CMMC Level 3 Controls: What They Are, Who Needs Them, and What Compliance Actually Requires

Most of the conversation around CMMC 2.0 centers on Level 2 — the 110-practice requirement set that applies to the largest segment of the defense industrial base. That focus is appropriate, given how many contractors it affects. But for a smaller subset of defense contractors working on the most sensitive programs, Level 2 is not the ceiling. Level 3 is.

CMMC Level 3 represents the most demanding compliance tier in the framework, and it operates differently from Levels 1 and 2 in ways that go beyond simply adding more controls. The verification mechanism is different. The government’s involvement is different. The ongoing program expectations are different. And the consequences of non-compliance for the contracts where Level 3 applies are significant enough that organizations in scope need to understand the requirements in depth, not just in outline.

This guide covers what Level 3 controls require, who Level 3 applies to, how the assessment process differs from Level 2, and what building a Level 3-compliant program actually looks like in practice.

How Level 3 Fits Into the CMMC 2.0 Framework

CMMC 2.0 reorganized the original five-level framework into three tiers, each corresponding to a different category of information and a different threat environment.

Level 1 protects Federal Contract Information (FCI) through 17 basic practices and annual self-attestation. Level 2 protects Controlled Unclassified Information (CUI) through 110 practices aligned to NIST SP 800-171 and triennial C3PAO assessment. Level 3 protects CUI on the most critical defense programs — those targeted by Advanced Persistent Threats (APTs), primarily nation-state actors — through a more demanding control set and government-led assessment.

The DoD’s CMMC program documentation describes Level 3 as targeting contractors whose systems process, store, or transmit CUI associated with critical programs and high-value assets. The defining characteristic isn’t simply the presence of CUI — that’s Level 2 territory — it’s the nature of the threat environment surrounding that CUI. Programs where nation-state adversaries have demonstrated capability, intent, and ongoing targeting are the programs where Level 3 applies.

Level 3 is built on the foundation of CMMC Level 2 — all 110 NIST SP 800-171 practices are included — and adds 24 enhanced requirements drawn from NIST SP 800-172, bringing the total to 134 practices. Understanding Level 3 therefore requires understanding Level 2 first, with the enhanced requirements addressed on top of that foundation.

Who Level 3 Applies To

Level 3 is not self-designated. Unlike Level 1 and Level 2 determinations, which contractors can often work through by reviewing their contract’s DFARS clauses and the nature of the information they handle, Level 3 applicability is determined by the DoD. A contracting officer or program office specifies in the solicitation or contract that Level 3 is required.

The programs where Level 3 is likely to apply share certain characteristics: they involve weapons systems, critical defense technologies, or sensitive acquisition programs that represent high-value intelligence targets. Contractors supporting hypersonic weapons programs, advanced aircraft development, sensitive communications infrastructure, or critical logistics systems for priority defense capabilities are examples of the program types where Level 3 requirements are most likely to appear.

For most of the defense industrial base, Level 3 is not in scope. The DoD has estimated that a relatively small percentage of contractors — those at the tip of the spear on the most sensitive programs — will face Level 3 requirements. But for those that do, the compliance burden is substantial, and the assessment process involves a level of government oversight that Level 2 does not.

If you’re uncertain whether your program could require Level 3, reviewing your contract’s data requirements list, the program’s security classification guidance, and consulting with your contracting officer will clarify the picture. A vCIO with deep defense sector experience can help interpret what the contract language signals about likely CMMC requirements before you commit to a compliance architecture.

The 24 Enhanced Requirements: What Level 3 Adds to the Foundation

CMMC Level 3’s 24 additional practices come from NIST SP 800-172, which was specifically designed to address the threat environment posed by advanced persistent threats. Where NIST SP 800-171 establishes a comprehensive security baseline, NIST SP 800-172 adds requirements that specifically address the techniques APT actors use — techniques that a standard security baseline, even a well-implemented one, doesn’t fully counter.

The enhanced requirements span several domains, with particular concentration in areas that APT actors most frequently exploit.

