CMMC 2.0

CMMC Readiness Calculator

Find your likely CMMC level, gauge control readiness, and estimate assessment cost.

The three CMMC levels

Level	For	Requirements	Assessment
1	Federal Contract Information (FCI)	15 requirements from FAR 52.204-21	Annual self-assessment
2	Controlled Unclassified Information (CUI)	110 requirements of NIST SP 800-171 Rev 2	Self-assessment or certification by a C3PAO, as the contract specifies, every three years
3	The most sensitive CUI programs	Level 2 plus 24 requirements from NIST SP 800-172	Assessment by DoD (DIBCAC)

Timeline

The CMMC Program rule (32 CFR Part 170) took effect on 16 December 2024.
The DFARS rule that puts CMMC into contracts (clause 252.204-7021) took effect on 10 November 2025, with requirements phased into new solicitations over the following years.
Separately, contractors handling CUI must post their NIST SP 800-171 assessment score in SPRS (DFARS 252.204-7019).

Plans of action (POA&Ms)

A Level 2 assessment can pass with some requirements still open on a plan of action, but only certain requirements qualify, a minimum score is needed, and open items must be closed within 180 days (32 CFR 170.21).

What it costs

In the final rule, DoD estimated the cost of supporting a Level 2 certification assessment at about $101,752 for a small entity and $112,345 for other entities, and a Level 1 self-assessment at about $5,977 or $4,042 a year. Those estimates assume the controls are already in place. Getting there (remediation) is usually the bigger cost, and the calculator above adds our estimate for it by organisation size.

Where to start

Check your contracts for FCI, CUI and the CMMC clause; that decides your level.
Scope the systems that store, process or transmit CUI, and shrink that scope where you can.
Run a gap assessment against NIST SP 800-171 and write your System Security Plan.
Fix the gaps in order of risk, then score yourself honestly in SPRS.

We run the gap assessment and the technical remediation. See vCISO services and VAPT.

Sources

Facts checked against the sources above on 22 October 2026. General information, not legal advice.

How this is calculated

Level: handling CUI points to Level 2 (all 110 NIST SP 800-171 Rev 2 requirements); FCI only points to Level 1 (the 15 requirements of FAR 52.204-21); neither means CMMC is likely not triggered (32 CFR Part 170).
Readiness = controls ticked out of 8 common controls, as a percentage. It is a sample, not a Level 2 score. 70% or more is green, 40% or more amber, below that red.
Cost: a remediation band by organisation size (our estimate) plus DoD’s own estimate from the 32 CFR 170 final rule of the cost to support the assessment - US$101,752 (small entity) or US$112,345 (other than small) for a Level 2 C3PAO certification assessment, and US$5,977 or US$4,042 a year for a Level 1 self-assessment.

Constants the tool uses

Unless a value names a study, it is VITI Security's working estimate for budgeting - not taken from a statute or a dated study - so treat it as an adjustable assumption.

Level 2 remediation: small / mid / large: US$20k-80k / 50k-150k / 100k-300k+
Level 1 readiness work: US$3,000-15,000
"Small" organisation: Under 100 staff (DoD uses SBA size standards instead)
Readiness sample: 8 common controls, equal weight

Worked example

The calculator run on its default inputs:

Do you handle Controlled Unclassified Information (CUI)?: Yes
Do you handle Federal Contract Information (FCI)?: Yes
Organization / contract size: Small (< 100 staff)
Controls already in place: Multi-factor authentication; Endpoint protection / EDR

Likely CMMC Level 2 required

25% ready

Likely required level: CMMC Level 2 - all 110 NIST SP 800-171 Rev 2 requirements (Level 3 adds 24 NIST SP 800-172 requirements for some programs)
Control readiness (8 sampled controls): 25% (2/8 in place)
Rough cost band: $20,000-$80,000 remediation (our estimate) + about $101,752 to support a C3PAO assessment (DoD estimate, small entity)

Handling CUI points to Level 2. Two of eight sampled controls (MFA and EDR) gives 25% readiness, shown red because it is under 40%. For a small organisation the cost line pairs US$20,000-80,000 of remediation with DoD’s US$101,752 estimate to support a C3PAO assessment.

Sources

CMMC Program final rule, 32 CFR Part 170 (Federal Register, 15 October 2024) - the program, effective 16 December 2024, and DoD’s assessment cost estimates
32 CFR 170.14 (eCFR) - Level 1 (15 FAR requirements), Level 2 (110 NIST SP 800-171) and Level 3 (24 NIST SP 800-172) requirements
32 CFR 170.21 (eCFR) - POA&M limits and the 180-day close-out
DFARS CMMC acquisition rule (Federal Register, 10 September 2025) - clause 252.204-7021, effective 10 November 2025
DFARS 252.204-7019 (eCFR) - posting NIST SP 800-171 assessment scores in SPRS

Sources last checked September 2026.

Limitations

The level comes from your contract, and a Level 2 contract may call for either a self-assessment or C3PAO certification. Eight sampled controls say little about a 110-requirement assessment, and DoD’s cost estimates assume the controls are already in place. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.