CMMC Level 2 Remediation Budget Calculator
Most defense suppliers know they must reach CMMC Level 2 but cannot say what it will cost. This calculator turns a gap count, a CUI headcount and a few unit costs into a first-year budget you can take to finance.
Your numbers
Count people and service accounts inside your planned CUI boundary, not the whole company.
From your NIST SP 800-171 self-assessment. Level 2 maps to the 110 practices of SP 800-171.
Average effort to design, implement, document and evidence one practice.
MFA, endpoint protection, log collection, encryption, mobile device management and similar subscriptions.
Use a quote from an authorized assessment organization. Leave 0 if you only plan a self-assessment.
Your results
A planning estimate from your own inputs. Real costs depend on architecture, existing tooling and assessor pricing. Not legal or assessment advice.
First-year budget vs CUI users
Sweeps Users who touch CUI from 5 to 250, holding your other inputs fixed.
Optional budget review
Send us your gap list and scope and we will sanity-check the budget assumptions and the CUI boundary.
Optional. The tool and every export work without this. No spam.
How to use the calculator
Start from a real NIST SP 800-171 self-assessment so the gap count is honest. Count only the users and systems that will sit inside the CUI boundary, because scoping is the biggest cost lever you control. Enter average hours per gap, your loaded labor rate, per-user tooling cost and any consultant and assessor quotes. The result shows the first-year total, the per-user cost and the steady-state tooling run rate.
- Use the number of open practices, not the number of controls you feel good about.
- Get a written quote for the assessment fee rather than guessing.
- Keep contingency at 10 to 20 percent for a first attempt.
The method behind the numbers
The model is a simple bottom-up sum: internal labor equals gaps times hours times rate; tooling equals CUI users times annual cost per user; consulting equals days times day rate; then the assessment fee is added and contingency applied to the subtotal. The chart sweeps the CUI user count while holding everything else constant, which shows why a smaller boundary lowers per-user and total cost, although labor and fees do not shrink in proportion.
Reading the result and common mistakes
The steady-state run rate only covers subscriptions. Ongoing evidence collection, log review, access reviews and annual affirmation take real staff time that you should budget on top. The biggest mistake is scoping the whole company as CUI when an enclave could cover thirty people. Another is underestimating documentation: a system security plan and policies take effort even when the technical control already exists.
- Compare this result with the enclave versus enterprise scope calculator on this site.
- Revisit the estimate after each remediation sprint as the gap count falls.
Frequently Asked Questions
Does CMMC Level 2 equal NIST SP 800-171?
Level 2 aligns to the 110 security requirements in NIST SP 800-171. Whether you need a self-assessment or a third-party assessment depends on the contract and the type of information handled, so check your contract clauses and the current CMMC program rule.
Why is scope so important to cost?
Every user, device and system inside the CUI boundary must meet the practices. Shrinking the boundary with an enclave reduces tooling, evidence and audit effort, though it adds the cost of building and running the enclave.
Are the default values realistic?
They are illustrative mid-range placeholders, not quotes. Replace every default with figures from your own staff costs, tool vendors and assessor quotes before using the result in a business case.
Does this include ongoing compliance?
Only tooling run rate is included. Add staff time for monitoring, access reviews, incident response testing and annual affirmations to get a full steady-state cost.
If your ERP holds drawings, specifications or purchase data that count as CUI, we can help you design an on-prem approach so the data stays inside your boundary. Ask for an architecture review.
Related Tools
CUI Enclave vs Enterprise Scope Cost Calculator
Model whether a dedicated CUI enclave is cheaper than bringing every user into scope, with a break-even CUI headcount and a what-if chart.
Aerospace & DefenseNIST 800-171 Audit Log Storage Sizing Calculator
Estimate gigabytes per day, online searchable storage and compressed archive storage for the audit logs your CUI environment must produce and keep.
Compliance & ContractsExport Compliance Program ROI Calculator
Compare program cost with the expected annual loss avoided, then see payback and multi-year net benefit as the effectiveness of controls changes.
Compliance & ContractsPlan of Action and Milestones (POA&M) Template
Fill in a security requirement gap and get a formatted POA&M document with weakness, risk, resources, milestones and sign-off lines.
More Aerospace & Defense tools
See all- DPAS Rated Order Acceptance Deadline Calculator
- Export License Delay Schedule Risk Calculator
- DFARS Flowdown Subcontractor Risk Tracker
- CMMC 2.0 Level 2 Readiness Assessment
- ITAR Compliance Checklist for Manufacturers
- DFARS 252.204-7012 Compliance Self-Assessment
- AS9100 Audit Readiness Checklist
- Export Control Screening Checklist
- Defense Contractor AI Readiness Assessment