What CMMC Level 2 really costs — and where the money actually goes.

Reviewed October 6, 2026: the planned November 10, 2026 Phase II expansion is suspended. Phase I self-assessment requirements and DFARS safeguarding duties remain. Check your solicitation, contract, and amendments before choosing an assessment path. Sources: official CMMC status and implementation memorandum.

The cost stack, line by line

A realistic Level 2 budget has five layers, and they arrive in a sequence. First, CUI discovery and scope reduction — our Teramis-driven discovery runs from $4,500/yr for organizations under 100 employees. Second, documentation: the Policy & Evidence Accelerator runs $7.5K–25K one-time depending on how much exists today. Third, ongoing operations: Managed Compliance Support from $2.5K/mo, or Managed Compliant IT from $3K/mo if you want the IT stack run compliantly too. Fourth, if your contracts push you to GCC High, the Migration + DFARS 7012 package is $25K + $250/user.

Fifth is a C3PAO assessment, if you pursue third-party certification for a confirmed requirement or business objective. Obtain a scoped quote directly from an authorized assessment organization. Treat its fees and scheduling separately from readiness services; the suspended Phase II transition is not a fixed November 2026 certification deadline.

The biggest lever isn't a product

Cost depends on boundary size and complexity, existing controls, evidence quality, and delivery requirements. Discovery identifies what needs protection and which security dependencies remain in scope. A smaller enclave can reduce some costs, but it does not remove applicable security requirements or automatically improve an SPRS score.

It's also why the most common money-waster is buying tools before scoping. A security platform licensed for 200 users protects a boundary you haven't drawn yet; when discovery lands the enclave at 60 users, the surplus seats don't come back. Scope is not a step you can buy your way past. The CUI Scope Reduction Field Guide lays out the method.

Spend in this order

• Scope first. Find where CUI actually lives and shrink the boundary before pricing anything else.
• Assess the gap. Score the boundary you actually have against all 110 requirements — see our gap assessment.
• Remediate by point impact. Close the 5-point gaps before the 1-pointers; sequence beats effort.
• Operate. Move into managed support so evidence stays current instead of decaying until the next fire drill.

Notice what the sequence buys you: every later step prices off the output of the earlier one. The gap assessment scores a boundary discovery already shrank. Remediation targets the gaps the assessment ranked. Managed support operates only the systems that survived scoping. Run the steps out of order and each one prices off a guess instead — which is how the terrifying quotes get built.

The costs that never stop

Certification is not the finish line for spending. Annual affirmations, evidence upkeep, and continuous monitoring continue after the assessor leaves — which is what the monthly managed-support figures above actually buy. Budgeting Level 2 as a one-time project is how companies end up compliant for exactly one audit cycle, then scrambling to reassemble evidence when the affirmation comes due.

If you want the arithmetic done on your own numbers, the free CMMC Calculator includes a Scenario Builder that shows package pricing live — set your headcount and scope assumptions and watch the stack reprice as the boundary shrinks. It's the fastest way to see why a scoping engagement that costs thousands routinely saves tens of thousands.

The honest summary: Level 2 is a five-figure-plus journey for most SMBs, the boundary decides which five figures, and the cheapest control is the one you never have to implement because the system it protected left scope.