requirements of NIST SP 800-171 Rev 2 on every system that stores, processes or transmits Controlled Unclassified Information (CUI). The price of that work depends far more on how much of your company is in scope than on any fixed fee. This page breaks the cost into buckets, explains what moves each one, and shows where small contractors usually save money. For the overall program, start at the CMMC hub.

The cost buckets

Level 2 spending falls into six buckets. Only one of them is the assessment.

1. Readiness or gap assessment. A practice-by-practice review of where you stand, ending in a gap report, an SPRS score estimate and a prioritized roadmap.
2. Remediation and tools. MFA, encryption, logging and monitoring, endpoint protection, patching, backups, device management and the labour to set them up. This is usually the largest bucket.
3. Documentation. The System Security Plan (SSP), policies and procedures, a plan of action and milestones (POA&M), CUI boundary descriptions and data-flow diagrams.
4. The assessment itself. A self-assessment is mostly internal staff time. A voluntary third-party assessment is a paid engagement with an authorized assessment organization.
5. Annual affirmation. A senior official affirms in SPRS each year that the requirements are still met. The filing is free; keeping the affirmation true is not.
6. Ongoing upkeep. Recurring licences, monitoring, training, policy reviews and evidence collection between assessments.

What drives the cost up or down

• Scope and the CUI boundary. Every system and person that touches CUI is in scope. A sloppy boundary can pull your whole network in.
• Users and assets. More users, laptops, servers and network devices mean more licences, more configuration and more evidence.
• Enclave vs whole company. Isolating CUI in a small enclave can shrink the job sharply when only a few staff handle it.
• Cloud choices. Cloud services holding CUI must meet FedRAMP Moderate-equivalent requirements under DFARS 252.204-7012. Government-cloud tenants such as Microsoft GCC High cost more per user than commercial tiers.
• Existing maturity. A current SSP, working MFA and an honest SPRS score already on file cut the remaining work.
• Your managed service provider. An MSP that already runs secure configurations helps; one that has to retool for CUI adds cost, and its own role must be documented.

Typical market ranges

How to cut the cost

1. Scope down first. Find out exactly where CUI enters, lives and leaves. Systems that never see CUI can stay out of scope when the boundary is drawn and documented properly.
2. Consider an enclave. If a handful of engineers or contracts staff handle CUI, a dedicated enclave can be cheaper than raising the whole company to Level 2.
3. Do a gap assessment before buying tools. Buying a platform before you know your gaps is an easy way to overspend. A NIST SP 800-171 gap assessment shows what is actually missing.
4. Fix the 5-point items first. SPRS scoring starts at 110 and subtracts 1, 3 or 5 points per unmet requirement, down to a minimum of -203. The heavily weighted items (such as MFA and FIPS-validated encryption) move your score most. See how the SPRS score works.
5. Reuse what you have. Many cloud suites already include security features you are paying for but not using.

What the Phase 2 suspension means for your budget

The DFARS CMMC rule (252.204-7021 and 252.204-7025) took effect on November 10, 2025, starting Phase 1. On July 13, 2026 the Department of War suspended the move to Phase 2, which had been due on November 10, 2026. While the suspension lasts, new requirements may only call for Level 1 (Self) or Level 2 (Self), and program offices may not require Level 2 (C3PAO) or Level 3. A CMMC Reform Task Force is reviewing the program. Read the details in our Phase 2 suspension explainer.

For budgeting, that shifts the near-term spend toward readiness and a sound self-assessment. Voluntary C3PAO assessments remain available for companies whose primes ask for one. Nothing about the suspension removes the underlying work: DFARS 252.204-7012 and NIST SP 800-171 Rev 2 still apply, and a weak self-assessment score in SPRS is visible to the contracting officers and primes who check it.

Conditional status and a POA&M

Under 32 CFR 170.21, a Level 2 assessment can end in conditional status if the score is at least 88 of 110 and the remaining items are allowed on a POA&M; those items must be closed within 180 days. Some requirements may not be deferred, so plan to fix the heavily weighted items before you assess. The rule text is on ecfr.gov (32 CFR Part 170).

Where a Galaxy gap assessment fits

Galaxy Consulting is a Cyber-AB Registered Provider Organization (RPO) with a Registered Practitioner on staff. It is not a C3PAO and does not conduct official assessments; it prepares you. A gap assessment typically takes two to three weeks. The Registered Practitioner guides you through all 110 Level 2 practices and delivers:

• a review of every applicable practice;
• a written gap report organized by domain;
• a risk-prioritized remediation roadmap;
• an SPRS score estimate; and
• a recommended path (scope, enclave or whole company, and next steps).

From there Galaxy can help with remediation, documentation (SSP, policies, POA&M, data-flow diagrams), and self-assessment and SPRS affirmation support. See the full list on the CMMC services page, compare with the Level 1 requirements if you only handle FCI, or book a free discovery call to talk through your scope.

Frequently asked questions

Related CMMC pages

• CMMC Level 2: the 110 requirements
• NIST SP 800-171 gap assessment
• How the SPRS score works
• C3PAO vs RPO
• The Phase 2 suspension explained

General information, not legal advice. Check your own contract clauses with your contracting officer or counsel.