How the CMMC Level 3 DIBCAC assessment process works
A contractor told it needs CMMC Level 3 should first understand that DCMA DIBCAC performs the Level 3 certification assessment, and that Final Level 2 (C3PAO) status for the same scope is a prerequisite to starting one. Under 32 CFR 170.18, DIBCAC is the only body that issues the Level 3 result. The organization owns its controls and its system security plan. A partner can prepare systems, configure logging and tooling, and organize evidence, but neither that partner nor a C3PAO can issue the Level 3 outcome. Before anything else, confirm the Level 2 scope, the CAGE codes in that scope and whether the Level 2 certification is final, because a Level 3 request depends on all three.
To start, the contractor emails the DCMA DIBCAC point of contact listed at dcma.mil/DIBCAC after reaching Final Level 2 (C3PAO), and includes its Level 2 certification unique identifier. The Level 3 scope must equal or be a subset of the Level 2 scope, as in a Level 3 data enclave inside a Level 2 enclave (32 CFR 170.19(e)). Any Level 2 POA&M items must be closed before the Level 3 assessment begins. Several Level 3 requirements, including IR.L3-3.6.1e and RA.L3-3.11.7e, may not appear on a POA&M at all. Ask the sponsoring program office how DIBCAC will treat your enclave boundary before you finalize the SSP, since the scope decision drives assessment effort more than any other factor.
The outcome varies by scope, by how much a POA&M is used and by the current status of the Phase II rollout. The Department of War suspended Phase II on 13 July 2026, and its CMMC pages describe the program as paused in Phase 1, so confirm with the contracting officer whether a Level 3 requirement is active in a given solicitation. If DIBCAC issues a Conditional Level 3 status, the contractor must close NOT MET requirements and pass a POA&M closeout assessment, with results posted within 180 days, or the status expires. Appeals of a DIBCAC outcome must be filed within 21 days (32 CFR 170.7). Plan a calendar that covers the three-year recertification cycle and the annual affirmations of both Level 2 and Level 3 status under 32 CFR 170.22(b)(4).
From Final Level 2 to the DIBCAC Level 3 result
This sequence moves a contractor from a Final Level 2 (C3PAO) result to a Level 3 status recorded by DCMA DIBCAC in eMASS, with any remaining gaps tracked through a closeout process. Each step ends with a document or record that proves the step is complete.
Confirm Final Level 2 status for the same scope
Before anything else, the organization confirms that its Level 2 (C3PAO) certification assessment has reached Final Level 2 status for the same systems that will carry Level 3 requirements. The owner is the organization's compliance lead, with the Affirming Official reviewing the result. The output is the Final Level 2 record and its unique identifier, which the next step requires. Level 3 scope must equal or be a subset of the Level 2 scope, so any mismatch should be resolved here, not later.
Request the Level 3 assessment from DIBCAC
After Final Level 2 is achieved, the contractor emails the DCMA DIBCAC point of contact listed at dcma.mil/DIBCAC and includes its Level 2 (C3PAO) certification unique identifier. The sender is the organization's designated representative. The output is a written request on file that identifies the organization and the Level 2 result it relies on. Ask DIBCAC to confirm receipt and the next points of contact in writing.
Confirm the Level 3 scope with DIBCAC
The organization and DIBCAC agree on the systems, enclaves and CAGE codes that fall inside the Level 3 boundary. A Level 3 data enclave inside a Level 2 enclave is a common pattern, and the scope must stay within the Level 2 boundary. The owner is the security lead with the system architect, and the output is a scope statement with the system security plans that cover each in-scope system, with their names, dates and versions ready for eMASS. Confirm any specialized assets and external service providers in writing as well.
Prepare evidence for each Level 3 objective
The organization assembles final-form evidence for every applicable Level 3 requirement objective, using the assessment objectives in NIST SP 800-171A and the 24 selected NIST SP 800-172 requirements. Drafts do not count. The owner is the control owner for each requirement, and the output is an evidence index that maps each objective to its artifacts. Hash the artifacts and record the hashing algorithm, since DIBCAC records the list of hashed artifact names in eMASS.
