CMMC Level 2 Readiness Checker

CMMC Level 1 covers 17 basic cyber hygiene practices and allows self-assessment. CMMC Level 2 requires all 110 security controls from NIST SP 800-171 across 14 control families, with a mandatory third-party C3PAO assessment. Level 2 applies to organizations handling Controlled Unclassified Information (CUI).

Most organizations need 6 to 18 months. Companies scoring above 75% on this readiness tool typically need 3 to 6 months. Below 50%? Plan for 12 to 18 months to implement controls, build documentation, and establish evidence collection.

Total three-year costs range from $150,000 to $400,000. The C3PAO assessment runs $105,000–$118,000 over three years, remediation $35,000–$115,000, and ongoing maintenance $20,000–$50,000 annually.

A C3PAO (Certified Third Party Assessment Organization) is authorized by the Cyber AB to conduct official CMMC Level 2 assessments. Find authorized C3PAOs at cyberab.org. The organization that helps you prepare cannot also certify you.

If your MSP processes, stores, or transmits CUI, they’re part of your CUI boundary and their systems fall within your assessment scope. Working with an MSP that understands CMMC — like On-Site Technology — simplifies your compliance path significantly.

No. This is a preliminary self-assessment to understand your readiness and prioritize remediation. Official certification requires an authorized C3PAO. However, this tool covers the same 14 control families and is an effective starting point.

Phase 2 takes effect November 2026, making C3PAO assessment mandatory for Level 2 contracts. Many primes are already requiring subcontractor compliance. Given limited C3PAO availability, start preparation now.