Access Control Enhancements (3.1.x additions)

Level 3 adds access control requirements that go beyond the standard authorization and least-privilege framework of Level 2. These enhancements address:

• Employing dynamic access control approaches that respond to the current security posture of both the user and the system they’re accessing. Static role-based access control, where permissions are assigned at provisioning and rarely revisited, is insufficient at this level. Level 3 expects access decisions to incorporate contextual factors — device health, network location, behavioral signals — in ways that most Level 2 programs don’t address.
• Using secure information sharing techniques that allow CUI to be shared with authorized parties while preventing unauthorized disclosure, even when the authorized party’s environment may not be fully controlled. This reflects the reality that high-value programs often involve collaboration across organizational boundaries where the contractor can’t fully control the downstream security posture.
• Implementing additional access controls for mobile devices and portable storage in environments where APT actors have demonstrated interest in using physical media as an attack vector, including scenarios where air-gapped systems might be targeted through supply chain compromise of media.

Awareness and Training Enhancements (3.2.x additions)

Level 3 requires training that specifically addresses APT tactics, techniques, and procedures (TTPs). This is qualitatively different from standard security awareness training that focuses on phishing, password hygiene, and acceptable use.

Personnel working on Level 3 programs need to understand how nation-state actors approach targeting — the patience involved in long-cycle intrusions, the use of supply chain compromise, the targeting of individuals with access to sensitive data through social engineering that may occur entirely outside of corporate IT systems (through personal email, social media, or even in-person contact). Standard annual security awareness training doesn’t address these TTPs. Level 3-appropriate training requires sector-specific threat intelligence and regular updates as the threat landscape evolves.

Configuration Management Enhancements (3.4.x additions)

The configuration management enhancements at Level 3 address the reality that APT actors frequently exploit known vulnerabilities in the window between disclosure and patching — and that they have the capability and patience to research zero-day vulnerabilities in software commonly used by high-value targets.

• Applying deny-by-default policies for software execution, where only explicitly authorized software is permitted to run on systems processing CUI. Application whitelisting or equivalent technical controls enforce this requirement, and maintaining an accurate allowlist in a dynamic environment is a non-trivial operational challenge.
• Verifying the integrity and correctness of security critical software as defined by the organization. This addresses supply chain attacks where legitimate software is compromised at the developer or distribution level — the type of attack that the SolarWinds incident exemplified.
• Employing automated mechanisms to detect misconfiguration of organizational systems. Manual configuration management is insufficient at this threat level. Automated configuration monitoring that continuously compares deployed settings against authorized baselines and alerts on deviation is expected.

Identification and Authentication Enhancements (3.5.x additions)

Level 3 authentication requirements go beyond the MFA requirement that Level 2 establishes. The enhancements address:

• Employing replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts. Standard MFA implementations can be vulnerable to certain attack techniques — session hijacking, real-time phishing proxies that capture authentication tokens. Level 3’s replay-resistance requirement addresses authentication architectures that remain secure even against these more sophisticated attacks.
• Implementing identity management approaches that support the dynamic and cross-organizational nature of high-value defense program collaboration, while maintaining the accountability and traceability requirements that CUI protection demands.

Risk Assessment Enhancements (3.11.x additions)

The risk assessment enhancements at Level 3 reflect the elevated threat intelligence requirements that APT environments impose:

• Employing threat intelligence from government and commercial sources to inform risk assessments and control decisions. A risk assessment that’s conducted without current threat intelligence about the actors targeting your program type is insufficient at this level. Organizations need to be consuming and applying threat intelligence from sources like the Cybersecurity and Infrastructure Security Agency (CISA) and relevant Information Sharing and Analysis Centers (ISACs) as part of their ongoing risk management process.
• Conducting cyber threat hunting activities on a recurring basis to identify adversary presence in the environment. Threat hunting is not reactive monitoring — it’s proactive searching for indicators of compromise that signature-based detection may miss. APT actors are specifically skilled at operating below the threshold of automated detection. Threat hunting by trained analysts with current threat intelligence is how organizations find what automated monitoring doesn’t.