Complete the DIBCAC assessment against Level 3 requirements
DCMA DIBCAC examines the Level 3 requirements in scope and records a result for each requirement objective. The contractor provides access, interviews and evidence on request, and it answers questions during the assessment. The output is the DIBCAC result for each objective, which determines whether the outcome is a full Level 3 status or a Conditional status. Ask DIBCAC to clarify any finding in writing before the outcome is recorded.
Review the eMASS record and POA&M usage
DIBCAC posts its Level 3 results in the CMMC instance of eMASS, including the assessment date and level, assessors, CAGE codes in scope, each SSP's name, date and version, the result for each objective, and POA&M usage. The organization checks that the record matches its scope and SSPs and raises any error with DIBCAC. The output is a verified eMASS record. Under the rule, some Level 3 requirements cannot sit on a POA&M, so confirm which items are affected.
Close out any Conditional Level 3 gaps
If the outcome is Conditional Level 3 (DIBCAC), the contractor must remediate NOT MET requirements and pass a DIBCAC POA&M closeout assessment, with results posted within 180 days. The score ratio must meet the minimum threshold, and the seven restricted Level 3 requirements cannot remain open. The owner is the remediation lead, and the output is closeout evidence accepted by DIBCAC. If closeout is not passed in time, the status expires and the contractor becomes ineligible for new awards requiring Level 3. Appeals within 21 days are available for a disputed outcome.
What DIBCAC checks in scope and records in eMASS
The first thing DIBCAC settles is the scope of the contractor information system it will assess. Under the CMMC final rule, that system can be an enterprise network or a network enclave. Level 3 scope must equal or be a subset of the Level 2 scope, and 32 CFR 170.19(e) gives a Level 3 data enclave inside a Level 2 enclave as the example of a valid subset. A practical check is to map every asset that stores, processes or transmits the Level 3 program's data and confirm each one sits inside an enclave already certified at Level 2. If a Level 3 asset falls outside the Level 2 boundary, the assessment cannot start until the boundary is corrected. Confirm the boundary with your Level 2 assessor and your DIBCAC point of contact before you commit to an enclave design.
Once the assessment is complete, DIBCAC records the results in the CMMC instance of eMASS. Under 32 CFR 170.18(a)(1)(i), the entry must include the assessment date and level, the assessors, every CAGE code in scope, and the name, date and version of each system security plan. It also records the result for each requirement objective, whether POA&M items were used, and a list of hashed artifact names with the hashing algorithm. Ask for the artifact list before the assessment begins so your team can confirm that file names, hashes and version labels match the evidence you intend to present. Any mismatch between the SSP version in eMASS and the one your team is working from will create avoidable questions during the review.
The eMASS record is the document your contracting officers and primes will read, so treat every field as a contract-facing statement. Every CAGE code in the record should match an entity you actually intend to cover, and an omitted subsidiary or division can leave part of the program outside the verified scope. Keep a change log for each SSP revision and for any boundary change made after Level 2 was achieved. Before the assessment, have a named owner reconcile the scope statement, CAGE list and SSP versions against your asset inventory. That reconciliation is internal work your own team performs, while DIBCAC alone decides what the final record says.
Which POA&M items block a Level 3 start and which can be closed later
The POA&M rules decide whether a Level 3 assessment can start and whether a Conditional status survives. Some Level 2 gaps must be closed first, some Level 3 requirements cannot be deferred at all, and the remaining items can be closed within a bounded closeout window. Read these limits before you request an assessment.
Score ratio floor for Conditional status
A Conditional Level 3 (DIBCAC) status under 32 CFR 170.21(a)(3) requires a score ratio of at least 0.8. The ratio reflects how many requirement objectives are met, so a POA&M with several open items can still clear the floor if the rest of the scope is strong. Check how the score is calculated under 32 CFR 170.24 before you assume a result. Confirm the calculation with your assessment team, because a weak domain can matter more than the overall number suggests.
Seven requirements barred from the POA&M
Seven Level 3 requirements may not sit on a POA&M at all, so each must be MET before the assessment can support a Conditional status. Two examples are IR.L3-3.6.1e, the security operations center requirement, and RA.L3-3.11.7e, the supply chain risk plan. Pull the complete list from 32 CFR 170.21 and map it against your Level 3 scope before you schedule anything. An open item on this list stops the path to Conditional status until it is resolved.
