Who needs CMMC Level 3 and how DoD decides

Who needs CMMC Level 3 today

Level 3 is not the default for defense contractors. A solicitation or contract that names a CMMC level has made that choice for one procurement, and under 32 CFR 170.5(b) the DoD program manager or requiring activity makes it. The decision weighs mission criticality, the type of program or technology, the threat of losing federal contract information or CUI, and the impact that an exploited weakness would have. Level 3 is generally reserved for the most critical programs and technologies, so most contractors will see Level 1 or Level 2 in their paperwork. Read the level in the solicitation and the contract clauses, and ask the contracting officer to confirm it wherever the wording is unclear.

When Level 3 does apply, DCMA DIBCAC performs the certification assessment. The organization owns its controls and its evidence. An implementation partner can prepare systems, documentation and evidence, but only the independent assessor issues a certification or report. Level 3 is built on Level 2, so the company must already meet Level 2 requirements, and any Level 3 enclave must equal or sit inside the Level 2 scope under 32 CFR 170.19(e). Check that dependency before bidding, because the Level 2 work and the enclave design drive most of the planning.

The rule environment is moving, so confirm the requirement before committing budget. On 13 July 2026 the Department of War suspended CMMC Phase II, which had included the Level 2 C3PAO certification requirement, and started a 60-day review by a CMMC Reform Task Force. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. As of 17 October 2026, the DoW CIO About CMMC page says implementation is paused in Phase 1 and may only require self-assessments at Levels 1 and 2, while the eCFR text of 32 CFR 170.3(e) still shows the original schedule. Ask the contracting officer which level and assessment type applies to each contract and record the answer in writing.

What makes a program critical enough for Level 3

The requiring activity, not the contractor, decides whether a procurement carries Level 3. Under 32 CFR 170.5(b), the program manager weighs mission criticality, the type of program or technology, the threat to the information, and the impact of exploited weaknesses. The cards below explain each factor and the questions to put to the program office before you price or bid.

Mission criticality

The requiring activity looks at how much the program's mission depends on the information and systems involved, and what happens to operations if they are disrupted. A program that supports core warfighting or sustainment functions is more likely to be assigned Level 3 than one with narrow, replaceable support data. Ask the program office to state the mission role of the work in the solicitation, and ask whether the contract data is tied to a named critical program or high value asset, since that link drives the enhanced SP 800-172 requirements.

Type of program or technology

The rule ties the decision to the kind of program or technology involved. Advanced or sensitive technology areas draw more scrutiny than commodity components, and the program type can change the threat profile of the same CUI. Ask whether the program is designated in the contract as critical, and whether the technology in scope is one the requiring activity has flagged for enhanced protection, so you know whether your own systems or subcontract work will inherit that designation.

Threat of loss of FCI or CUI

The requiring activity assesses how likely it is that adversaries would target the information, and what a loss would mean for national security or for the program. Information that nation-state actors are known to pursue is treated differently from information with low adversary interest. Ask the program office what threat assessment supports the chosen status, and whether the controlled information on your contract is the same material that other programs have flagged as a target, because that determines how much of your environment must meet the enhanced requirements.

Impact of exploited weaknesses

This factor asks what would happen if an adversary used a weakness in the contractor's system to reach the information, including effects on other systems and programs connected to it. A weakness that exposes a single program differs from one that gives access to a broader network of defense systems. Ask the program office what consequences it expects from a compromise of your environment, and whether your system connects to other critical programs, because interconnections widen the impact and make Level 3 more likely for the whole chain.

Confirming the status in the contract

The chosen CMMC level appears in the solicitation and the contract, not in the rule alone. Before bidding, locate the CMMC requirement in the solicitation, confirm the required level for each line item, and check whether any subcontracted work carries a different level. Confirm with the contracting officer which status applies at award and whether it can change during performance, and record the answer in your bid file. Your Affirming Official and any Level 3 assessment planning should rest on that written status, not on assumptions about the program.

What NIST and the proposed FAR rule say about critical programs and high value assets

NIST frames the enhanced SP 800-172 requirements as a tool for a narrow case: controlled unclassified information (CUI) sitting in a nonfederal system that is associated with a high value asset or a critical program. NIST also says these requirements are intended for federal agencies to use in contracts or other agreements. For a defense contractor, the practical reading is that the enhanced requirements are a contract decision made by the government, not a default property of every CUI environment. Your first task is to find out whether your contract, task order or subcontract tells you that the program is critical or that a high value asset is involved, and if it does not, to ask the contracting officer directly. Note that the NIST statement describes SP 800-172 in general, and the enhanced requirements are the ones CMMC Level 3 selects.