System and Communications Protection Enhancements (3.13.x additions)

• Isolating security functions from non-security functions and employing separate execution domains for higher-level security functions. This architectural requirement addresses the technique of exploiting security tool vulnerabilities to gain elevated privileges.
• Implementing architectural designs, software development techniques, and systems engineering principles that promote security from the initial design phase rather than adding it later. For organizations involved in developing defense systems rather than just using them, this connects CMMC compliance to the secure-by-design principles that the DoD increasingly expects across the defense industrial base.

System and Information Integrity Enhancements (3.14.x additions)

• Using threat indicator information relevant to the information and systems being protected to improve the organization’s ability to detect malicious activity. This connects the threat intelligence consumption requirement from risk assessment to the operational security monitoring function.
• Employing advanced automated security analysis tools and techniques as part of the organization’s security operations. The specific capabilities expected here — behavioral analysis, anomaly detection, advanced malware analysis — go beyond the endpoint protection and SIEM configurations that satisfy Level 2 monitoring requirements.

The Level 3 Assessment Process: Government-Led, Not C3PAO-Led

This is perhaps the most structurally significant difference between Level 2 and Level 3. While Level 2 assessments are conducted by accredited C3PAOs operating independently of the government, Level 3 assessments are conducted by the Defense Contract Management Agency (DCMA) Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).

The DIBCAC assessment is a government-led, government-controlled process. The assessment team consists of government employees and contractors working under DCMA oversight, not private-sector assessors. The assessment scope, methodology, and outcomes are under government control in a way that C3PAO assessments are not.

The practical implications of this distinction are significant:

• The scheduling is government-controlled. Unlike C3PAO assessments where the contractor can select an assessor, negotiate a timeline, and sequence the assessment relative to their readiness, DIBCAC assessments are scheduled according to government capacity and program priority. Contractors don’t choose when they’re assessed.
• The access requirements are more extensive. Government assessors conducting DIBCAC assessments may require access to systems, facilities, and personnel beyond what a C3PAO assessment involves. The nature of the programs where Level 3 applies creates a higher-stakes assessment environment where the government takes a more direct interest in the outcome.
• The prerequisite is Level 2 certification. Before a DIBCAC assessment for Level 3 can occur, the contractor must hold a valid CMMC Level 2 certification from a C3PAO assessment. Level 3 is not a path contractors can pursue directly — it builds on a demonstrated Level 2 foundation.
• The findings carry direct program implications. A significant finding in a DIBCAC assessment doesn’t just affect a CMMC certification status — it may directly affect the program office’s decisions about continued contracting with the affected organization.

Building a Level 3-Ready Program: What’s Different From Level 2

Organizations that have built mature Level 2 programs have a meaningful foundation for Level 3 — but the gap between a well-implemented Level 2 program and a Level 3-ready program is substantial enough that it requires a distinct program investment, not just incremental additions.

The areas where the investment is most significant:

• Threat intelligence integration. Level 2 programs can function without formal threat intelligence consumption. Level 3 cannot. Organizations need sources of relevant, current threat intelligence — government feeds like the CISA threat advisories, sector-specific ISAC feeds, and potentially commercial threat intelligence subscriptions — and they need processes for translating that intelligence into control decisions and operational adjustments. This is a capability that doesn’t exist in most Level 2 programs and needs to be built from scratch.
• Advanced security operations. The monitoring, detection, and threat hunting requirements at Level 3 require a security operations function that goes significantly beyond the log review and alert response that satisfies Level 2. Whether that’s an internal security operations center, a managed security service provider operating within the Level 3-scoped environment, or a hybrid model, the operational capability needs to be in place and demonstrable. Reactive monitoring won’t pass a DIBCAC assessment at this level.
• Supply chain security at depth. Level 3’s enhanced configuration management and system integrity requirements specifically address supply chain attack vectors. Organizations need to evaluate the security posture of their software suppliers, verify the integrity of software updates before deployment, and have mechanisms for detecting compromise in software they’ve received through legitimate channels. This is a capability area that’s still developing across the defense industrial base, and the NIST supply chain risk management guidelines provide the foundational framework.
• Architectural maturity. The security architecture requirements at Level 3 — separate execution domains for security functions, deny-by-default software execution, dynamic access control — require deliberate architectural investment that can’t be retrofitted quickly onto an existing environment. Organizations that anticipate Level 3 requirements need to build these architectural principles into their environment from the ground up, or plan for significant re-architecture as part of the Level 3 compliance program.

