CMMCpedia
Work with me

Terms / Certification

Level 3

The 24 additional requirements from NIST SP 800-172, assessed by the Government. Final Level 2 (C3PAO) is a prerequisite for even starting.

Also called CMMC Level 3, Level 3 (DIBCAC).

Official Source Material

The OSC must achieve a CMMC Status of Final Level 2 (C3PAO) on the Level 3 CMMC Assessment Scope, as defined in § 170.19(d), prior to initiating a Level 3 certification assessment, which will be performed by DCMA DIBCAC (www.dcma.mil/DIBCAC) on behalf of the DoD.

Source: 32 CFR 170.18(a)(1), eCFR text current as of September 17, 2026

Practitioner Guidance

What it means in practice

Level 3 is rare, and you will know because the contract says so.

It applies to programs where the Department judges the threat to warrant more than Level 2. It adds 24 selected requirements from NIST SP 800-172 on top of the 110, and DCMA DIBCAC performs the assessment. Most small companies never see it. If your contract does not name it, this page is background.

You cannot start Level 3 without a Final Level 2 (C3PAO) status first.

The prerequisite is explicit, and it applies to recertification too. That means two assessment tracks running on three year cycles: a Level 2 certification assessment by a C3PAO and a Level 3 assessment by the Government. Plan the sequence before you commit to a schedule.

Your scoping shortcuts at Level 2 become expensive here.

In the Level 3 scope, contractor risk managed assets are treated as CUI assets. Assets you documented rather than assessed at Level 2 are assessed at Level 3. If a Level 3 requirement is anywhere on your horizon, scope with that in mind from the start.

A cloud service does not relieve you of the 24 requirements.

Section 170.18 says so directly. The requirements apply to every environment where the information is handled. Where you inherit protection from a provider, you demonstrate it through a responsibility matrix and a body of evidence that says clearly which side implements each requirement.

What falls short

  • A Level 3 plan without a Final Level 2 (C3PAO) status. The assessment cannot begin.
  • Inherited controls claimed without evidence. The rule asks you to demonstrate the protection during the assessment.
  • A Level 2 scope that relied heavily on the contractor risk managed category. Those assets convert, and the work arrives late.

Edge cases

  • You achieve Level 3 (DIBCAC). That also satisfies Level 1 (Self), Level 2 (Self), and Level 2 (C3PAO) for the same scope.
  • Your status is conditional. The closeout assessment is performed by the Government, and four Level 3 requirements may never appear on a POA&M.
  • A prime holds Level 3 and you supply it. Under 170.23 your requirement is Level 2 (C3PAO), not Level 3.

Over-engineering

  • Preparing for Level 3 on the chance a contract may require it. Build Level 2 properly, and scope so the conversion is possible.
  • Buying the enhanced requirements as a product. They describe advanced practices, and several are about people and process.