Written and maintained by CASRAI Editorial Board
Last updated
CMMC Level 3 is the highest status in the Cybersecurity Maturity Model Certification program. It is a certification assessment performed by the Defense Contract Management Agency’s DIBCAC (not by a commercial assessor), it can only be started after the organization already holds a Final Level 2 (C3PAO) status, and it tests 24 enhanced requirements selected from NIST SP 800-172. This guide summarizes the rule in 32 CFR part 170 as published in the eCFR (text current as of 2026-10-01, checked 2026-10-29).
What CMMC Level 3 is and who runs it
Under 32 CFR 170.18, the Level 3 certification assessment is performed by DCMA DIBCAC “on behalf of the DoD.” A passing result earns a CMMC Status of Conditional or Final Level 3 (DIBCAC). DIBCAC uploads the results to the CMMC instantiation of eMASS, which transmits them automatically to SPRS. Results reach the organization through a CMMC Assessment Findings Report.
Level 3 adds to Level 2 rather than replacing it. Level 2 is identical to NIST SP 800-171 Revision 2 in the rule’s 170.14(c)(3); Level 3 requirements are “selected from NIST SP 800-172 Feb2021,” and assessment follows NIST SP 800-172A (March 2022) together with NIST SP 800-171A (June 2018). For the Level 2 baseline itself, see CMMC Level 2 assessment.
Eligibility: Final Level 2 (C3PAO) comes first
The rule makes a Final Level 2 (C3PAO) status for the systems in the Level 3 scope a prerequisite. The Level 3 CMMC Assessment Scope must be equal to, or a subset of, the scope of that Level 2 (C3PAO) certification. A contractor therefore cannot go straight to Level 3 from a self-assessment.
Separately, 170.18(b) says that before award of any contract or subcontract that carries a Level 3 (DIBCAC) requirement, the organization must hold a Conditional or Final Level 3 (DIBCAC) status and must have submitted an affirmation of compliance into SPRS. Which solicitations carry a Level 3 requirement is set by the contract, not by 170.18. Scoping terms are covered in the CMMC scoping guide.
What Level 3 requires: the 24 enhanced requirements
Table 1 to 170.14(c)(4) lists 24 security requirements, each carrying a CMMC identifier of the form family.L3-number followed by “e.” To earn Final Level 3, the organization needs a MET result on every one of them. The table below groups them by family and paraphrases the rule’s wording.
| Family | Requirement IDs | What the rule requires (paraphrased) |
|---|---|---|
| Access Control (AC) | 3.1.2e, 3.1.3e | Restrict access to organization-owned or issued resources; use secure transfer solutions between security domains |
| Awareness and Training (AT) | 3.2.1e, 3.2.2e | Threat-focused awareness training (at hire, after a significant cyber event, at least annually) with role-tailored practical exercises |
| Configuration Management (CM) | 3.4.1e, 3.4.2e, 3.4.3e | Authoritative source of approved components; automated detection of misconfigured or unauthorized components; automated inventory discovery |
| Identification and Authentication (IA) | 3.5.1e, 3.5.3e | Cryptographic, replay-resistant bidirectional authentication of systems; block components that are not known, authenticated and properly configured |
| Incident Response (IR) | 3.6.1e, 3.6.2e | A security operations center capability operating 24/7 (remote or on-call staff allowed); an incident response team deployable within 24 hours |
| Personnel Security (PS) | 3.9.2e | Protect systems if adverse information develops about individuals with access to CUI |
| Risk Assessment (RA) | 3.11.1e to 3.11.7e | Threat intelligence in risk assessment; ongoing threat hunting; advanced automation and analytics; documenting chosen solutions and rationale in the SSP; annual effectiveness assessment; supply chain risk assessment and an annually updated supply chain risk plan |
| Security Assessment (CA) | 3.12.1e | Penetration testing at least annually or after significant security changes |
| System and Communications Protection (SC) | 3.13.4e | Physical or logical isolation techniques, or both |
| System and Information Integrity (SI) | 3.14.1e, 3.14.3e, 3.14.6e | Integrity verification of security-critical software with root of trust or signatures; specialized assets (IoT, IIoT, OT, GFE, test equipment) in scope or segregated; threat indicators guiding detection and hunting |
That is 2 + 2 + 3 + 2 + 2 + 1 + 7 + 1 + 1 + 3 = 24 rows. The Risk Assessment family carries seven of them, which is where Level 3 differs most from a Level 2 program built around policies and a system security plan: threat hunting, a 24/7 operations capability and a 24-hour response team are operational commitments.
Compliance steps
- Hold Final Level 2 (C3PAO) for the information systems you want in Level 3 scope.
