How long does a CMMC gap assessment take?

For a typical small or mid-sized Ohio manufacturer, scoping and assessment take a few weeks, driven mostly by how quickly evidence and interviews can be scheduled. Multi-site or OT-heavy environments take longer.

Is a gap assessment the same as a CMMC certification?

No. A gap assessment is a readiness exercise. Certification at Level 2 (C3PAO) is performed only by an authorized C3PAO, and a C3PAO cannot assess a company it consulted for within the previous three years.

Do I need a gap assessment if CMMC Phase 2 is paused?

Yes if you handle CUI. DFARS 252.204-7012 already requires NIST SP 800-171, and DFARS 252.204-7019 requires a current self-assessment score in SPRS. A gap assessment is how you make that score accurate.

What do I get at the end?

A scored gap report against all 110 requirements, a CUI scoping decision, a prioritized remediation roadmap, and the starting point for your SSP and POA&M.

CMMC Resource

CMMC Gap Assessment for Ohio Companies: Cost and Process

Q: How much does a CMMC gap assessment cost?

Pricing depends on scope: users, locations, OT in scope, and existing documentation. For reference, DoD's own model estimates about $14,426 for a small business to plan and prepare for a Level 2 self-assessment and about $20,699 to plan and prepare for a Level 2 C3PAO certification, excluding remediation. TRNSFRM offers a free 45-minute gap audit to scope the work before you commit to anything.

Short answer

A CMMC gap assessment compares your current environment to the 15 FAR 52.204-21 requirements (Level 1) or the 110 NIST SP 800-171 requirements (Level 2) and produces a scored gap list, a scoping decision, and a remediation plan. The DoD's own regulatory cost model, published with the CMMC final rule, estimates that a small business spends about $14,426 just to plan and prepare for a Level 2 self-assessment and about $20,699 to plan and prepare for a Level 2 C3PAO certification, before any remediation. Ohio manufacturers usually start with a scoped gap assessment so that remediation money goes to the controls that actually affect their SPRS score.

What the DoD estimates CMMC assessments cost

DoD estimates per assessment for a small entity, from the CMMC Program final rule, 32 CFR Part 170 (89 FR 83092, Oct 15, 2024). Figures exclude the cost of implementing the controls.
Assessment	Plan and prepare	Conduct	Report	Affirmations	Total
Level 1 self-assessment (annual)	$1,803	$2,705	$909	$560	$5,977
Level 2 self-assessment (every 3 years)	$14,426	$15,542	$2,851	$4,377	$37,196
Level 2 C3PAO certification (every 3 years)	$20,699	$76,743	$2,851	$4,377	$104,670

DoD built these numbers assuming outside consulting help at $260.28 per hour. They cover assessment activity only. Closing gaps (MFA, logging, FIPS-validated encryption, a CUI enclave or GCC High, policies and training) is a separate budget, and it is usually the larger one. Our CMMC certification cost guide breaks those remediation categories down.

How a CMMC gap assessment works

Scope the CUI. Identify where Controlled Unclassified Information and Federal Contract Information enter, live and leave: email, file shares, ERP and MES, CAD and CAM workstations, shop floor PCs, and cloud apps. DoD's Level 2 Scoping Guide sorts assets into CUI assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets (such as OT and test equipment), and out-of-scope assets.
Assess every requirement. Each of the 110 NIST SP 800-171 requirements is tested against its assessment objectives in NIST SP 800-171A (320 objectives in total), with evidence, not just interviews.
Score it the way DoD will. The DoD Assessment Methodology starts at 110 and subtracts weighted points for each unmet requirement, so a score can fall as low as negative 203. That score is what you post in SPRS.
Check POA&M eligibility. Under 32 CFR 170.21 a conditional Level 2 status requires a score of at least 80 percent (88 of 110), only certain lower-weighted requirements may sit on a POA&M, and open items must be closed within 180 days.
Deliver the plan. You get a prioritized remediation roadmap, a draft System Security Plan outline, and a POA&M you can actually work.

What drives the cost for an Ohio company

Number of locations and whether CUI touches more than one plant
Whether shop floor OT, CNC or test equipment is in scope
ITAR or export-controlled data, which usually points to Microsoft GCC High or an enclave
How much documentation already exists (SSP, policies, network diagrams)
Whether you are targeting Level 2 self-assessment or a C3PAO certification

Where CMMC stands right now

Phase 2 third-party certifications were paused in July 2026, but DFARS 252.204-7012, NIST SP 800-171, SPRS scoring and False Claims Act exposure did not pause. A gap assessment now gives you an accurate SPRS score and a remediation plan before certification requirements return.

How TRNSFRM helps

TRNSFRM runs CMMC gap assessments for Ohio manufacturers and defense suppliers from our North Royalton headquarters and Columbus-area presence, then helps close the gaps as your managed IT and security provider. We are not a C3PAO and do not perform certification assessments; we prepare you for one. Start with a free 45-minute CMMC gap audit.

Book a free CMMC gap audit

Or call (877) 777-6855

Frequently Asked Questions

CMMC Certification Cost

Real budgets compared with DoD estimates.

CMMC Level 2 Guide

The 110 requirements and how the assessment runs.

CMMC Compliance Services

Gap assessment, remediation and readiness.

Manufacturer's Guide to NIST 800-171

Implementation guide for manufacturers.

CMMC for Columbus Manufacturers

CMMC planning for Central Ohio.

How to Choose a CMMC Consultant in Ohio

RPO vs C3PAO vs MSP.

Free Ohio CMMC Gap Audit

A free 45-minute readiness gap audit.