Level 2 POA&M items close first
Any open Level 2 POA&M item must be closed before a Level 3 assessment starts, under 32 CFR 170.19(e). Level 3 scope must equal or sit inside Level 2 scope, so a gap in the Level 2 enclave can hold up the Level 3 start even when the Level 3 controls are ready. Treat your Level 2 POA&M as a prerequisite checklist and confirm each closure with evidence in final form. Ask your team whether any Level 2 item tied to a shared service also touches the Level 3 boundary.
Closeout window after Conditional status
A Conditional Level 3 status requires you to remediate NOT MET requirements and pass a DIBCAC POA&M closeout assessment, with results posted within 180 days. If that window lapses, the status expires and you become ineligible for new awards that require Level 3. Build the remediation schedule, evidence collection and closeout request before the initial assessment ends. Confirm the posting timeline and what DIBCAC expects in the closeout package with the agency.
How a Conditional Level 3 status expires and how to close it
A Conditional Level 3 (DIBCAC) status is a window, not a finish line. Under 32 CFR 170.18, the contractor must remediate every NOT MET requirement and then pass a DIBCAC POA&M closeout assessment, with results posted within 180 days. If that does not happen, the status expires and the contractor becomes ineligible for new awards that require Level 3. The clock starts from the Conditional result, so the 180 days cover both the fixes and the closeout review. Treat the date as a fixed deadline in your program plan from the day the result is recorded.
The fastest way to lose the window is to start remediation evidence late. For each NOT MET objective, collect the remediation in final form: the updated configuration, the signed procedure, the log extract or the test record that shows the control operating. Drafts do not count toward the outcome, and a fix that exists only in a ticket is hard to show to an assessor. Keep the Level 3 SSP, the POA&M and the eMASS entries aligned as each item closes, so the closeout reviewers see one consistent story. Because the 0.8 score ratio and the limits on which requirements may sit on a POA&M still apply to Conditional status (32 CFR 170.21), confirm early which open items could block the closeout at all.
Confirm the closeout process with DIBCAC before the clock runs down. Ask in writing how the POA&M closeout assessment is scheduled, what artifacts it expects, whether the same assessors return and how results are posted to eMASS. Ask your contracting officer how the expiration would affect any solicitation or option period you are pursuing. Your internal owner should be named for each open item, and your Affirming Official should know the dates. Where your team depends on a partner to prepare evidence, the partner can organize and test that package, but the organization still owns the controls and only DIBCAC issues the outcome.
Appeals, recertification and the dual annual affirmations
A contractor that disagrees with the outcome of a DCMA DIBCAC-conducted assessment can appeal it. The appeal is narrow: it must argue a specific basis, in writing, within a short window. The appeal goes to the DIBCAC Quality Assurance Review Team, which answers in writing or asks for more documentation before deciding. Treat the appeal as a documentation exercise, not a place to introduce new evidence that was missing during the assessment.
- 21-day window: Under 32 CFR 170.7, the written appeal must be submitted within 21 days of the assessment outcome. Calendar that date when the result is received.
- Written basis required: The submission must state the grounds for disagreement, tied to specific requirement objectives and the evidence already reviewed.
- Quality review response: The DIBCAC Quality Assurance Review Team responds in writing, either with a decision or a request for more documentation.
- Evidence in final form: Requirements are judged on final evidence, so drafts or policies adopted after the assessment usually will not change a NOT MET result.
- Internal owner: Assign one person to own the deadline, the assessment record in eMASS and the response.
Before relying on an appeal, confirm with your DIBCAC point of contact how submissions are delivered and what documentation the review team expects.
Level 3 status is not permanent. Under 32 CFR 170.18, a Level 3 certification assessment must be repeated every three years for all systems in the Level 3 scope. Because Level 2 is a prerequisite, a new Level 2 (C3PAO) certification assessment is also required on the same three-year cycle. The two assessments are separate events with separate assessors, so planning for one does not satisfy the other.
- Three-year Level 3 cycle: Every system in the Level 3 scope must be reassessed by DIBCAC at the end of the cycle.
- Parallel Level 2 cycle: A new C3PAO certification for the same scope is also required every three years to keep Level 3 status.
- Scope stability: Changes to enclaves, CAGE codes or systems between cycles can expand what must be assessed, so document scope changes as they occur.
- Evidence refresh: SSPs, POA&M history, hashed artifact lists and objective results should be current before the next assessment starts.
