CMMC Level 3

CMMC Level 3

Level 3 focuses on the protection of CUI and encompasses the 110 requirements from NIST SP 800-171 R2 required by DFARS clause 252.204-7012. Additionally, 24 requirements selected from NIST SP 800-172 (Feb 2021), as detailed in table 1 to § 170.14(c)(4)

Level 3 Scoping Guidance
Level 3 Assessment Guide

AC.L3-3.1.2E Organizationally Controlled Assets

AC.L3-3.1.3E Secured Information Transfer

AT.L3-3.2.1E Advanced Threat Awareness

AT.L3-3.2.2E Practical Training Exercises

CM.L3-3.4.1E Authoritative Repository

CM.L3-3.4.2E Automated Detection & Remediation

CM.L3-3.4.3E Automated Inventory

IA.L3-3.5.1E Bidirectional Authentication

IA.L3-3.5.3E Block Untrusted Assets

IR.L3-3.6.1E Security Operations Center

IR.L3-3.6.2E Cyber Incident Response Team

PS.L3-3.9.2E Adverse Information

RA.L3-3.11.1E Threat-Informed Risk Assessment

RA.L3-3.11.2E Threat Hunting

RA.L3-3.11.3E Advanced Risk Identification

RA.L3-3.11.4E Security Solution Rationale

RA.L3-3.11.5E Security Solutions Effectiveness

RA.L3-3.11.6E Supply Chain Risk Response

RA.L3-3.11.7E Supply Chain Risk Plan

CA.L3-3.12.1E Penetration Testing

SC.L3-3.13.4E Isolation

SI.L3-3.14.1E Integrity Verification

SI.L3-3.14.3E Specialized Asset Security

SI.L3-3.14.6E Threat-Guided Intrusion Detection

CMMC Level 2