How to Achieve CMMC Level 3 Compliance (Step-by-Step)

CMMC Level 3 requirements extend beyond Level 2 with 24 additional controls drawn from NIST SP 800-172. Understanding what Level 3 demands means examining what those controls require, which contractors must meet them, and how they fundamentally change the assessment process. Most defense contractors assume Level 2 covers their obligations — or treat Level 3 as a distant concern.

Both assumptions carry real contract risk. Level 3 applies to a specific subset of high-priority DoD programs handling the most sensitive CUI, and misreading your required level creates gaps that surface during procurement. Here’s what CMMC Level 3 actually requires, who needs it, and what separates it from Level 2.

What CMMC Level 3 Compliance Actually Requires?

The NIST SP 800-172 Control Requirements

CMMC Level 3 builds on Level 2’s 110 practices by adding 24 requirements from NIST SP 800-172. These controls target attack vectors that sophisticated adversaries exploit against high-priority DoD programs — threats that lower CMMC levels aren’t designed to address.

CMMC 2.0 organizes these enhanced security requirements across the same 14 practice domains used at all CMMC levels. Level 3 applies NIST SP 800-172 requirements to environments where CUI sensitivity is highest. At this tier, CMMC 2.0 mandates government-led assessment — not third-party certification. For full details on the assessment structure, see the CMMC Program Office.

The 24 requirements from NIST SP 800-172 are distributed across eight practice domains:

Access Control — Restricts privileged remote sessions and limits portable storage device use

Awareness and Training — Requires advanced threat awareness training for users with elevated access

Configuration Management — Enforces security-focused software usage restrictions and policy controls

Identification and Authentication — Strengthens multi-factor authentication for high-privilege accounts

Incident Response — Mandates external coordination capabilities and post-incident analysis

Risk Assessment — Adds threat hunting obligations and supply chain risk assessment requirements

System and Communications Protection — Enforces higher-threshold network segmentation and encrypted communications

System and Information Integrity — Requires advanced malware protection and continuous threat monitoring

These level 3 security requirements don’t replace Level 2 controls — they layer on top of them. CMMC Level 3 builds on the full foundation of Level 2 before introducing enhanced protections. That means every CMMC Level 3 requirement assumes the 110 NIST SP 800-171 controls are already implemented and verifiable.

Level 3 builds on every control in NIST SP 800-171 — review our CMMC compliance checklist to confirm your Level 2 foundation before addressing the 24 additional requirements.

For a full walkthrough of how CMMC levels are structured, see our guide to the CMMC 2.0 certification process.

Achieving CMMC Level 3 certification means every level 3 control above is technically enforced and verifiable — not just documented. DIBCAC confirms CMMC Level 3 compliance through government-led assessment, giving DoD direct oversight of its highest-risk contractor environments. Level 3 security requirements establish an operational baseline that lower CMMC levels don’t reach.

Who Needs CMMC Level 3 Certification?

Not every contractor handling CUI needs CMMC Level 3 compliance. Level 3 is designed for a narrow subset of defense industrial base companies working on high-priority DoD programs where CUI exposure carries the greatest national security risk. Most contractors processing CUI fall under CMMC Level 2 — and that distinction matters for both compliance planning and contract bidding.

The DoD determines which programs require CMMC Level 3 certification at the contract level. Program offices identify contracts where CUI sensitivity and threat profile justify enhanced level 3 controls, then specify the required CMMC levels in solicitation language. Contractors don’t self-select for Level 3 — the requirement appears in the contract, tied to program classification.

Level 3 applies specifically to level 3 contractors meeting one or more of these program-level criteria:

High-value DoD acquisition programs — contracts tied to critical weapons systems, advanced R&D, or strategically sensitive platforms

Elevated CUI sensitivity classifications — programs where CUI loss would meaningfully degrade U.S. operational or technological advantage

Advanced persistent threat exposure — programs identified by DoD as likely targets of nation-state cyber actors

OUSD(R&E) priority programs — contracts falling under the Office of the Under Secretary of Defense for Research and Engineering oversight
Explicit contract specification — solicitation language that designates CMMC Level 3 as the required tier

Understanding whether you need CMMC Level 3 starts with reviewing which CMMC levels your contract documentation specifies. If your program office hasn’t flagged enhanced requirements, CMMC Level 2 covers the vast majority of CUI-handling scenarios. Level 3 assessments are conducted by the Defense Industrial Base Cybersecurity Assessment Center rather than accredited third-party organizations. This CMMC assessment structure reflects the elevated oversight DoD applies to its most sensitive supplier relationships. Achieving CMMC Level 3 compliance without a contract requirement creates unnecessary burden.

