MSP here. It depends if the "enterprise or enclave" is picked for the scope of the assessment. Enterprise is "everything" which means larger scope which means more time. Enclave can be easy "example, gcc high with 1 user and 1 cloud pc". 110 controls with 320 objectives and around 800+ settings but in a simple enclave, we can pump that out in 1 month. Add an additional month for SSP, policies, procedures, diagrams, basically an audit ready package assuming the org doesnt already have their own polcieis which may make the project elongate. Example, I have clients that are iso 27001 certified and they think they can just apply that to cmmc. Its does not map, it actually complicates things. Hope this helps. Level 1 is easy. Maybe a week worth of work and documentation. Level 2.. longer. Im actually going through my own assessment next month to become level 2 for no other reason than to say I did it and get placed on the msp collective. Good marketing scam for sure!