Prepare for CMMC Level 3 with evidence that stays current

CMMC Level 3 is the highest tier of the US Department of Defense's Cybersecurity Maturity Model Certification. It protects controlled unclassified information against advanced persistent threats by adding 24 enhanced requirements from NIST SP 800-172 to the 110 NIST SP 800-171 requirements of Level 2. It is assessed by the government's DIBCAC rather than a third-party assessor, and applies only where a contract specifies it.

Only defence contractors and subcontractors whose contracts specify CMMC Level 3 need it. These are typically organisations handling controlled unclassified information on the Department's highest priority programmes. The contracting officer sets the required level. Most defence suppliers need Level 1 or Level 2 instead, and any organisation seeking Level 3 must first hold Final Level 2 certification from an accredited C3PAO for the same scope.

CMMC Level 3 has 24 security requirements, selected from NIST SP 800-172 and set out in 32 CFR 170.14. Some carry Department-defined parameters. They sit on top of the 110 Level 2 requirements from NIST SP 800-171, so a Level 3 organisation implements 134 requirements in total. They cover areas such as threat hunting, a security operations centre, penetration testing, automated inventory and supply chain risk.

CMMC Level 3 assessments are performed by the Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), a government body. Accredited third-party assessors (C3PAOs) cannot certify Level 3. The organisation must first achieve Final Level 2 (C3PAO) status for the same scope, then DIBCAC assesses the 24 Level 3 requirements and may also check Level 2 requirements.

A CMMC Level 3 status lasts three years, after which DIBCAC must reassess the organisation. In addition, a senior official must submit an affirmation of continued compliance each year, and after any assessment that closes out a plan of action. Because the Level 2 certification is a prerequisite, it must also be maintained throughout, so evidence has to stay current rather than being gathered once.

The CMMC rules are in force, but the phased rollout of assessment requirements is on hold. In July 2026 the Department suspended Phase 2 and the later phases, including the planned introduction of Level 3 requirements in contracts, pending a review of the programme. Phase 1 self-assessments and DFARS 252.204-7012 obligations remain. Contractors should check the Department's CMMC pages for the latest position.

CMMC Level 3 and ISO 27001 overlap but are not interchangeable. ISO 27001 is a voluntary international standard for an information security management system, while CMMC Level 3 is a US defence contract requirement assessed by DIBCAC against specific NIST SP 800-171 and 800-172 requirements. ISO 27001 certification does not satisfy CMMC, but shared controls and evidence can support both programmes.

Yes, OneClickComply supports CMMC Level 3 today. It maps the 24 Level 3 requirements alongside Level 2, collects evidence automatically from connected tools, monitors controls for drift and generates policies from your real environment. Our audit team can help you prepare. OneClickComply does not issue CMMC certification: Level 3 status is granted only through a DIBCAC assessment.