Contractors uncertain whether Level 1 or Level 2 applies should first confirm scope — see our breakdown of CMMC level requirements for defense contracts.

The CMMC Compliance Roadmap walks you through each assessment domain so you can confirm your required level before procurement decisions are made.

How CMMC Level 3 Differs from Level 2?

CMMC 2.0 structures Level 2 and Level 3 as distinct tiers — different control sets, assessment bodies, and oversight models. They are not variations of the same requirement.

Level 3 assumes full Level 2 compliance as a prerequisite — review the CMMC Level 2 requirements before assessing the gap Level 3 adds.

2. Level 2 requirements cover NIST SP 800-171’s 110 practices.

3. Level 3 certification adds 24 controls from NIST SP 800-172 on top of full Level 2 C3PAO assessment requirements. A verified Level 2 standing is the prerequisite for Level 3 pursuit. Contractors cannot enter the level 3 certification process without first satisfying Level 2 requirements in full.

The four structural differences between Level 2 and Level 3:

Control count — CMMC Level 2: 110 practices (NIST SP 800-171). Level 3 certification: 134 practices total, incorporating all Level 2 controls plus 24 from NIST SP 800-172

Assessment body — CMMC Level 2 certification uses accredited C3PAOs authorized by the Cyber AB. The CMMC Level 3 assessment transfers oversight to DIBCAC, a government body operating under direct DoD authority

Oversight model — A CMMC assessment at Level 3 operates under federal oversight protocols. CMMC Level 2 functions as a commercial third-party engagement

Recertification cadence — CMMC Level 2 follows a triennial third-party cycle. Level 3 certification frequency is program-driven — unlike other CMMC levels, scheduling is subject to DIBCAC authority rather than contractor-initiated timing

Final Thoughts:

The CMMC Level 3 assessment differs from Level 2 certification in authority, not just scope. At Level 2, contractors engage an accredited C3PAO through the Cyber AB marketplace. At Level 3, DIBCAC initiates and controls the assessment — contractors don’t schedule it. That shift reflects the direct federal interest in confirming security posture for the most sensitive programs.

Before a DIBCAC-led Level 3 assessment, contractors typically complete a structured CMMC readiness assessment to identify control gaps.

CMMC Level 3 requirements aren’t designed for most contractors — but misidentifying your level is where compliance exposure starts. You now have the framework: what Level 3 controls require, which programs trigger it, and how the assessment differs from Level 2. The CMMC Compliance Roadmap walks you through each assessment domain so you can confirm your required level before procurement conversations force the issue. Map your compliance path without hiring a separate consultant. Download it. Confirm your level. Protect your contracts. The next DIBCAC review won’t wait for your scope to be clarified. C3PAOs focus on contractors who understand the framework but haven’t confirmed their actual obligation.

Download the CMMC Compliance Roadmap to map your required level and assessment domains before your next contract review.

Frequently Asked Questions About CMMC Level 3 Requirements

What is the difference between CUI and CMMC?

Controlled unclassified information is the sensitive federal data that CMMC compliance protects. CMMC levels define which security practices contractors must implement based on the CUI they handle.

What level of CUI is required per NIST?

Requirements from NIST SP 800-171 establish baseline security requirements for CUI at Level 2. The CMMC Level 3 requirement adds 24 controls drawn from NIST SP 800-172.

Is CMMC Level 3 mandatory for all defense contractors?

No. Only level 3 contractors working on high-priority DoD programs with elevated CUI sensitivity require CMMC Level 3. Most defense contractors handling CUI fall under CMMC Level 2. Organizations confirming their required level can explore RHTG’s CMMC compliance services for a structured path from scoping through assessment.