If your business works with or plans to work with the U.S. Department of Defense or its contractors, CMMC Level 3 may be a contractual requirement for your organization. Level 3 is the highest level of CMMC, and introduces a higher bar to show that your security program can adequately protect Controlled Unclassified Information (CUI).
At Rhymetec, our vCISOs guide companies through compliance readiness every day. We’ve created this CMMC Level 3 Checklist to help you understand the CMMC Level 3 requirements, identify gaps in your current security program, and how to prioritize remediation efforts prior to engaging a C3PAO for certification and pursuing your official government-led assessment.
With the right planning, CMMC Level 3 can be achieved without derailing business growth or overloading your internal teams. If you are unsure of which level of CMMC you need, check out our CMMC Compliance Checklist for Level 2 and our CMMC Level 1 Checklist, or contact our team today for direct, tailored guidance for your organization.
CMMC Level 3 Compliance Checklist: What Are The Steps?
**The CMMC Level 3 Assessment Guide (v2.13) is released by the DoD’s CIO office and provides specific requirements and processes for assessment. Level 3 applies to a narrow subset of contractors working on high-sensitivity DoD programs involving advanced or unique CUI. Organizations should use our checklist as a reference, but also be sure to review the official rule and guide directly while preparing for assessments by DCMA DIBCAC.
CMMC Level 3, also known as the “Expert” level, applies to organizations supporting DoD programs involving highly sensitive or mission-critical CUI. It combines the full NIST 800-171 control set with even more safeguards, pulled from NIST SP 800-172.
Step 1: Reach CMMC Level 2
Your organization must complete a successful Level 2 CMMC assessment by a C3PAO before beginning Level 3. This ensures all 110 NIST SP 800-171 controls are implemented. Once you have fulfilled the requirements for your CMMC Level 2 checklist, you just need to fill in the remaining requirements for Level 3:
Step 2: Implement Necessary NIST SP 800-172 Controls
The next step is to implement selected NIST SP 800-172 controls. The DoD requires adding 24 additional controls from NIST SP 800-172, which are designed to protect CUI against advanced threats. Additionally, you will need to update your System Security Plan from Level 2 to describe how both the 110 base controls and the 24 additional controls are implemented.
Step 3: Defining Your Assessment Scope
Use the official Level 3 Scoping Guide to categorize which CUI-bearing assets and surrounding systems are in scope. You need to confirm that unrelated systems (such as public WiFI or non-CUI devices) aren’t included.
Step 4: Undergo A Government-Led Assessment
Level 3 requires a government-led assessment by DCMA DIBCAC every three years, plus annual affirmations by the organization’s Affirming Official. The Level 2 (C3PAO) annual affirmation for the same scope must also continue.
The DoD’s Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)’s role in CMMC is to conduct assessments every three years for organizations that need CMMC Level 3. This leads us into Step 5:
Step 5: Maintain and Renew Your Certification
According to official DoD documentation, here are the certification requirements for CMMC Level 3:
Source: U.S. Department of Defense
Level 3 DIBCAC certifications require renewal every three years, and organizations have to also submit confirmation of compliance every year.
CMMC Level 3 Checklist: Timelines
The time required to meet CMMC requirements varies depending on your organization’s size, industry, and whether or not you already comply with NIST 800-171 or a similar framework. Below are timelines to show what an average organization can expect for Levels 1, 2, and 3.
Working with a vCISO can streamline the process and fast-track you to audit readiness. Rhymetec works closely with trusted auditing partners and can connect you with them for your assessment.
**Note: The following timeline assumes that the organization will start with a gap assessment and follow a typical implementation plan. Organizations that are already aligned with NIST 800-171 can generally proceed faster.
CMMC Level 3 Timeline (9-12 Months)
Gap Assessment and Planning: 1-2 Months
- Gap assessment aligned with NIST 800-171 and advanced controls
- Mapping FCI and CUI
- Initial drafting of documentation
- Create an implementation roadmap
Advanced Technical Controls and Procedural Controls: 6-7 Months
- Network segmentation and access control
- SIEM integration and centralized logging
- Advanced endpoint configuration and hardening
- Security policy creation and approval
- Incident response plan
- …and more.
Validation and Final Preparation For Your Assessment (2-3 Months)
- Vulnerability scan and pen test
- Finalize documentation
- Undergo an official government-led audit
**Note: Level 3 readiness can be accelerated if your organization has already implemented FedRAMP or other NIST-based frameworks. Organizations with complex cloud environments can require more time for controls such as segmentation and advanced logging. The support of a vCISO from the beginning can vastly speed things up!
