CMMC 2.0 Level 3

Why does it matter?

Level 3 applies only where a contract selects it, and it adds threat-informed requirements on top of all 110 Level 2 requirements. It is scored at one point per requirement, a Conditional status needs 80 percent, and seven requirements can never sit on a plan of action (32 CFR 170.21(a)(3) and 170.24(c)(3)).

Key benefits include:

• Advanced persistent threat focus

The 24 requirements add a security operations center that runs 24/7, an incident response team deployable within 24 hours, threat hunting and threat-informed risk assessment (IR.L3-3.6.1e, IR.L3-3.6.2e, RA.L3-3.11.2e, RA.L3-3.11.1e).

• Government-performed assessment

DCMA DIBCAC, not a commercial C3PAO, assesses Level 3 and issues the Certificate of CMMC Status (170.7, 170.18).

• Level 2 as the foundation

A Final Level 2 (C3PAO) status for the same scope comes first, open Level 2 plan-of-action items must be closed, and Level 3 scoring assumes every Level 2 requirement is already MET (170.18(a), 170.19(e), 170.24(c)(3)).

• Re-evaluation and appeal

A NOT MET requirement can be re-evaluated for 10 business days after the active assessment if new evidence exists, and an outcome can be appealed to DCMA DIBCAC within 21 days (170.18(c)(2), 170.7(b)).

• Supply chain assurance

Subcontractors that handle CUI under a Level 3 prime contract need at least Level 2 (C3PAO), and RA.L3-3.11.6e and RA.L3-3.11.7e require supply chain risk response and a plan updated at least annually (170.23).

How does it work?

Level 3 is built on NIST SP 800-172 and assessed with NIST SP 800-172A (March 2022) alongside SP 800-171A. DoD selected 24 enhanced requirements and set organization-defined parameters for them, listed in table 1 to 32 CFR 170.14(c)(4). They fall in ten domains: AC, AT, CM, IA, IR, PS, RA, CA, SC and SI, with seven of the 24 in Risk Assessment.

The organization first holds a Final Level 2 (C3PAO) status, then emails DCMA DIBCAC with its Level 2 assessment identifier. DIBCAC validates the status, schedules the assessment, performs limited checks of Level 2 requirements where asset categories changed, and delivers a CMMC Assessment Findings Report. A failed Level 2 check can pause, hold or end the Level 3 assessment (170.18(c)).

A Conditional Level 3 (DIBCAC) status needs at least 80 percent of the 24 requirements MET and a plan of action that excludes seven named requirements, among them the security operations center, the incident response team and the supply chain risk plan. DIBCAC performs the closeout within 180 days. The status lasts three years, and a new Level 2 (C3PAO) assessment is also needed every three years (170.18, 170.21(a)(3)).

Key Elements

• 24 selected requirements

Identifiers take the form DD.L3-3.x.xe, for example AC.L3-3.1.2e, which restricts access to resources the organization owns, provisions or issues, and SI.L3-3.14.1e, which verifies software integrity by root of trust or cryptographic signatures. Seven of the 24 sit in the RA domain (170.14(c)(4)).

• Operational readiness

IR.L3-3.6.1e requires a security operations center capability that operates 24/7, with allowance for remote or on-call staff. IR.L3-3.6.2e requires a cyber incident response team that can be deployed within 24 hours. Neither can be placed on a plan of action (170.14(c)(4), 170.21(a)(3)).

• Threat-driven risk and testing

Organizations use threat intelligence in risk assessment (RA.L3-3.11.1e), hunt threats on an ongoing aperiodic basis (RA.L3-3.11.2e), assess security solutions at least annually (RA.L3-3.11.5e) and run penetration testing at least annually or after significant changes (CA.L3-3.12.1e).

• Supply chain and specialized assets

RA.L3-3.11.6e and RA.L3-3.11.7e require supply chain risk response and a plan updated at least annually. SI.L3-3.14.3e requires IoT, IIoT, OT, government furnished equipment, restricted systems and test equipment to be in scope or segregated in purpose-specific networks.

• Scope and cloud inheritance

Level 3 scope covers CUI Assets, including assets that can but are not meant to handle CUI, and Security Protection Assets. If a cloud service provider supplies a requirement, the organization shows it through a Customer Implementation Summary or Customer Responsibility Matrix and a body of evidence (170.19(d), 170.18(c)).

• Records and affirmation

The organization keeps hashed evidence artifacts for six years from the CMMC Status Date. It affirms both Level 3 (DIBCAC) and Level 2 (C3PAO) every year, because C3PAOs and DIBCAC check different requirements (170.18(c)(4), 170.22(b)(4)).

What does it cover?

Level 3 applies where a DoD contract names Level 3 (DIBCAC) for information systems that process, store or transmit CUI. Part 170 leaves the choice of level to the DoD program manager for each procurement (170.3(d)), allowing Level 3 at DoD's discretion in Phase 2 and intending it for all applicable solicitations in Phase 3 (170.3(e)). The Level 3 scope must equal or be a subset of the Final Level 2 (C3PAO) scope (170.18(c)(1)).

What are its objectives?

Level 3 asks a contractor that already meets Level 2 to defend CUI against advanced persistent threats and to prove it to the Government.

Hold a Final Level 2 (C3PAO) status for the Level 3 scope before requesting an assessment, with Level 2 plan-of-action items closed.

Meet all 24 selected NIST SP 800-172 requirements, or hold a Conditional status with a compliant plan of action and milestones.

Keep the System Security Plan current with the rationale and risk determination for each selected security solution (RA.L3-3.11.4e).

Close any plan of action within 180 days in a closeout assessment by DCMA DIBCAC.

Reassess Level 3 and Level 2 every three years and affirm both every year.

Retain hashed evidence artifacts for six years from the CMMC Status Date.

Framework in Context

Level 3 sits above Levels 1 and 2 and does not replace them: a Level 3 (DIBCAC) status also satisfies Levels 1 and 2 for the same scope, and DFARS 252.204-7021 lists it as one of seven possible statuses. The enhanced requirements come from NIST SP 800-172, the supplement to SP 800-171, which the rule incorporates in its February 2021 edition (170.2). FedRAMP is separate: it governs cloud service providers that hold CUI (170.19(d)(2)).

Common Framework Mappings

Level 3 builds on NIST SP 800-171 Rev. 2 through CMMC Level 2 and on NIST SP 800-172 for its 24 requirements, and sits above CMMC Level 1 and CMMC Level 2. Organizations also map it to NIST SP 800-53 and NIST SP 800-161 for supply chain risk, ISO/IEC 27001, the NIST Cybersecurity Framework and the CIS Critical Security Controls to reuse evidence.

Mapped frameworks include:

CIS Controls v8.1

CMMC 2.0

CMMC 2.0 L2

ISO 27001:2022

NIST CSF 2.0

NIST SP 800-161 Rev.1

NIST 800-171 Rev.2

NIST 800-53 Rev.5