The June 2026 FAR overhaul proposed rule would make that reading explicit. Its proposed FAR 52.240-7 would state that NIST SP 800-172 requirements apply only when the agency identifies them for a critical program or high value asset. This is a proposed rule, not a final one, so its wording, numbering and effective date could change before any contract relies on it. Treat it as a signal of where the government is heading, and confirm its current status in the Federal Register and with your contracting officer before you plan spend around it. The FAR overhaul proposed rule is the primary text to read.

Ask the contracting officer three specific questions and record the answers in writing: which program or asset is designated critical or high value, which CMMC level and enhanced requirements the solicitation or contract names, and whether the designation applies to your subcontractors or only to the prime. Keep the answers with your System Security Plan and your contract file. If the contract is silent, do not assume either outcome. Ask before you bid, because the answer determines whether Level 3 scope and its costs belong in your proposal at all.

What DoD estimated for the enhanced SP 800-172 requirements

This table compares the CMMC rule's initial implementation estimates for the enhanced SP 800-172 requirements, which apply only to critical programs or high value assets, across three company sizes by endpoint count. Read the figures as government estimates of implementation cost, not quotes, and treat the annual recurring estimate of 20 percent as a starting point for your own model.

Company profile (endpoints)	Initial implementation estimate	What to model for your own case
Small business, 25 to 50 endpoints	$202,500 (CMMC rule estimate)	Endpoint count, existing Level 2 controls, and whether a single enclave covers the critical program
Company with 50 to 100 endpoints	About $1,000,000 (CMMC rule estimate)	Tooling you must add for 24/7 monitoring and whether staff or a managed provider will run it
Company with 750 to 1,500 endpoints	About $2,315,000 (CMMC rule estimate)	Size of the Level 3 enclave, number of specialized assets, and how many subcontractors need flowdown
Annual recurring costs	Estimated at 20 percent of initial cost (CMMC rule estimate)	Staffing for monitoring, testing cycles, affirmations, and tool licenses or support renewals
Who pays for the work	Your organization, with advisers and vendors paid under their own scope	Written scope from each adviser, with deliverables and timelines agreed before work starts
Level 2 prerequisite	Not included in the enhanced estimate shown above	Confirm Level 2 costs separately, since Level 3 builds on a Level 2 scope

How Level 3 scope sits inside Level 2

A Level 3 assessment can only cover a boundary that already sits inside a Level 2 boundary. The CMMC rule describes the assessed contractor information system as something like an enterprise network or a network enclave, and 32 CFR 170.19(e) uses a Level 3 data enclave inside a Level 2 enclave as its example. The Level 3 scope must equal or be a subset of the Level 2 scope. In practice, this means a company cannot certify Level 3 on systems, people or facilities that its Level 2 assessment did not cover. Before any program asks for Level 3, the organization should map which systems store, process or transmit the CUI in question and confirm that every one of them falls within the Level 2 boundary it already holds or is preparing for.

*Illustrative example:* a defense contractor runs a corporate network that holds CUI for many contracts. Inside it, one program team builds a separate enclave with its own identity store, engineering repositories and restricted workstations for a critical program. The Level 2 assessment covers the corporate enclave and the program enclave. A Level 3 assessment could then target only the program enclave, provided that enclave is fully inside the Level 2 scope and its supporting services, administrators and support tools are also in scope. If the program team relies on a shared directory or a file transfer service outside the Level 2 boundary, the Level 3 boundary is larger than the Level 2 boundary and the design must change before assessment.

Scope decisions are the point where contractors most often need an outside view. Confirm the proposed Level 3 boundary, its dependencies and any shared services with your Level 2 assessor and with the program office, and get their agreement in writing before engineering work starts. Ask the program office which systems it considers part of the critical program, because the rule leaves that choice to the requiring activity under 32 CFR 170.5(b). Keep the boundary diagram, asset inventory and data flow records current, since DCMA DIBCAC will test them against the environment that exists at assessment time.

What subcontractors need on a Level 3 contract

When the prime contract requires Level 2 with a C3PAO assessment, the rule sets a floor for any subcontractor that handles CUI. Under 32 CFR 170.23(a)(3), that subcontractor needs at least a Level 2 (C3PAO) status for the work it performs. The subcontractor does not inherit the prime's certificate, and its own assessed environment must cover the CUI it touches.

Floor, not ceiling: the subcontractor must reach at least Level 2 (C3PAO) for CUI work, even if its own contracts call for less.
Own status: the subcontractor's CMMC status belongs to the subcontractor, and the assessment result is issued by a C3PAO, not by the prime or a consultant.
Scope match: the assessed system must cover the systems, people and locations where the subcontractor stores, processes or transmits CUI.
Non-CUI work: a subcontractor that never handles CUI may fall outside this floor, so confirm the data flows in writing before accepting the flowdown.

