CMMC 2.0

CMMC Readiness Calculator

Find your likely CMMC level, gauge control readiness, and estimate assessment cost.

How this is calculated

Level: handling CUI points to Level 2 (all 110 NIST SP 800-171 Rev 2 requirements); FCI only points to Level 1 (the 15 requirements of FAR 52.204-21); neither means CMMC is likely not triggered (32 CFR Part 170).
Readiness = controls ticked out of 8 common controls, as a percentage. It is a sample, not a Level 2 score. 70% or more is green, 40% or more amber, below that red.
Cost: a remediation band by organisation size (our estimate) plus DoD’s own estimate from the 32 CFR 170 final rule of the cost to support the assessment - US$101,752 (small entity) or US$112,345 (other than small) for a Level 2 C3PAO certification assessment, and US$5,977 or US$4,042 a year for a Level 1 self-assessment.

Constants the tool uses

Unless a value names a study, it is VITI Security's working estimate for budgeting - not taken from a statute or a dated study - so treat it as an adjustable assumption.

Level 2 remediation: small / mid / large: US$20k-80k / 50k-150k / 100k-300k+
Level 1 readiness work: US$3,000-15,000
"Small" organisation: Under 100 staff (DoD uses SBA size standards instead)
Readiness sample: 8 common controls, equal weight

Worked example

The calculator run on its default inputs:

Do you handle Controlled Unclassified Information (CUI)?: Yes
Do you handle Federal Contract Information (FCI)?: Yes
Organization / contract size: Small (< 100 staff)
Controls already in place: Multi-factor authentication; Endpoint protection / EDR

Likely CMMC Level 2 required

25% ready

Likely required level: CMMC Level 2 - all 110 NIST SP 800-171 Rev 2 requirements (Level 3 adds 24 NIST SP 800-172 requirements for some programs)
Control readiness (8 sampled controls): 25% (2/8 in place)
Rough cost band: $20,000-$80,000 remediation (our estimate) + about $101,752 to support a C3PAO assessment (DoD estimate, small entity)

Handling CUI points to Level 2. Two of eight sampled controls (MFA and EDR) gives 25% readiness, shown red because it is under 40%. For a small organisation the cost line pairs US$20,000-80,000 of remediation with DoD’s US$101,752 estimate to support a C3PAO assessment.

Sources

CMMC Program final rule, 32 CFR Part 170 (Federal Register, 15 October 2024) - the program, effective 16 December 2024, and DoD’s assessment cost estimates
32 CFR 170.14 (eCFR) - Level 1 (15 FAR requirements), Level 2 (110 NIST SP 800-171) and Level 3 (24 NIST SP 800-172) requirements
32 CFR 170.21 (eCFR) - POA&M limits and the 180-day close-out
DFARS CMMC acquisition rule (Federal Register, 10 September 2025) - clause 252.204-7021, effective 10 November 2025
DFARS 252.204-7019 (eCFR) - posting NIST SP 800-171 assessment scores in SPRS

Sources last checked September 2026.

Limitations

The level comes from your contract, and a Level 2 contract may call for either a self-assessment or C3PAO certification. Eight sampled controls say little about a 110-requirement assessment, and DoD’s cost estimates assume the controls are already in place. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.