- Lead time: Ask your Level 2 assessor and DIBCAC contact to confirm scheduling constraints well before the expiry date.
Check your current certificate dates against the scope in eMASS and confirm with the DIBCAC point of contact which systems will be reviewed in the next cycle.
Between certification assessments, a Level 3 contractor must affirm its status every year. Under 32 CFR 170.22(b)(4), the contractor affirms both its Level 2 (C3PAO) status and its Level 3 (DIBCAC) status. The two affirmations are not interchangeable because the two assessing bodies check different requirements. A C3PAO assesses the Level 2 requirements, while DIBCAC assesses the Level 3 requirements, so an affirmation supported only by one body's results leaves a gap.
- Two affirmations each year: One for Level 2 (C3PAO) status and one for Level 3 (DIBCAC) status, each covering its own requirement set.
- Different requirement sets: A Level 2 result does not confirm that the 24 Level 3 requirements are met, and a Level 3 result does not replace the Level 2 certification.
- Affirming official: The affirmation is made by an official with authority to bind the organization, so confirm who holds that role.
- Ongoing accuracy: An affirmation is a statement that the scope and controls remain as assessed, so changes must be tracked between affirmations.
- Recordkeeping: Keep the supporting evidence for each affirmation with the assessment file.
Before each affirmation, confirm with your assessors that no changes to scope, POA&M items or SSP content have occurred since the last submission.
What to have in place before DIBCAC arrives
DIBCAC assesses Level 3 only after Final Level 2 (C3PAO) status for the same scope, and it checks each objective against records that must already be final. The six items below are the points where most Level 3 preparations stall, and each one has a check you can run before you email the DIBCAC point of contact.
Confirmed Level 3 scope inside Level 2
Document every system, enclave and CAGE code that handles Level 3 work, then confirm each one sits inside the Level 2 boundary already certified. The rule gives a Level 3 data enclave inside a Level 2 enclave as an example of a scope that must equal or be a subset of the Level 2 scope. Check it by mapping each Level 3 asset to a Level 2 asset record and flagging any asset that appears in only one list. Any gap here reopens the question of whether Final Level 2 covers the work.
Final SSPs with versions and dates
Each system security plan in scope needs a name, a version, a date and an approval record that match what the assessors will see. DIBCAC records the name, date and version of each SSP in eMASS, so a draft or an unversioned file creates a mismatch on day one. Check it by comparing the SSP header, change log and approval signature against the copy in your document repository. Confirm that every SSP describes the systems as they run today.
Final evidence for every objective
A requirement counts as MET only when every applicable assessment objective is satisfied with evidence in final form, and drafts do not count. Evidence includes policies, logs, scan reports, tickets and configuration exports dated within the review period. Check it by walking each objective in NIST SP 800-171A and recording one final artifact, its owner and its date. Replace any screenshot, draft policy or unsigned procedure before the assessment begins.
Closed Level 2 POA&M items
Any Level 2 item still on the plan of action and milestones must be closed before a Level 3 assessment starts. Level 3 also restricts which requirements may appear on the POA&M at all, so an open Level 2 item can block the start of the assessment rather than only lower the score. Check it by exporting the current POA&M, confirming each item has a closure artifact, and removing any item that is open only on paper. Keep the closure evidence with the item so DIBCAC can trace it.
Artifact hashing ready for eMASS
DIBCAC's Level 3 results in eMASS list the names of the hashed artifacts and the hashing algorithm, so the hash record must exist before the assessment, not during it. Choose one algorithm, hash every final artifact, and store the file names and hash values in a register that matches the evidence repository. Check it by re-hashing a sample of files and confirming the values match the register. Changing any file after hashing means recomputing its hash and updating the register.
Named owners for each Level 3 requirement
Every Level 3 requirement needs one accountable owner who can explain how the control works, produce its evidence and answer assessor questions without a vendor present. Owners also keep the requirement current between assessments, which matters because the Level 3 assessment must be repeated every three years. Check it by listing each requirement with its owner, backup owner and last evidence date, then confirming the owners can demonstrate the control in a walkthrough.
Who owns controls, who prepares evidence and who issues the result
The contractor is the organization that holds the contract and the Level 3 scope. It decides which systems, enclaves and CAGE codes are in scope, owns every control it operates, and is the party that makes the annual affirmations. No outside firm can take over those obligations, and the contractor answers to DIBCAC for the accuracy of what it submits.
