Free CMMC tool · rough planning ranges
Estimate an illustrative CMMC level and readiness, assessment, upkeep, and first-year planning ranges from company size, FCI or CUI, and current maturity.
Planning ranges — not a quote
The model scales illustrative readiness, assessment, and annual upkeep ranges by employee count and current maturity. For a C3PAO scenario, the first-year planning range annualizes the assessment cost across its three-year cycle before adding readiness and upkeep.
FCI-only work maps to Level 1 and CUI maps to Level 2. A Level 2 solicitation can require either self-assessment or C3PAO certification; this calculator displays the more involved C3PAO cost scenario. Level 3 applies only when designated by DoD and cannot be self-selected from these inputs.
All figures are rough planning estimates and ranges, not quotes. Actual cost depends on systems, existing controls, assessment scope, chosen providers, and the contract's required assessment type. Level 3 is government-designated, not self-selected. Verify current CMMC requirements and pricing before budgeting.
Open the source material and verify the requirements or values that apply to your situation.
Questions to verify
No. They are broad illustrative planning ranges. Scope, systems, evidence maturity, provider choices, and the assessment organization can materially change actual cost.
No. The solicitation determines whether Level 2 uses self-assessment or C3PAO certification. The calculator shows a C3PAO scenario so the larger planning exposure is visible.
No. Level 3 is designated by DoD for selected programs and follows a final Level 2 C3PAO status; it is not inferred from company size or maturity.
Longlead flags which upcoming DoD projects will trigger CMMC requirements 12–24 months early.
See Longlead Cyber