Who Level 3 applies to
Level 3 applies when DoD designates it for CUI on its highest-priority programs. The solicitation and contract state the level (DFARS 252.204-7021).
Prerequisite: Final Level 2 (C3PAO) status
An organization must hold Final Level 2 (C3PAO) status for the same Level 3 scope before the Level 3 assessment (32 CFR 170.18).
The 24 NIST SP 800-172 requirements
Level 3 uses 24 selected requirements from NIST SP 800-172 (February 2021), with DoD-defined parameters. The list and parameters are in 32 CFR 170.14(c)(4).
How Level 3 is assessed
DCMA DIBCAC conducts the assessment every three years, and the organization submits an affirmation annually (32 CFR 170.18).
POA&M rules at Level 3
Level 3 has its own POA&M rules. Read them in 32 CFR 170.21 rather than relying on a summary.
Rollout and current status
CMMC is phased in through contracts. DoD suspended the Phase 2 transition on 13 July 2026; during the suspension, requirements may designate only Level 1 (Self) or Level 2 (Self). See current CMMC status.