Gardience · CMMC Level 2 · Updated 2026-11-07 · Gardience Engineering · How we test

How much does CMMC Level 2 cost?

• $104,670DoD estimate: Level 2 C3PAO assessment over 3 years, small company
• $37,196DoD estimate: Level 2 self-assessment over 3 years, small company
• $10,000a year: Gardience Starter plus the CMMC add-on
• 35 mintechnical side, SPRS -203 to 110 in a test

CMMC Level 2 is the Department of Defense requirement for contractors that handle controlled unclassified information (CUI): the 110 security requirements of NIST SP 800-171 Rev. 2, scored in the Supplier Performance Risk System (SPRS). What it costs depends on three things: which assessment your contract asks for, how far your systems are from the 110 requirements today, and who does the work to close the gap.

The DoD published its own estimates with the final CMMC program rule on October 15, 2024. For a small company:

The three-year figures add two yearly affirmations of $1,459 each to the first assessment. The DoD built the estimates from hours of staff and outside help, priced at $190.52 an hour for a director and $260.28 an hour for an external service provider. Your contract says which Level 2 assessment applies: a self-assessment, or a certification assessment by an authorized assessor (C3PAO).

Getting compliant. The rule assumes the company has already implemented NIST SP 800-171, because DFARS 252.204-7012 has required it since December 31, 2017, so its estimates do not include implementing the requirements, keeping them in place, or closing a plan of action. For most companies that readiness work is the larger bill: patching and hardening every machine that touches CUI, encrypting drives, turning on audit logs, multifactor sign-in, writing the System Security Plan, and collecting the records assessors ask for.

Two kinds of work, and they cost differently:

• The technical side. Settings on every Windows and Linux machine in scope: patches, the security baseline, firewall, audit logs, account lockout, disk encryption, FIPS mode, removable storage, and antivirus. Done by hand it is many hours per machine, repeated whenever something drifts. The DoD's own rate for outside help prices 40 hours at $10,411.
• The people and process side. Policies, training records, background checks, visitor logs, an incident response plan, and a risk assessment. No tool can do this for you, but it can draft the policies, collect the records, and remind people until they arrive.

Every requirement not met costs 5, 3, or 1 SPRS points, down to a lowest possible score of -203. The free SPRS score calculator shows where you stand, and the CMMC Level 2 checklist lists all 110 requirements with their points.

Every plan is a flat yearly price, Windows and Linux alike, with no per-machine charge. The free 90-day trial includes CMMC Level 2 on up to 25 machines. See pricing.

Gardience covers all 110 requirements from one console. It checks and fixes the technical requirements on your Windows and Linux machines with your approval, collects your records for the rest through upload links, keeps a live SPRS score, and writes the System Security Plan, the POA&M, and a signed evidence pack. On a 50-machine test network with 20 Windows servers holding CUI, the technical side went from an SPRS score of -203 to 110 in 35 minutes; the method and logs are on the proof page.

The assessor's fee is separate either way. Gardience does not perform the assessment; an authorized assessor (C3PAO) does, using the evidence Gardience produces.

1. Score yourself with the SPRS score calculator to see how many requirements are open.
2. Split the gaps into machine settings and records, using the checklist.
3. Price the assessment your contract requires, using the DoD estimates above as a floor.
4. Price the readiness work: Gardience for the technical side, and your team's time, or a consultant's, for the records and policies.

No. The DoD's estimates cover planning, the assessment, reporting, and affirmations only. They assume the requirements are already implemented, because DFARS 252.204-7012 has required NIST SP 800-171 since 2017.

The DoD estimates $34,277 for a small company's first Level 2 self-assessment and affirmation, and $37,196 over three years including two yearly affirmations.

The DoD estimates $101,752 for a small company's Level 2 certification assessment and affirmation, and $104,670 over three years. Assessors set their own prices, so quotes vary.

Yes, in part. The DoD paused Phase 2, the third-party assessments, on July 13, 2026. Level 1 and Level 2 self-assessments and the SPRS score you report are still required in contracts. See what still applies.

No. Starter covers up to 250 machines and Team up to 1,000 for one flat yearly price, and the CMMC add-on is $4,000 a year on either.

Checked November 7, 2026.

• The final CMMC program rule in the Federal Register, October 15, 2024: the DoD's cost estimates for each assessment, its labor rates, and why implementation costs are not included (text on govinfo.gov).
• 32 CFR 170.24, the CMMC scoring methodology, and 32 CFR 170.21, POA&M rules and Conditional Level 2.
• DFARS 252.204-7012, which requires NIST SP 800-171.
• NIST SP 800-171 Rev. 2, the 110 security requirements.

Read more

• CMMC Phase 2 is paused: what defense suppliers still owe
• STIG and CIS evidence for assessors: Windows and Linux
• Air-gapped patch management for Windows and Linux