Free tool · Updated 6 October 2026
In short: Free CMMC Level 2 gap analysis: 25 questions across the 14 NIST SP 800-171 families, a readiness score, the families you would fail and what fixes each one with a fixed-fee price. Before you pay a C3PAO.
The CMMC Phase 2 rollout was suspended on 13 July 2026 and Class Deviation 2026-O0025 Revision 3 of 3 September 2026 extended Phase 1, which means Level 2 self-assessments and SPRS scores still decide awards while C3PAO slots stay scarce. The median modeled year-one cost of Level 2 for a 25-user CUI enclave is about $90,000 with a range of $67,000 to $115,000; the tool shows which of those dollars you actually need.
How it works
- Answer 25 questions: One or two per family, chosen from the requirements that cost the most SPRS points and fail most often. About five minutes.
- See your score: A readiness percentage, a bar per family and the three families you would fail today, free and without an email.
- Unlock the plan: The full table: fix per gap, the ITSECOPS fixed-fee price, the typical US consultancy price, one-off and monthly totals, and a copy by email within one business day.
Frequently asked questions
How much does CMMC Level 2 cost with ITSECOPS?
Published fixed fees: gap assessment and scoping $5,000 to $15,000, implementation $15,000 to $40,000, SSP, POA&M and evidence $8,000 to $20,000, continuous compliance $1,500 to $5,000 per month, typically 30 to 50 percent below US-only consultancies. The tool allocates those fees to the families you fail so the estimate matches your gaps, not a package.
Is this an SPRS score?
No. Use the SPRS score calculator for the official DoD Assessment Methodology score (-203 to 110). This tool measures readiness per family and prices the remediation.
Where is the enclave line from?
A CUI enclave on Microsoft 365 GCC High or an enclave product is the single biggest one-off item for most contractors; the range follows the ITSECOPS CMMC cost model and the market figures on the CMMC cost page.
Can ITSECOPS certify us?
No. ITSECOPS is a readiness consultancy, not a C3PAO. We prepare the SSP, POA&M and evidence, run the recurring activities and support you through the C3PAO assessment.
Related
SPRS score calculator · CMMC cost model 2026 · The 37 recurring Level 2 activities · CMMC consultants, fixed fees · Client testimonials