What About Other Federal Regulations? FedRAMP and CMMC
Many organizations are unsure whether they need to meet CMMC, FedRAMP, or both:
“Being in a marketplace where we’re working with a lot of cloud service providers and a lot of software application services, that’s one of the most common questions we get. There are significant differences between the two frameworks, but there are also a lot of overlapping controls.” – Metin Kortak, CISO at Rhymetec
CMMC applies to DoD contractors and subcontractors working with CUI or FCI, and maps directly onto the NIST SP 800-171 security controls.
FedRAMP is designed for cloud service providers that offer IaaS, PaaS, or SaaS to civilian federal agencies. It is based on NIST SP 800-53, and uses impact-level baselines (Low, Moderate, and High).
“If you are a cloud service provider and you are working with the Department of Defense, there is a likely chance you need to comply with both CMMC and FedRAMP. A lot of organizations in this position will choose to pursue FedRAMP first. If you comply with FedRAMP and you implement all of the controls, you’re already implementing the majority of the controls you’ll need for CMMC. The remaining work for CMMC will be working with auditors and gathering documentation.” – Metin Kortak, CISO at Rhymetec
Both frameworks require foundational security measures, including access controls, incident response, and continuous monitoring. However, FedRAMP imposes a broader and deeper set of both technical and documentation requirements, especially around cloud-hosted services.
The good news is there’s substantial overlap—especially at FedRAMP Moderate—but the organization is still responsible for meeting all NIST SP 800-171 Rev. 2 objectives across the CMMC scope. FedRAMP-authorized CSPs help, but you must still map, evidence, and assess controls for your environment.
Organizations that need both will often opt to do FedRAMP first, as they can then leverage that foundation to streamline CMMC compliance. For a deeper dive on the differences between these two federal frameworks (and how to determine which you need), check out our blog on CMMC vs. FedRAMP.
Advantages of Engaging A CMMC Consultant To Help Meet CMMC Level 3 Requirements (The Earlier, The Better!)
The higher levels of CMMC are complex.
If you aren’t already compliant with the relevant NIST frameworks, compliance for Levels 2 and 3 will require implementing a massive amount of technical controls and corresponding documentation. For many companies, it simply isn’t feasible to manage all of this internally.
This is where a virtual CISO (vCISO) comes in. A vCISO acts as a CMMC Consultant, working closely with your team to understand your environment and translating technical requirements into what you actually need to accomplish.
Our vCISOs at Rhymetec support you throughout the entire CMMC preparation process. We conduct your gap assessment, carry out control implementation for the controls you need, finalize documentation, and serve as the main contact point for auditors on your behalf.
**For information on our vCISO pricing options, check out our blog on vCISO pricing.
Outsourcing the bulk of the work required for CMMC is helpful at any point in the compliance process, but is especially transformative during the initial stages. In our experience, especially partnering with startups to meet their compliance goals, working with a vCISO from the beginning allows you to turn an onerous process into a business enabler.
An experienced vCISO will build a security program for your organization that not only meets CMMC and requirements but scales as your business grows. They understand exactly how to structure your compliance program to enable you to more easily meet additional or future requirements in your industry, and can connect you to the best auditing partners in your space. Contact us today to learn more.
Partner For Success: Work With Rhymetec + An Accredited C3PAO
Meeting CMMC requirements is a complex process.
The good news is that you don’t have to do it alone. Our partnership with industry leader A-LIGN, an accredited C3PAO, gives you access to both the security legwork needed to meet requirements as well as certified assessment services.
Together, we help organizations prepare for CMMC with confidence. Whether you are just getting started or finalizing your readiness for an assessment, we’re here to support your compliance journey with security expertise and a trusted C3PAO partner.
C3PAOs are the only organizations authorized by the CyberAB to perform official CMMC assessments. Their involvement is essentially a must-have for any contractor aiming for certification. Meanwhile, as a Registered Provider Organization (RPO), Rhymetec works hand-in-hand with A-LIGN to help you prepare for that assessment.
RPOs are approved to offer consulting and readiness support, and help you implement required controls, remediate gaps, and make sure your security practices and documentation align with CMMC standards. Together with A-LIGN, we are proud to offer this streamlined option for our clients.
About Rhymetec
Our mission is to make cutting-edge cybersecurity available to SaaS companies and startups. We’ve worked with over 1,000 companies to provide practical security solutions tailored to their needs, enabling them to be secure and compliant while balancing security with budget. We enable our clients to outsource the complexity of security and focus on what really matters – growing their business. Contact us today to get started.