The four cost drivers
Every credible CMMC estimate comes back to the same four variables. Understanding them lets you interrogate any quote you receive, including ours.
- Level: Level 1 covers 15 requirements and self-assessment. Level 2 covers 110 controls plus, usually, a C3PAO assessment.
- Scope: an enclave holding CUI is far cheaper to secure than an entire corporate network. This is the single biggest lever.
- Existing baseline: modern identity, managed endpoints, and centralized logging reduce remediation dramatically. Legacy on-prem environments increase it.
- Assessment fee: at Level 2 the C3PAO bills separately from your implementation partner. Budget it as its own line item.
Why scoping is worth more than negotiating
Contractors tend to focus on the hourly rate of their implementation partner. That is rarely where the money is. The difference between applying 110 controls to 15 users in a defined enclave versus applying them to 120 users across an unsegmented network dwarfs any rate difference.
Time spent up front deciding where CUI is allowed to live is the highest-return work in the entire program. It is also the part that requires operational buy-in rather than just IT effort, which is why it gets skipped.
Costs contractors forget to budget
The implementation quote is not the whole program. These items surprise people at the worst possible time.
- Licensing changes, including GCC High migration where it is genuinely required
- The C3PAO assessment fee itself, plus potential re-assessment
- Ongoing managed services to keep controls in place between assessments
- Annual affirmations and the internal effort behind them
- Employee time — interviews, training, and evidence gathering are real hours
- Remediation of anything the assessment surfaces late
How we price it
We run the gap assessment first, at no cost, and give you a scoped range afterward. We would rather lose a deal on an honest number than win one on a number we have to revise in month three.
If your budget cannot support the scope you are in, we will tell you that during scoping — including when the right answer is to restructure how CUI flows through your business rather than to buy more security.