- Scope decisions: The contractor defines the Level 3 scope, which must equal or sit inside the Level 2 scope, and documents it in its System Security Plan.
- Control ownership: Each of the 24 Level 3 requirements and the Level 2 requirements underneath them needs a named internal owner who runs the control day to day.
- Evidence in final form: The contractor decides what goes into the assessment and confirms that evidence is final, not drafts.
- Plan of action and milestones: The contractor decides which items go on the POA&M within the limits and tracks closeout.
- Affirmations: The contractor's Affirming Official signs the annual affirmations for both Level 2 and Level 3 status.
Before engaging anyone, confirm internally who will own each control after the assessment ends, since that ownership continues for three years between assessments.
An implementation partner such as DeployOpen works inside the contractor's environment to prepare the systems, controls and evidence that an assessor will examine. Its work is fixed in a written scope, and its deliverables go to the contractor. The partner does not score the contractor, does not issue a report, and cannot grant or record any CMMC status.
- System preparation: Planning, hardening and integrating self-hosted open-source platforms that support the Level 3 controls, such as logging, monitoring and access management, inside the contractor's own infrastructure.
- Documentation: Drafting the System Security Plan, procedures and control descriptions for the contractor's review and approval.
- Evidence preparation: Organizing configuration records, logs and test results so the contractor can present them in final form.
- Remediation support: Helping close NOT MET findings and POA&M items before the assessment, or after a Conditional result, within the written scope.
- Independence boundary: The partner must not perform the assessment it helped prepare for, and it cannot sign affirmations or submit results on the contractor's behalf.
Ask any partner to state in its proposal which deliverables it will produce and confirm in writing that it will not issue a report, certificate or status.
DCMA DIBCAC, the Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center, is the body that performs Level 3 certification assessments under 32 CFR 170.18. It is a government assessor, so the contractor cannot hire it, and it is the only party that records the Level 3 result. DIBCAC assesses the Level 3 requirements, while the Level 2 certification assessment, performed by a C3PAO, covers the Level 2 requirements. Each body checks different requirements, which is why both are affirmed annually.
- Assessment: DIBCAC examines the Level 3 scope against the assessment objectives and records a result for each requirement.
- eMASS recording: DIBCAC's results in the CMMC instance of eMASS include the assessment date and level, assessors, CAGE codes in scope, each SSP's name, date and version, POA&M usage and hashed artifact names.
- Status decisions: DIBCAC determines whether the contractor receives a Level 3 status, including a Conditional status that depends on remediation and a POA&M closeout assessment.
- Appeals: Under 32 CFR 170.7, a contractor may appeal within 21 days, and a Quality Assurance Review Team responds in writing.
Confirm the current DIBCAC point of contact and submission steps on the DoW CIO About CMMC page before you request an assessment.
Questions buyers ask about the Level 3 DIBCAC process
Can we start a CMMC Level 3 assessment without Level 2 C3PAO status?
No. Under 32 CFR 170.18, a Level 3 assessment by DCMA DIBCAC requires Final Level 2 (C3PAO) status for the same scope before it can start. Level 2 is a prerequisite, not an optional step, so the Level 2 certification assessment has to be completed and finalized first. The scope of the Level 3 assessment must also equal or be a subset of the Level 2 scope, and any Level 2 POA&M items must be closed before the Level 3 assessment begins. Confirm the exact scope boundary with your Level 2 C3PAO and your DIBCAC point of contact before you schedule either assessment, because a mismatch can delay the work after you have already paid for the first one.
Who requests the Level 3 assessment and what do we send DIBCAC?
Your organization makes the request. After you achieve Final Level 2 (C3PAO) status, you email the DCMA DIBCAC point of contact listed at dcma.mil/DIBCAC and include your Level 2 (C3PAO) certification unique identifier. The request identifies the scope you intend to assess. Before sending it, have your Affirming Official, security lead and contracts team agree on the systems, CAGE codes and SSPs in scope, because DIBCAC records those details. Keep your own copy of the request and the correspondence, since you will need the same scope information for annual affirmations and any later recertification.
What does DIBCAC record in eMASS after a Level 3 assessment?