A compliance program built for Level 3 looks different from one built for Level 2 not just in what controls are implemented but in the operational sophistication of how they’re managed. The continuous compliance principles we covered in our guide on building a continuous compliance program apply at Level 3, but with higher stakes and less tolerance for operational gaps.

Level 3 and Supply Chain: Flow-Down Implications

One area that Level 3 contractors need to address carefully is the flow-down of requirements to their subcontractors. If a prime contractor holds Level 3 requirements, the CUI that flows to subcontractors on that program may carry the same sensitivity — and therefore the same compliance requirements — as the CUI handled by the prime.

This creates a supply chain management challenge: Level 3 contractors need to evaluate whether their subcontractors handling program CUI are operating at an appropriate compliance level, and in some cases that may mean Level 3 requirements flow down to subcontractors who may not yet understand what that means for them.

The flow-down obligation isn’t new — it exists at Level 2 as well — but at Level 3 the stakes and the compliance complexity are both higher. For manufacturing and engineering organizations that operate in tiered supply chains on sensitive defense programs, understanding both their own Level 3 obligations and what they need to require of their subcontractors is a critical early step in program planning.

Our earlier coverage of how third-party vendors affect your CMMC compliance covers the vendor risk management principles that apply at both levels, though Level 3 contexts require even more rigorous third-party due diligence than Level 2 does.

Common Gaps When Organizations Transition From Level 2 to Level 3

Organizations that have achieved Level 2 certification and are now preparing for Level 3 face a specific challenge: they’ve built a mature program, and it’s still not enough. The gaps that consistently emerge in this transition tend to cluster in a few areas.

• Threat intelligence is consumed but not operationalized. An organization may subscribe to threat intelligence feeds and have personnel who read the reports, but the intelligence doesn’t systematically influence control decisions, hunting activities, or risk assessments. Level 3 expects operationalized intelligence — where what you know about current threats changes what you do.
• Monitoring is reactive rather than proactive. The SIEM is running, alerts are being reviewed, and known indicators are being detected. But threat hunting — proactive searching for signs of adversary presence that hasn’t triggered alerts — isn’t happening on a defined schedule with documented methodology and outcomes. This is a significant gap at Level 3.
• Software supply chain verification is aspirational rather than operational. The policy says software integrity is verified before deployment. The practice is that software updates are applied when available and assumed to be legitimate. The verification mechanism — cryptographic signature checking, vendor attestation review, independent integrity verification — exists on paper but not in the operational workflow.
• Architectural debt from Level 2 assumptions. The environment was designed to meet Level 2 requirements, and it does. But Level 3’s architectural requirements — deny-by-default software execution, isolated security function domains, dynamic access control — weren’t built in and can’t be added without significant environment changes.

Understanding where these gaps exist before the DIBCAC assessment requires either an honest internal evaluation against the Level 3 control set or a readiness assessment from a partner with Level 3 familiarity. Given that CMMC scoping decisions made at the Level 2 stage may need to be revisited for Level 3, that evaluation should start early — well before DIBCAC scheduling becomes a near-term reality.

Conclusion: Level 3 Demands Program Depth, Not Just Control Addition

CMMC Level 3 is not Level 2 with 24 more boxes to check. It’s a qualitatively different compliance regime that expects operational sophistication in threat intelligence, security operations, supply chain risk management, and security architecture that most defense contractors — even mature Level 2 organizations — haven’t yet built.

The contractors that will navigate Level 3 successfully are the ones that treat it as a program maturity target rather than a compliance checklist. They’re consuming and operationalizing threat intelligence. They’re hunting, not just monitoring. They’re verifying software integrity as an operational practice. They’ve built their environments with Level 3 architectural principles in mind, not retrofitted them after the fact.

That level of program maturity requires experienced partners who understand both the framework and the threat environment it was designed to address.

If your organization is planning its CMMC compliance journey, contact Stealth Technology Group today at (617) 903-5559 or visit the website to learn how modern cybersecurity infrastructure can accelerate your path toward certification readiness.