- Request the assessment. Per 170.18(c)(1)(ii), the organization emails a request to the DCMA DIBCAC point of contact and includes the Level 2 certification assessment unique identifier. DIBCAC validates the Level 2 (C3PAO) status and then contacts the organization to schedule.
- Undergo the assessment. DIBCAC assesses against NIST SP 800-171A and 800-172A and scores under the CMMC scoring methodology in 170.24. For assets whose category changed between the Level 2 and Level 3 assessments, DIBCAC performs limited checks of Level 2 requirements; a NOT MET result there can pause, hold or end the Level 3 assessment.
- Receive a status. A passing score gives Final Level 3 (DIBCAC). A plan of action and milestones (POA&M) that meets the Level 3 conditions in 170.21(a)(3) gives Conditional Level 3 (DIBCAC).
- Affirm. Affirmation of the Level 3 status is required at the time of each assessment and annually afterward (procedures in 170.22).
Typical timeline phases
The rule sets intervals, not calendar dates. In order: the Level 2 (C3PAO) certification; the request to and scheduling by DIBCAC; the active assessment; then, for a NOT MET requirement, re-evaluation is allowed during the assessment and for 10 business days after the active assessment period, provided new evidence exists, it does not materially affect other assessed requirements, and the findings report has not been delivered. A Conditional status must be closed out by a DIBCAC POA&M closeout assessment within 180 days of its status date or it expires. Once Final, the Level 3 assessment repeats within three years of the status date, and the Level 2 (C3PAO) certification must also be redone every three years to keep Level 3. Affirmation recurs annually.
Common mistakes
- Scoping Level 3 wider than Level 2. The Level 3 scope must equal or be a subset of the Level 2 (C3PAO) scope.
- Letting the Level 2 certification lapse. The rule requires a Level 2 (C3PAO) assessment every three years for Level 3 status to be maintained, and recertification at Level 3 has its own prerequisite of a new Level 2 assessment.
- Treating a Conditional status as open-ended. It expires after 180 days without a successful closeout; if that happens during contract performance, standard contractual remedies apply and the organization is ineligible for further awards requiring Level 3 for that system until a new status is achieved.
- Forgetting that DoD can reassess. Under 170.18(a)(1)(iv) and 48 CFR 252.204-7020, a later DIBCAC assessment can take precedence over an existing status. See DFARS 252.204-7021 for the contract clause that ties status to awards.
- Assuming the newest NIST publication is the one in the rule. See the FAQ on NIST SP 800-172 versions.
Related programs
| Status | How it relates to Level 3 (per 32 CFR part 170) |
|---|---|
| Level 1 (Self) | Satisfied by a Level 3 (DIBCAC) status for the same assessment scope |
| Level 2 (Self) | Satisfied by a Level 3 (DIBCAC) status for the same assessment scope |
| Level 2 (C3PAO) | Required first; must be repeated every three years to maintain Level 3; also satisfied by a Level 3 status for the same scope |
| Level 3 (DIBCAC) | Conditional or Final; assessed by DCMA DIBCAC against the 24 enhanced requirements |
For how universities and research institutions meet these expectations, read CMMC compliance for universities and research institutions, NIST SP 800-171 for university CUI research and the SPRS score and self-assessment.
FAQ
Is CMMC Level 3 the same as NIST SP 800-172?
No. Level 3 uses 24 requirements selected from NIST SP 800-172 (February 2021) and layers them on the Level 2 baseline of NIST SP 800-171. Not every 800-172 requirement is in Table 1 to 170.14(c)(4).
Who performs a Level 3 assessment?
DCMA DIBCAC, on behalf of the DoD. Commercial C3PAOs perform the Level 2 certification assessments that come first.
How long does CMMC Level 3 certification last?
The Level 3 assessment must be repeated within three years of the status date (the Conditional status date, if a POA&M was used). Affirmation is due annually. A Conditional status expires if not closed out within 180 days.
Which version of NIST SP 800-172 does the rule use?
The eCFR text current as of 2026-10-01 cites NIST SP 800-172 Feb2021 and SP 800-172A Mar2022. NIST’s publication page, checked on 2026-10-29, shows SP 800-172 (February 2021) as withdrawn on May 13, 2026 and superseded by SP 800-172 Revision 3. The rule text current as of 2026-10-01 does not adopt Revision 3, so this guide describes assessments against the editions the rule cites.
Sources
- 32 CFR 170.18, CMMC Level 3 certification assessment and affirmation requirements, eCFR, checked 2026-10-29: https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-D/section-170.18
- 32 CFR 170.14, CMMC Model, including Table 1 to paragraph (c)(4), eCFR, checked 2026-10-29: https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-C/section-170.14
- NIST SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information, NIST CSRC, checked 2026-10-29: https://csrc.nist.gov/pubs/sp/800/172/final
