CMMC Level 3
The 24 NIST SP 800-172 enhanced requirements selected in 32 CFR 170.14(c)(4), with the rule's verbatim text, for programs that need them on top of Level 2.
What CMMC Level 3 is
CMMC Level 3 applies to the small subset of Department of Defense programmes handling the most critical Controlled Unclassified Information, where the threat model is an advanced persistent actor rather than an opportunist. Its practices come from NIST SP 800-172, the enhanced-requirements companion to 800-171, and they are qualitatively different in kind: threat hunting, deception, dual authorisation, adaptive response, supply-chain provenance.
Level 3 is strictly incremental. It does not replace Level 2 — it assumes all 110 Level 2 practices are already in place and adds to them, and Level 3 assessment is conducted by the Defense Industrial Base Cybersecurity Assessment Center rather than by a C3PAO.
Most organisations reading this do not need Level 3, and it is worth saying so plainly: it is driven by specific contract language, not by a general desire to be more secure.
Who it applies to
- Contractors on the specific DoD programmes that designate Level 3 in the contract.
- Organisations already at Level 2 who have been told a follow-on award will require Level 3.
- Nobody else. If your contract does not say Level 3, it is not your requirement.
How it is structured in CMDash
CMDash seeds the 24 NIST SP 800-172 (Feb 2021) enhanced requirements that 32 CFR 170.14(c)(4) Table 1 selects for Level 3, across ten of the 800-171 families, using the rule's own wording. Level 2's 110 practices are a separate framework and both need to be enabled.
| Access Control | 2 |
| Awareness & Training | 2 |
| Configuration Management | 3 |
| Identification & Authentication | 2 |
| Incident Response | 2 |
| Personnel Security | 1 |
| Risk Assessment | 7 |
| Security Assessment | 1 |
| System & Communications Protection | 1 |
| System & Information Integrity | 3 |
These counts are the control rows CMDash actually seeds, checked against the seed files by a test on every build.
The control text
24 of the 24 seeded controls carry the publisher’s own wording, taken from 32 CFR 170.14(c)(4) Table 1 (eCFR). It is public-domain content, so CMDash reproduces it rather than paraphrasing — you assess against what the publisher wrote.
What CMDash does for CMMC Level 3
- The 24 enhanced requirements, with the rule's verbatim text, tracked with the same owners, statuses, evidence and reviewer workflow as everything else.
- A seeded crosswalk to CMMC Level 2, so the dependency between the two levels is visible rather than assumed, plus a crosswalk to NIST CSF.
- CMMC-format POA&M export and the read-only assessor seat, scoped to Level 3 alone if that is what you need to share.
- Both L2 and L3 practices are mapped into the regulatory radar's CMMC 2.0 programme entry.
- Every control is a tracked row with an owner, a status (not started, in progress, implemented, not applicable, at risk, failing), reviewer notes, and its own evidence requirements — not a checkbox on a spreadsheet.
- Evidence is uploaded against a specific control, dated, and kept on that control, so an assessor can see what was true when.
- Gaps export to a POA&M CSV — every control that is not implemented and not marked out of scope, with owner, status and evidence requirements.
- Policies you author in CMDash link to the controls they govern, so each control row shows which living policies stand behind it.
- A time-boxed, read-only external assessor seat can be scoped to just this framework, with an expiry date you set and a record of every page they opened.
What it shares with your other frameworks
CMDash seeds control-to-control crosswalk mappings, each with a confidence score. They are what stops the same artefact being gathered twice, and they are how a second framework costs a fraction of the first.
Where the evidence comes from
CMDash reads from the security tools you already run and turns what they report into control evidence. These are the integrations whose data lands closest to CMMC Level 3’s control groups — you decide which control each signal evidences, and CMDash keeps it current from then on.
Where CMDash stops
Published on purpose. A buyer who discovers a limit after signing is a support ticket and a refund conversation; a buyer who reads it here is making an informed decision.
- Level 3 here is the 24 requirements of 32 CFR 170.14(c)(4) Table 1, checked against the eCFR text on 2026-10-08. The NIST SP 800-172A assessment objectives are not part of the catalog; CMDash tracks each requirement as a whole.
- The requirement text is the rule's Table 1 wording, including the DoD-assigned parameters, and the identifiers are the rule's. The short titles and the evidence suggestions are CMDash's own labels, not requirement text. NIST withdrew SP 800-172 in May 2026 in favour of Rev 3, but 32 CFR 170.14 still cites the Feb 2021 version, so that is what CMDash follows.
- Level 3 assessment is conducted by DIBCAC. CMDash is not an assessor and produces evidence, not a determination.
- Enabling Level 3 without Level 2 tracks an incomplete picture, because Level 3 is defined as an increment on a complete Level 2 baseline.
Common questions
Do we need Level 2 as well?
Yes. Level 3 is defined as an increment on the complete Level 2 baseline, so both need to be enabled in CMDash and both need to be met. The seeded crosswalk between them exists to make that dependency explicit.
Why are there fewer practices than we expected?
Because this is only the increment: the Level 3 requirement is Level 2 plus these 24 enhanced requirements, and CMDash keeps them as a separate framework rather than shipping a combined set that would double-count the 110.
Also in Government & Defense
Paid plans cap how many frameworks you run at once, never which ones — CMMC Level 3 is available on every paid plan.
View pricingReady to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.