Most DoD contractors focus their CMMC planning on Level 2. But if your company supports sensitive national security programs, you may be looking at Level 3 requirements — and the gap between the two levels is significant.
This article explains exactly what differentiates CMMC Level 2 and Level 3, who actually needs each one, how assessments differ, and what the cost and complexity implications are for your business.
A Quick Reminder: The Three CMMC Levels
CMMC 2.0 has three certification levels:
- Level 1 (Foundational): 17 basic safeguarding practices. Annual self-assessment. For contractors handling FCI but not CUI.
- Level 2 (Advanced): All 110 NIST SP 800-171 requirements. Self-assessment or C3PAO assessment depending on contract type. For most contractors handling CUI.
- Level 3 (Expert): All Level 2 requirements plus additional requirements from NIST SP 800-172. Government-led assessment. For contractors supporting the most sensitive DoD programs.
The overwhelming majority of defense contractors fall under Level 1 or Level 2. Level 3 is reserved for a small subset of the industrial base.
What CMMC Level 2 Requires
Level 2 is defined by the 110 security practices in NIST SP 800-171, organized across 14 control families:
Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.
The intent of Level 2 is to protect Controlled Unclassified Information from the kinds of threats that most defense contractors actually face — opportunistic attacks, phishing, insider threats, and credential theft.
Who needs Level 2? Any DoD contractor or subcontractor whose contracts involve CUI. If your contract includes DFARS clause 252.204-7012, you are handling CUI and you are in scope for Level 2.
Assessment requirement for Level 2: Depends on the specific contract.
- Non-prioritized acquisitions: Annual self-assessment with senior official affirmation in SPRS
- Prioritized acquisitions (involving more sensitive CUI): Third-party assessment by a certified C3PAO
What CMMC Level 3 Requires
Level 3 builds directly on Level 2. To achieve Level 3, you must first satisfy all 110 NIST 800-171 requirements from Level 2, then implement additional requirements drawn from NIST SP 800-172.
NIST SP 800-172 is an enhancement publication designed to address advanced persistent threats (APTs) — the kinds of sophisticated, nation-state-sponsored attacks targeting the defense industrial base. The additional Level 3 controls address areas like:
- More stringent access control and privilege management requirements
- Enhanced cryptographic protections
- Advanced threat detection and security information and event management (SIEM) capabilities
- Supply chain risk management controls
- More rigorous incident response and recovery capabilities
Who needs Level 3? Contractors specifically identified by DoD as supporting programs with the highest national security sensitivity. This is not a self-determined category — DoD will specify Level 3 requirements in specific solicitations. If your contracts do not mention Level 3, you almost certainly do not need it.
Assessment requirement for Level 3: A government-led assessment conducted by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). There is no option for self-assessment or C3PAO assessment at Level 3.
Key Differences Side by Side
| CMMC Level 2 | CMMC Level 3 | |
|---|---|---|
| Security framework | NIST SP 800-171 (110 requirements) | NIST SP 800-171 + NIST SP 800-172 additions |
| Who it applies to | Most DoD CUI contractors | Most sensitive DoD program contractors |
| Assessment type | Self-assessment or C3PAO | DIBCAC (government) |
| Assessment frequency | Annual (self) or triennial (C3PAO) | Per DIBCAC schedule |
| Threat focus | Common adversarial tactics | Advanced persistent threats (APTs) |
| Typical cost to achieve | $50K–$500K+ | Significantly higher |
| % of contractors affected | Majority of DoD supply chain | Small minority |
How to Know Which Level You Need
Your contracts and solicitations will tell you. Look for:
- CMMC Level 2 indicators: DFARS clause 252.204-7012, references to CUI handling, NIST 800-171 compliance requirements
- CMMC Level 3 indicators: Explicit CMMC Level 3 requirement in the solicitation, DIBCAC assessment references, program-specific cybersecurity requirements above standard CUI handling
If you are unsure, contact your contracting officer or prime contractor to clarify what level applies. Do not assume Level 3 applies — it is a specific designation for specific programs.
Why the Assessment Difference Matters
The difference between a C3PAO assessment and a DIBCAC assessment is not just procedural — it affects how you prepare, how long the process takes, and what level of evidence you need.
C3PAO assessments (Level 2) are conducted by independent, commercial firms that are authorized and trained by the CMMC Accreditation Body (CyberAB). You select your C3PAO from the authorized marketplace, schedule your assessment, and work through a defined process.
DIBCAC assessments (Level 3) are conducted by government officials with direct DoD authority. The process is more intensive, schedules are government-controlled, and the level of scrutiny is higher. Companies that have achieved Level 2 and maintained strong controls are in the best position for Level 3, but the additional 800-172 requirements represent a meaningful uplift.
The Cost Implications
Achieving CMMC Level 2 is not cheap. Depending on your company size, current security posture, and the complexity of your IT environment, Level 2 compliance can cost anywhere from $50,000 to more than $500,000 to fully implement — including technology investments, policy development, training, and assessment costs.
Level 3 is more expensive still. The additional NIST 800-172 controls often require specialized security tooling (SIEM, advanced endpoint detection, supply chain risk management systems) and the operational discipline to run them effectively. DIBCAC assessment preparation typically requires more extensive documentation and evidence gathering than a C3PAO assessment.
The right question is not 'which level is cheaper?' but 'which level do my contracts actually require?' Pursuing Level 3 when your contracts only require Level 2 is a significant unnecessary investment. Failing to achieve Level 3 when your contracts require it means losing access to the programs that require it.
Build Toward Level 2 First
For the vast majority of defense contractors, Level 2 is the right immediate target. A solid Level 2 posture — all 110 NIST 800-171 requirements fully implemented, a current SSP, and a clean C3PAO assessment — positions you competitively for nearly all DoD contract opportunities.
If your specific programs eventually require Level 3, the work you have done for Level 2 is not wasted — it is the foundation. Level 3 is built on top of Level 2, not separate from it.
Not sure where you stand on Level 2 readiness today? Take our free CMMC Readiness Assessment to evaluate your current posture across all 14 NIST domains and identify the gaps you need to close.
Frequently Asked Questions
Does CMMC Level 3 apply to subcontractors?
Yes, if the prime contractor flows the requirement down. On highly sensitive DoD programs, primes may require their key subcontractors to achieve Level 3 if those subcontractors handle the sensitive CUI involved in the program.
How long does a DIBCAC assessment take?
DIBCAC assessments are more complex and time-consuming than C3PAO assessments. Timeline depends on program scheduling and DIBCAC capacity, which is more constrained than the commercial C3PAO market.
Can I self-attest for Level 3?
No. Level 3 requires a DIBCAC government-led assessment. There is no self-assessment option at Level 3.
What happens if I start pursuing Level 3 but do not finish before a contract deadline?
This is a significant risk. If a solicitation requires Level 3 certification and you do not hold it by the proposal deadline, you will not be able to bid on or win that award. Plan your certification timeline well in advance of the contract opportunity.