DIBCAC posts its Level 3 results to the CMMC instance of eMASS. Under 32 CFR 170.18(a)(1)(i), those results include the assessment date and level, the assessors, every CAGE code in scope, the name, date and version of each system security plan, and the result for each requirement objective. The record also shows whether POA&Ms were used and lists the names of hashed artifacts along with the hashing algorithm. Review these entries carefully before they are final, because your contracting officers and primes will rely on them. Ask your DIBCAC contact which fields you can verify before posting and how to correct an error.
What happens if we fail or hold a Conditional Level 3 status?
A Conditional Level 3 (DIBCAC) status requires you to remediate every NOT MET requirement and then pass a DIBCAC POA&M closeout assessment, with results posted within 180 days. If you miss that window, the status expires and you become ineligible for new awards that require Level 3. Under 32 CFR 170.21(a)(3), a Conditional status also needs a score ratio of at least 0.8, and seven Level 3 requirements, including IR.L3-3.6.1e and RA.L3-3.11.7e, cannot sit on the POA&M. If you disagree with the outcome, 32 CFR 170.7 allows a written appeal within 21 days, which a DIBCAC Quality Assurance Review Team answers in writing or with a request for more documentation.
Do we need to recertify Level 3 every three years?
Yes. Under 32 CFR 170.18, a Level 3 certification assessment must be repeated every three years for all systems in the Level 3 scope. Because Level 2 compliance is a prerequisite, a new Level 2 (C3PAO) certification assessment is also required on the same cycle to keep Level 3 status. Between assessments, 32 CFR 170.22(b)(4) requires you to affirm annually both your Level 2 (C3PAO) status and your Level 3 (DIBCAC) status, because the two assessing bodies check different requirements. Plan the affirmations, evidence refresh and scope changes as recurring work, not as a one-time project.
Can a partner do the Level 3 work for us, and what does it need from our staff?
A partner can prepare your systems, controls and evidence, but it cannot run the assessment or issue the result. DeployOpen, for example, plans, implements, hardens and documents self-hosted open-source platforms inside your own infrastructure, and prepares evidence for the assessment. Only DCMA DIBCAC issues the Level 3 outcome, and your organization owns its controls and affirmations. Your staff must still make decisions on scope, approve the system security plans, confirm that evidence is in final form rather than in draft, and own the Affirming Official role. Most engagements are fixed-scope, so ask for the written scope, deliverables and timeline before work starts.
How DeployOpen prepares your Level 3 environment and evidence
DeployOpen is a Chainscore Labs company that plans, implements, customizes, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For a Level 3 assessment, that work usually means preparing the Level 3 data enclave and the security services around it so that DIBCAC can examine the systems in scope and the evidence for each objective. DeployOpen also runs security testing, including the application, API, infrastructure and red team work that Level 3 programs tend to need, and it builds private cyber ranges and training where teams want to rehearse incident response. Every engagement is fixed-scope, with the systems, deliverables and timelines agreed in writing before work starts.
DeployOpen does not issue DIBCAC results, assessment reports, eMASS entries, certificates or conditional statuses. Only DCMA DIBCAC can conduct the Level 3 certification assessment, and the organization itself owns its controls, its System Security Plan and its affirmations. Hiring DeployOpen does not guarantee a MET result, a Conditional status or any award. What it can do is help you confirm, before you request the assessment, that the Level 3 scope is equal to or a subset of the Level 2 scope, that the Final Level 2 (C3PAO) status applies to that same scope, and that no POA&M items remain on the Level 2 requirements. Ask any prospective partner to show how it would document each objective, which artifacts it would hash for the record, and who on your side signs off on final evidence.
Before you engage any implementation partner, confirm the scope in writing: the systems and CAGE codes in the Level 3 enclave, the boundary between it and the Level 2 enclave, which of the 24 Level 3 requirements your own staff will operate, and which ones a managed service will cover. Ask for a list of deliverables that maps to what DIBCAC will review, including the SSP versions and the evidence folders, and confirm that the partner will not draft or backdate evidence. Plan for recurring work after the first assessment as well, since the Level 2 and Level 3 certifications both need repeating every three years and both require annual affirmations. The 'Final' designation for Level 2 is the gate to everything else in this section, so treat it as the first milestone to verify.
