CMMC Level 3 Requirements

CMMC Level 3 is the top tier of the program, reserved for contractors whose CUI supports the Department’s highest-priority programs. It keeps every Level 2 requirement and adds 24 enhanced requirements selected from NIST SP 800-172, aimed at advanced persistent threats. The assessment is performed by the government itself, through DCMA’s DIBCAC, and only after the organization already holds a Final Level 2 certification from a C3PAO.

For almost every defense contractor, the honest answer to “do we need Level 3?” is no. It is assigned program by program, and a contractor finds out from the solicitation, not from its own risk assessment.

Level 3 at a glance

• Information: CUI on programs the DoD designates as needing enhanced protection.
• Requirements: all 110 NIST SP 800-171 Rev 2 requirements, plus 24 selected from NIST SP 800-172 with DoD-defined parameters.
• Prerequisite: a Final Level 2 (C3PAO) certification covering the same scope.
• Assessor: DCMA DIBCAC, a government team, not a commercial C3PAO.
• Cadence: assessment every three years, with an annual affirmation of continuing compliance.
• Defined in: 32 CFR Part 170, the CMMC program rule.

What the enhanced requirements cover

NIST SP 800-172 assumes a well-resourced adversary that may already be inside the network. The selected requirements therefore shift the emphasis from keeping attackers out to detecting, containing and recovering from them. Examples include:

• A security operations capability that monitors around the clock and an incident response team that can deploy quickly.
• Threat hunting and threat-informed risk assessment, rather than relying only on alerts.
• Penetration testing on a defined schedule, using automated tools and human testers.
• Automated inventory and configuration checks that find unauthorized or misconfigured components.
• Bidirectional authentication between systems and blocking of untrusted or unknown assets.
• Supply chain risk management, with a documented plan and a way to respond to supplier risk.
• Isolation of critical system components and protection of specialized assets such as OT and IoT.
• Advanced awareness training including practical exercises based on current threats.

These are operational capabilities, not documents. A Level 3 environment needs people and tooling running continuously, which is why the population is small.

How Level 3 differs from Level 2

Level 2 asks whether 110 safeguarding requirements are implemented and evidenced at objective level. Level 3 asks whether the organization can withstand and respond to a determined attacker. The step between them is less about adding controls and more about maturity: continuous monitoring, an internal or contracted SOC, tested response, and a security team that can show its work.

The assessment model also changes. A Level 2 certification is performed by a C3PAO; Level 3 brings a government assessment team into your environment, on top of the Level 2 certificate you already hold. Details of the Level 2 baseline are on CMMC Level 2 requirements, and the C3PAO step is covered in how a C3PAO assessment works.

Common misconceptions

• “Aerospace companies need Level 3.” Industry does not set the level. Most aerospace suppliers hold CUI that sits at Level 2.
• “Level 3 replaces Level 2.” It adds to it. The 110 Level 2 requirements stay in force and must already be certified.
• “A C3PAO can assess us for Level 3.” It cannot. The C3PAO certifies Level 2; the Level 3 assessment is performed by DIBCAC.
• “We should build to Level 3 to be safe.” Building continuous SOC, threat hunting and penetration testing you are not required to hold is expensive, and it does not raise a Level 2 score. Spend that budget on closing Level 2 gaps first.

Where Level 3 stands in 2026

Level 3 was scheduled to reach contracts in a later rollout phase than Level 2 third-party assessments. With Phase 2 suspended in July 2026, Level 3 sits further out still. Nothing about the requirements has been withdrawn, but the date a contractor might first see Level 3 in a solicitation is uncertain. Check CMMC program status for the current position.

How to prepare if a program may need it

1. Confirm the requirement. Ask the program office or prime which contracts are expected to carry Level 3 and which systems they would cover.
2. Make Level 2 boring. A clean scope, a current SSP, closed POA&M items and evidence mapped to every objective. Level 3 builds on that foundation and cannot repair it.
3. Keep the scope small. An enclave makes 24 continuous, operational requirements far more achievable than applying them company-wide.
4. Decide how you will staff monitoring and response. Most organizations at this level use a dedicated SOC, in-house or through a provider whose own scope is understood.

If you are unsure whether you sit at Level 1, 2 or 3, start with the clause-by-clause test, or have a CMMC readiness assessment establish it from your contracts.