What Is CMMC Level 3? Requirements and Who Assesses It
By Shaheer Malik · Updated Oct 28, 2026
CMMC Level 3 is for CUI on DoD’s highest-priority programs. It adds 24 requirements selected from NIST SP 800-172 to the 110 of Level 2. Only the government’s Defense Contract Management Agency DIBCAC can assess it, every three years, and you must already hold a Final Level 2 (C3PAO) status for the same scope.[1]
Who can conduct a Level 3 assessment?
Only DCMA DIBCAC. The rule assigns its assessors to “conduct Level 3 certification assessments” and “issue Certificates of CMMC Status resulting from Level 3 certification assessments.”[1] C3PAOs do not assess Level 3.
Prerequisite
A Final Level 2 (C3PAO) status for the systems in the Level 3 scope is a prerequisite, and recertifying at Level 3 needs a new Level 2 assessment too. A Level 3 (DIBCAC) status also satisfies Level 1 (Self), Level 2 (Self) and Level 2 (C3PAO) for the same scope.[1] You must affirm both your Level 2 (C3PAO) and Level 3 statuses every year.[1]
The 24 requirements
They fall in ten domains and cover areas such as:[1][2]
- A security operations center that operates 24/7 (IR.L3-3.6.1e) and an incident response team deployable within 24 hours (IR.L3-3.6.2e).
- Threat-informed risk assessment, threat hunting and supply chain risk plans (RA.L3-3.11.1e to 3.11.7e).
- Automated detection of misconfigured or unauthorized components and an authoritative inventory (CM.L3-3.4.1e to 3.4.3e).
- Practical, role-based awareness training at least annually (AT.L3-3.2.1e, 3.2.2e).
Conditional status at Level 3
A Conditional Level 3 status needs at least 80 percent, and some requirements can never be on the POA&M, including the security operations center, the incident response team and the supply chain risk plan.[1]
When it applies
The 2024 rule let DoD start adding Level 3 requirements in Phase 2, at its discretion, and planned them for all applicable contracts from Phase 3.[1] The September 3, 2026 class deviation suspended the Phase 2 transition, so that timetable is on hold while the suspension lasts.[3]
Compare CMMC consultants (RPOs) and C3PAOs by state, or describe your project once and we send it to up to 3 matching firms.
FAQ
Who can conduct a CMMC Level 3 assessment?
Only DCMA DIBCAC, the Defense Contract Management Agency’s Defense Industrial Base Cybersecurity Assessment Center. C3PAOs assess Level 2 only.
How many requirements are in CMMC Level 3?
All 110 Level 2 requirements plus 24 selected from NIST SP 800-172, 134 in total.
Do I need Level 2 before Level 3?
Yes. A Final Level 2 (C3PAO) status for the same assessment scope is a prerequisite for a Level 3 certification assessment.
Sources
- 32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
- NIST SP 800-172: Enhanced Security Requirements for Protecting CUI (checked Oct 28, 2026)
- Class Deviation 2026-O0025, Revision 3: FAR Overhaul Part 40, DFARS Part 240 (Sep 3, 2026) (checked Oct 28, 2026)
More on levels and requirements
- CMMC Level 1 Self-Assessment: Requirements and Steps
- CMMC Level 2 Self-Assessment vs C3PAO Certification
- CMMC Levels and Controls: How Many Each Level Has
- CMMC Level 1 Requirements: All 15 Controls Listed
- What Is CMMC Level 2? Requirements, Self vs C3PAO
- Which CMMC Level Do I Need? A Quick Way to Decide
Get quotes from matching firms
Describe what you need once. It goes to up to 3 matching firms, never published or sold.
Request quotesIndependent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.