"How much does CMMC Level 2 cost?" is the question every defense contractor asks first and the one with the least satisfying answer, because there is no government-set fee and no single sticker price. The honest response is that cost is a function of decisions you control — chiefly how you scope your environment and how far your current posture sits from the standard — plus a market-priced assessment on top. This post breaks the number into the three buckets it actually lives in, names the variables that move each one, and points to the public basis for planning figures. Treat everything here as decision-support for budgeting, not a quote.
Bucket one: readiness and remediation
This is usually the largest cost, and it is entirely yours before an assessor is ever involved. It covers the gap assessment that tells you where you stand, and then the work of closing real deficiencies: standing up multi-factor authentication, deploying FIPS-validated encryption for CUI, building audit logging and monitoring, hardening boundary protection, and writing an accurate System Security Plan and its supporting evidence. The size of this bucket is driven almost entirely by how far you have to travel. A contractor already near compliance — reflected in a strong SPRS score — spends comparatively little here; one starting from a deeply negative score is funding an architecture and process program, not a checkbox exercise. The clearest early signal of this cost is the gap implied by your baseline SPRS number, which is why establishing that number honestly is the first budgeting step; the companion post on calculating your SPRS score and the free SPRS score estimator exist precisely to size this bucket.
Bucket two: the C3PAO assessment
This is the third-party certification engagement itself — the fee you pay a CMMC Third-Party Assessment Organization to assess your environment against the 320 objectives of NIST SP 800-171A. It is a market-priced professional service, not a government fee, so it varies with the scope and complexity of what the assessor has to examine and with assessor demand. Because the pool of authorized C3PAOs is finite and the Phase 2 window is drawing a large share of the Defense Industrial Base toward certification at once, this is also a cost with timing pressure: assessment slots grow scarcer and pricier as the deadline approaches, which is a practical argument for booking readiness — and eventually the assessment — early rather than late.
Bucket three: ongoing sustainment
Certification is not a one-time purchase. A Level 2 certification assessment is valid for three years, but it comes with an annual affirmation of continuous compliance submitted in SPRS by a senior official, and the underlying reality has to stay true across that period. Sustainment covers continuous monitoring, keeping evidence current, tooling subscriptions, the staff time to maintain the posture, and the eventual re-assessment at the end of the three-year cycle. Teams that budget only for the one-time assessment and treat the certificate as the finish line consistently underestimate the total cost of ownership. The cheapest sustainment model is one where evidence is generated as a byproduct of running the environment rather than reconstructed by hand each year.
The variables that move all three buckets
One decision dominates the rest: scope. Because every in-scope asset multiplies remediation work, assessment effort, and sustainment burden, the size of your CUI boundary is the master dial on total cost. A tight, well-enclaved environment lowers all three buckets simultaneously; a sprawling one raises all three. This is why scoping is a budgeting decision as much as a technical one — the CUI scoping post covers how to shrink the boundary legitimately. After scope, the largest movers are your starting maturity (the SPRS gap), the complexity and headcount of the in-scope environment, and whether you build a compliant enclave yourself or adopt a purpose-built one.
The public basis for planning figures
You do not have to guess entirely in the dark. When the DoD published the CMMC program rule at 32 CFR Part 170, it included an economic analysis with estimated nonrecurring and recurring cost figures per entity, differentiated by organization size. Those published estimates are the most authoritative public baseline available, and they are worth reading as a planning anchor — with the caveat that they are DoD's modeling assumptions, not a quote for your specific environment. Your real cost will diverge from any average based on your scope and starting point, which is exactly why the buckets above matter more than any single headline number. Any specific dollar figure, from a vendor or from the rule's analysis, should be treated as decision-support for planning rather than a guarantee.
How to budget honestly
The productive sequence is: establish an honest SPRS baseline to size the remediation bucket, scope your CUI boundary tightly to shrink all three buckets at once, gather actual C3PAO quotes against that defined scope rather than a hypothetical one, and budget for sustainment and re-assessment from the start instead of just the initial certification. Done in that order, "how much does it cost?" turns from an unanswerable question into a defensible number you can put in front of leadership.
Where Valty fits, honestly
Valty is not a C3PAO and does not set or quote assessment prices — that is between you and an accredited assessor. What the platform addresses is the part of the cost you control: sizing the readiness gap through SPRS scoring and 320-objective tracking, supporting the scope reduction that lowers every bucket, and sustaining evidence over the three-year cycle through generated OSCAL artifacts so that maintaining certification does not mean rebuilding the package by hand each year. It is decision-support for planning and reducing the cost of readiness, not a certification service and not a guaranteed price. For the full picture, see the CMMC overview and the federal and regulatory capability page.