The published numbers, and the line they exclude.

The published figures

For a small entity the rule models a Level 1 self-assessment at $5,977 a year, a Level 2 self-assessment at $34,277, and a Level 2 certification assessment by a Certified Third-Party Assessment Organization (C3PAO) at $101,752. For an other-than-small entity the Level 2 certification figure is $112,345. Inside those totals the assessor’s own fee is modelled at $31,234 and $52,056 respectively, derived from an assumed three-person, 120-hour team for a small entity at a blended $260.28 an hour.

Two qualifications matter more than the numbers. The rule states plainly that the estimates "do not include actual prices of C3PAO services available in the marketplace" and that supply and demand will set those. And the figures cover assessment and affirmation, not remediation — the engineering work of closing the gaps an assessment finds, which for most suppliers arriving at this without an existing programme is the largest line by a distance.

How it falls across years

A Level 2 certification assessment is valid for three years, with an affirmation at the time of assessment and annually after it. So the shape is one heavy year and two light ones, repeating. The trap is treating the light years as free: the evidence that supports the affirmation has to keep being produced, and a supplier who lets it lapse pays for the heavy year twice.

The lever that actually moves the number

Scoping. Every figure above scales with how many systems are in the boundary. Money spent early on narrowing where Controlled Unclassified Information is allowed to go reduces assessment cost, remediation cost and the standing evidence burden at the same time. It is the only decision in this programme that reduces all three.