Most defense contractors know they need CMMC Level 2. The question that generates the most confusion is whether they also need Level 3. The answer is not always obvious, and getting it wrong in either direction is expensive. Pursuing Level 3 when you only need Level 2 wastes hundreds of thousands of dollars. Assuming you only need Level 2 when your contracts require Level 3 means you cannot bid on the work. This guide helps you make the right call.
The Core Difference
CMMC Level 2 requires implementation of all 110 NIST SP 800-171 Rev 2 security requirements. Level 3 requires everything in Level 2 plus 24 additional security requirements selected from NIST SP 800-53 Rev 5. These additional requirements are specifically chosen to provide enhanced protection against advanced persistent threats (APTs), which is why Level 3 is sometimes called the "APT protection" level.
Level 2 vs. Level 3 at a Glance
Level 2: Advanced
- Controls: 110 (NIST 800-171 Rev 2)
- Assessment: C3PAO (third-party)
- Frequency: Triennial
- Focus: CUI protection
- Threat Model: General cybersecurity threats
- Cost Range: $100K-$500K (implementation)
- Timeline: 6-12 months typical
- Prerequisite: None
Level 3: Expert
- Controls: 110 + 24 additional (NIST 800-53)
- Assessment: DIBCAC (government-led)
- Frequency: Triennial
- Focus: APT protection for critical CUI
- Threat Model: Nation-state adversaries
- Cost Range: $300K-$1.5M (implementation)
- Timeline: 12-24 months typical
- Prerequisite: Level 2 certification
When Does CUI Exposure Trigger Level 3?
The decision is not yours to make unilaterally. The requiring activity (the DoD program office) determines whether a contract requires Level 2 or Level 3 based on the sensitivity of the CUI involved and the threat environment. However, understanding the criteria helps you anticipate requirements and plan accordingly.
Level 3 Trigger Indicators
Critical Technology Programs
Programs involving technologies on the DoD Critical Technologies List, including hypersonics, directed energy, quantum computing, AI/ML for military applications, and advanced materials.
High-Value CUI
CUI that, if compromised, would provide a significant intelligence advantage to a nation-state adversary. This includes weapons system designs, operational plans, and intelligence-related information.
Known APT Targeting
Programs or technologies known to be actively targeted by nation-state cyber actors. The intelligence community provides threat assessments that inform these determinations.
Aggregation Risk
Situations where a contractor holds CUI from multiple programs that, when aggregated, creates a higher sensitivity level than any individual program's CUI alone.
The 24 Additional NIST 800-53 Practices
The 24 additional practices required for Level 3 are drawn from NIST SP 800-53 Rev 5 and focus on capabilities that defend against sophisticated, persistent adversaries. These are not basic security hygiene. They represent advanced security capabilities that most commercial organizations do not implement.
Level 3 Additional Practice Areas
Enhanced Access Control
Dual authorization for critical operations, access enforcement with enhanced granularity, and dynamic access control based on risk.
Advanced Audit Capabilities
Cross-organizational audit correlation, audit record reduction and analysis, and automated audit review with anomaly detection.
Enhanced Incident Response
Automated incident handling, dynamic response capabilities, and coordination with external security organizations.
Threat Intelligence Integration
Active threat hunting, integration with threat intelligence feeds, and proactive defense measures based on current threat landscape.
Advanced System Protection
Network segmentation with enhanced monitoring, boundary protection against covert channels, and protection against supply chain threats.
Security Operations
Continuous monitoring with automated response, security operations center capabilities, and real-time security posture awareness.
DIBCAC vs. C3PAO: The Assessment Difference
Level 2 assessments are conducted by commercial C3PAOs accredited by the Cyber AB. Level 3 assessments are conducted by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), which is a government organization within the DoD. This distinction matters for several reasons:
Assessment Process Comparison
C3PAO (Level 2)
- • You select and schedule the C3PAO
- • Commercial relationship (you pay)
- • Multiple C3PAOs available
- • Assessment typically 1-2 weeks on-site
- • Results reported to Cyber AB
- • POA&M allowed with 180-day closeout
- • Certification valid for 3 years
DIBCAC (Level 3)
- • DIBCAC schedules the assessment
- • Government-led (no direct cost to you)
- • Limited DIBCAC capacity
- • Assessment may take 2-4 weeks
- • Results reported directly to DoD
- • Stricter POA&M limitations
- • Certification valid for 3 years
A critical point: you must have a passing Level 2 certification before DIBCAC will conduct a Level 3 assessment. This means your timeline for Level 3 includes the time to achieve Level 2 first. If you need Level 3 by a specific date, work backward from that date and add the Level 2 preparation and assessment time.
Cost and Timeline Implications
Level 3 is significantly more expensive and time-consuming than Level 2. The additional 24 practices require advanced security capabilities that most contractors do not have in place. Here is a realistic cost and timeline breakdown:
Level 3 Cost Drivers
| Cost Category | Level 2 Range | Level 3 Incremental |
|---|---|---|
| Security tooling | $50K-$200K | $100K-$400K |
| Staff / expertise | $50K-$150K | $100K-$300K |
| Documentation | $20K-$80K | $30K-$100K |
| Assessment preparation | $30K-$100K | $50K-$150K |
| C3PAO / DIBCAC assessment | $50K-$150K | N/A (government-led) |
| Total estimated range | $200K-$680K | $280K-$950K additional |
Making the Decision
If you are unsure whether your contracts will require Level 3, here is the practical approach:
1. Check Your Contracts
Review your current and anticipated contracts for CMMC level requirements. The solicitation or contract will specify the required level. If it says Level 2, that is what you need. Do not over-engineer.
2. Talk to Your Program Office
If you work on programs involving critical technologies, ask the program office whether Level 3 is anticipated. They may not have finalized the requirement yet, but they can give you directional guidance.
3. Start with Level 2
Level 2 is a prerequisite for Level 3. Even if you ultimately need Level 3, you must achieve Level 2 first. Starting with Level 2 is never wasted effort.
4. Build with Level 3 in Mind
If Level 3 is a possibility, make architecture decisions during Level 2 implementation that will make the Level 3 upgrade easier. Choose security tools that support advanced capabilities. Design your network segmentation with enhanced monitoring in mind.
Unsure Whether You Need Level 2 or Level 3?
AeoliTech helps contractors assess their CMMC level requirements and build implementation plans that scale from Level 2 to Level 3 when needed.
Schedule a CMMC Readiness CallLeonard Esere
Founder & CEO, AeoliTech
Leonard's experience implementing NIST 800-53 High controls at Los Alamos National Laboratory gives him direct expertise in the advanced security practices required for CMMC Level 3.