Ask the prime to state in writing which CMMC level applies to your specific subcontract and which CUI you will receive.

How to confirm whether your contract requires Level 3

This sequence turns an unclear Level 3 question into a written answer from the government side, a mapped boundary and confirmed subcontractor obligations before any budget is committed. Each step produces a record you can point to later. The rules on critical programs and high value assets are still moving, so the written answer you obtain governs over any general reading of the rules.

Read the solicitation and the CMMC status it states
Start with the solicitation, the contract clauses and the statement of work. Look for the CMMC level the requiring activity has stated, usually in the DFARS 252.204-7021 and 252.204-7025 requirements and the instructions to offerors. Note the exact level, the assessment type (self-assessment, C3PAO or DIBCAC) and any language that refers to critical programs, high value assets or enhanced SP 800-172 requirements. Under 32 CFR 170.5(b), the program manager or requiring activity selects the status using factors such as mission criticality and the threat to the information, and Level 3 is generally reserved for the most critical programs and technologies. Done when you have a dated copy of the clause text and a one-page note quoting the stated level. If the solicitation says nothing about Level 3, record that absence too.
Ask the program office about the critical program designation
Send written questions to the contracting officer and the program office. Ask whether the program or the system has been designated a critical program or high value asset, whether the enhanced SP 800-172 requirements are in scope, and which Level 3 assessment applies. Ask them to identify the CUI categories and the system or enclave the requirement covers. NIST describes the SP 800-172 requirements as intended for CUI in a nonfederal system associated with a high value asset or critical program, and the proposed FAR overhaul would tie FAR 52.240-7 to agency identification of those assets. Done when you have a written reply that names the designation, or a written statement that none has been made. Keep the reply with the solicitation file, because a verbal answer will not hold up later.
Map the Level 3 boundary against the Level 2 boundary
Draw the system boundary your Level 2 assessment already covers, then mark the enclave or environment the Level 3 requirements would reach. Under 32 CFR 170.19(e), a Level 3 data enclave inside a Level 2 enclave is the example of scope that must equal or be a subset of the Level 2 scope, so the Level 3 boundary cannot sit outside what Level 2 already assessed. List the assets, identities, networks and personnel inside the Level 3 boundary and note which ones are shared with other programs. Have your security lead and, where you use one, your implementation partner review the diagram. Done when you have an approved boundary diagram with a list of the assets it contains and a note of any asset that is shared with work outside the contract.
Confirm subcontractor requirements with the prime
Ask the prime contractor in writing which level each subcontractor must hold. Under 32 CFR 170.23(a)(3) and (4), a subcontractor that handles CUI needs at least Level 2 (C3PAO) when the prime contract requires Level 2 (C3PAO) or Level 3 (DIBCAC). Ask whether the prime expects its subcontractors to hold a Level 2 certificate, whether they will require a flowdown clause, and how they will verify status in SPRS. List each subcontractor that will touch CUI or a Level 3 boundary asset and record the required level beside its name. Done when each subcontractor has a written requirement from the prime and you know which of them must start their own assessment work.
Record the answers and confirm them before budgeting
Assemble one written file containing the clause text, the program office reply, the approved boundary diagram and the subcontractor requirements. Add a short summary that states the level you believe applies, the assessment type and the date each answer was given. Circulate it to the contracts, legal and finance leads and ask the program office to confirm the summary in writing. Because the CMMC rule, the DFARS clause and the FAR overhaul are changing, check the file against the current text of the rules before any cost estimate or bid decision, and re-confirm it when the contract is modified. Done when the program office has confirmed the summary in writing or has explained in writing why it cannot. Only then should Level 3 engineering and assessment costs enter the budget.

Questions buyers ask about who needs CMMC Level 3

Who decides whether a contract requires CMMC Level 3?

The DoD program manager or requiring activity chooses the CMMC status for a procurement, under 32 CFR 170.5(b). The choice weighs mission criticality, the type of program or technology, the threat of losing federal contract information or CUI, and the impact of exploited weaknesses. Level 3 is generally reserved for the most critical programs and technologies, so a contractor typically learns of the requirement from the solicitation or contract terms. Ask the contracting officer or program office in writing which level applies, why it applies, and where the requirement appears in the contract documents.

Does a Level 3 contract put the whole company at Level 3?

No. Level 3 scope follows the systems that handle the protected information. Under 32 CFR 170.19(e), the Level 3 scope must equal or be a subset of the Level 2 scope, and the rule gives a Level 3 data enclave inside a Level 2 enclave as the example. The assessed system can be an enterprise network or a network enclave, so an organization may confine the Level 3 controls to the enclave that holds critical program data. As an illustrative case, a company with several hundred staff might only place a small engineering enclave in Level 3 scope. Confirm the boundary with the program office early, because the boundary drives most of the cost.

