---
title: "CMMC readiness"
description: "Level 1 and Level 2: system boundary, requirements, your SPRS score and support at the assessment. Level 1 — $3,360 one-off, Level 2 — from $15,300."
locale: en
canonical: https://finleadgen.com/en/services/cmmc
source: https://finleadgen.com/en/services/cmmc.md
price_reviewed: 2026-08-06
---

# CMMC readiness

The defence contract stays yours.

**Level 1 — $3,360 one-time · Level 2 — from $15,300.**

## Your contract has a DFARS clause. Who is meeting it?

So far, nobody — and until renewal that changed nothing. Now a bid without a confirmed level is not even taken up for review. The requirement sits in the terms of the solicitation, not in anyone's goodwill, and no talk with the buyer will lift it.

## The narrower the system boundary, the cheaper

First we narrow the boundary: we look at which systems touch the customer's information at all, and cut out everything that does not. The fewer systems inside, the fewer requirements, and the cheaper the whole programme.

Level 1 follows the rule word for word: fifteen requirements, the paperwork written up, the self-assessment filed, and a signing officer whom we walk right up to the signature. The scope is the same for everyone, so the price is known up front, not after the work.

Level 2 means one hundred and ten requirements, a separate place for the customer's information, a plan of work and a score in the government register. At the assessment we sit beside you.

## What the programme includes

| What | State | Price |
| --- | --- | --- |
| System boundary: which systems touch the customer's information | included |  |
| What is missing against your level's requirements, and the plan | included |  |
| Written policies, procedures and finished paperwork | included |  |
| Working out your score and uploading it to the SPRS register | included |  |
| Preparing and filing the self-assessment, guiding the signing officer | included |  |
| Support at the assessment and answers to the assessor | included |  |
| The annual affirmation and an eye kept on the systems | included |  |
| The independent C3PAO assessor's fee and licences — billed at cost | paid to the vendor |  |

## Your price

| Plan | Price | Note |
| --- | --- | --- |
| Level 1 | $3,360 one-off | Thirty hours: the fifteen requirements of the rule. |
| Level 2 | from $15,300 for the readiness work | One hundred and ten requirements and a score in the register. |
**Level 1**
- The boundary, fifteen requirements, the self-assessment and the signing officer
- Renewing the affirmation — $895 a year
**Level 2**
- What is missing of the hundred and ten requirements, and a separate place
- A plan of work, the SPRS score and support at the C3PAO assessment
- An eye kept on the systems — $1,230 a month

## Extras

| What | State | Price |
| --- | --- | --- |
| An external pen test for the assessor's requirement | not included | from $4,480 |
| We watch for attacks around the clock | not included | $18 per endpoint a month |
| Fractional chief information security officer | not included | from $2,500 a month |
| SOC 2 readiness and keeping Type 2 | not included | from $2,250 |
| Questionnaires your client has sent | not included | $1,350 per questionnaire |
| If you are breached, we investigate — monthly | not included | $670 a month |
| Backups and a check that they actually restore | not included | $1,340 per site |
| Preparing for a cyber policy renewal | not included | $2,250 one-off |

### Which level do we actually need?

Look at the contract: it names the clause and the kind of information. If it is only information about the contract itself — Level 1. If protected customer information appears — Level 2. We read the contract before we invoice.

### Do you do Level 3?

We take it on, but we do not quote straight away. At the third level the assessment is run by a government body, not a commercial assessor, and the volume of work depends entirely on the system boundary. First we set the boundary, then we count.

### How long until we are ready for the assessment?

Level 1 is a matter of weeks, because the rule spells out the requirements word for word. Level 2 is measured in quarters and hangs on one thing — how narrow we managed to make the system boundary at the first step.

### Do we lose the contract if we are late?

Yes. A bid without a confirmed level is not taken up for review — that is a condition of the solicitation, not our opinion. So we plan the work backwards from the submission date, and you get the first plan of work before you pay, not after.

## Where to send the quote

Tell us the clause from your contract and the bid date — we will send the quote and the plan by email.