Do we need Level 2 in place before Level 3 applies?

Yes, in practice. Level 3 is built on Level 2. The CMMC Program rule defines three levels, and Level 3 adds 24 selected NIST SP 800-172 requirements to the Level 2 baseline of NIST SP 800-171 Rev. 2 requirements. Because the Level 3 scope must sit inside the Level 2 scope, the Level 2 environment is the foundation that the enhanced controls are added to. Plan the Level 2 work first, then the Level 3 enclave, and confirm with the program office and DCMA DIBCAC what prerequisite assessment results must exist before a Level 3 assessment can be requested.

What do subcontractors need on a Level 3 contract?

Under 32 CFR 170.23(a)(3) and (4), a subcontractor that handles CUI needs at least Level 2 with a C3PAO assessment when the prime contract requires Level 2 (C3PAO) or Level 3 (DIBCAC). The prime contractor should first list which subcontractors will receive or process CUI, then confirm the CMMC status each one holds. Flow the applicable requirement into each subcontract and ask subcontractors to show current status in the SPRS and their assessment records. Subcontractors that do not handle CUI may have lighter obligations, so confirm the scope of each subcontract with the prime and the program office.

What did the government estimate Level 3 implementation would cost?

The CMMC program rule (Federal Register, 15 October 2024) estimated costs for the enhanced SP 800-172 requirements that apply only to critical programs or high value assets. It estimated initial implementation at $202,500 for a small business with 25 to 50 endpoints, about $1,000,000 for one with 50 to 100 endpoints, and about $2,315,000 for one with 750 to 1,500 endpoints. The rule also estimated annual recurring costs at 20 percent. These are government estimates, not quotes. Your own figure depends on your endpoint count, existing tooling and enclave size, so ask for a written scope and a breakdown of engineering, assessment support and recurring items.

Can our own team prepare for Level 3 without outside help?

Yes. The organization owns its controls, so an internal team can design, operate and document them. The difficulty lies in operations: the enhanced requirements expect sustained security monitoring, incident response capacity, threat-informed testing and supply chain planning, all producing evidence that is final and current. Internal teams should count the staff hours for those functions before committing. Certification is different. Only DCMA DIBCAC issues Level 3 certification results, so an internal team can prepare the environment and evidence but cannot issue its own Level 3 outcome.

What can an implementation partner do for Level 3, and what can it not do?

A partner can plan, implement, harden, document and support self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, prepare the systems and evidence an assessment will review, and run security testing. DeployOpen works this way and most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. A partner cannot issue audit reports, attestations or certifications. Level 3 results come only from DCMA DIBCAC, and the organization remains accountable for its controls. Ask any partner to state those boundaries in the statement of work.

How does the Phase II suspension affect when Level 3 applies?

The Department of War suspended CMMC Phase II on 13 July 2026 and started a 60-day review by a CMMC Reform Task Force. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. As of 17 October 2026, the DoW CIO's About CMMC page says implementation is paused in Phase 1 and may only require self-assessments at Levels 1 and 2, while the eCFR text of 32 CFR 170.3(e) still contains the original four-phase schedule. Level 3 timing is therefore uncertain. Confirm in writing with the contracting officer which CMMC status and assessment type a contract requires today.

How DeployOpen scopes Level 3 readiness

DeployOpen works on the Level 3 question as a scoping and readiness exercise: first confirm which systems the requiring activity has placed at Level 3, then decide what a self-hosted environment must do to support that position. Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and the organization keeps ownership of its controls and its contract decisions.

How we scope

Confirm in writing which contract, program or technology the requiring activity has assigned to Level 3, and which systems carry that data.
Map the proposed Level 3 enclave against the Level 2 boundary so the enhanced scope equals or sits inside the Level 2 scope.
Identify subcontractors and external providers that will handle the data, and document what each must hold before the work starts.

How we build

Plan and deploy self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, with the enclave boundary designed in from the start.
Configure logging, monitoring, access, and vulnerability handling so each enhanced requirement has a system that produces its evidence.
Test controls against the assessment objectives in NIST SP 800-172A and record gaps as tracked items with owners and dates.

How we hand over

Deliver the system security plan, network diagrams, configuration baselines, and an evidence index mapped to each requirement ID.
Provide runbooks for the security operations, incident response, and maintenance tasks your staff will perform after handover.
Document open gaps and any plan of action items in final form, so your team and the independent assessor can review the same record.

How we support

Ongoing support, upgrades, and continuous testing are available as a retainer after the written scope is delivered.
Retainers can cover evidence refresh between assessment cycles, so affirmations rest on current records rather than memory.
DeployOpen prepares systems and evidence only. The assessment, and any certification decision, comes from an independent assessor, which we will help you prepare for.

Who needs CMMC Level 3