CMMC Phase 3 Requirements and Level 3 Guide

Published Date: October 23, 2026 Author: Nikhil Raj

Category: Blogs Tags: CMMC

CMMC Phase 3 extends certification to option periods and introduces Level 3 DIBCAC assessments. Learn what it requires, its suspension status and how to prepare.

TL;DR

CMMC Phase 3 was scheduled to begin November 10, 2027, when the Department of War intended to require Level 2 (C3PAO) certification to exercise option periods and Level 3 (DIBCAC) certification for applicable contracts at award.
Phase 3 is on hold, because the July 13, 2026, suspension paused Phase 2 and every later CMMC milestone pending a reform review.
Contractors expecting Level 3 should still plan early, since it requires a Final Level 2 certification first plus 24 enhanced NIST SP 800-172 requirements assessed by the government.

Most CMMC planning has centered on Phase 2 and the shift to third-party Level 2 certification. For contractors supporting the Department of War’s (DoW’s) most sensitive programs, CMMC Phase 3 is the more consequential milestone. It was designed to extend certification into option periods on existing awards and to introduce government-led Level 3 assessments, two changes that affect revenue already under contract as well as new pursuits.

That timeline is now uncertain. The DoW suspended Phase 2 and all later milestones in July 2026, so the original Phase 3 start date no longer works as a fixed deadline. The requirements themselves remain in the program rule, which is why leaders need to understand what CMMC Phase 3 asks for, who it affects and how to prepare without a confirmed date.

What Is CMMC Phase 3?

CMMC Phase 3 is the third of four implementation phases defined in 32 CFR 170.3(e), scheduled to begin one calendar year after Phase 2. It adds two requirements to those of Phases 1 and 2:

Level 2 (C3PAO) for option periods: Level 2 third-party certification becomes a condition of award for applicable contracts and a condition for exercising option periods on contracts awarded after the CMMC acquisition rule took effect on November 10, 2025.
Level 3 (DIBCAC) at award: Level 3 becomes a condition of award for all applicable solicitations and contracts, although the DoW may delay it to an option period at its discretion.

For a refresher on how the levels differ, see our guide to CMMC 2.0 levels and requirements.

Phase	Original Start Date	Primary Change
Phase 1	November 10, 2025	Level 1 or Level 2 self-assessment at award
Phase 2	November 10, 2026	Level 2 (C3PAO) certification at award
Phase 3	November 10, 2027	Level 2 (C3PAO) for option periods; Level 3 (DIBCAC) at award
Phase 4	November 10, 2028	Full implementation, including option periods on older contracts

Is CMMC Phase 3 Still Happening in 2027?

CMMC Phase 3 is on hold. The July 13, 2026, DoW CIO memorandum suspended the Phase 2 transition along with all pending and future implementation milestones, which covers Phases 3 and 4.

A CMMC Reform Task Force finished its 60-day review in September 2026, but its recommendations had not been published as of mid-October 2026. Because each phase starts one year after the previous one, a revised Phase 2 date would likely move Phase 3 as well. Our analysis of the CMMC Phase 2 suspension and C3PAO readiness explains which Level 2 obligations apply today.

The program rule at 32 CFR Part 170 still defines Level 3 and its assessment process. DoW leadership has also criticized point-in-time assessments, so Level 3 verification could change in form when the program resumes.

What Does CMMC Level 3 Require?

CMMC Level 3 requires a Final Level 2 (C3PAO) certification for the same scope, plus 24 enhanced requirements from NIST SP 800-172 assessed by the Defense Contract Management Agency’s Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). It is intended for Controlled Unclassified Information (CUI) tied to the DoW’s highest-priority programs.

Level 3 Assessment Rules

Prerequisite: Final Level 2 (C3PAO) status, with a Level 3 scope equal to or smaller than the Level 2 scope.
Assessor: DIBCAC conducts the assessment, not a C3PAO.
Conditional status: A limited Plan of Action and Milestones (POA&M) is allowed, but certain requirements cannot be deferred, and open items must be closed and verified within 180 days.
Validity: Three years, with an annual affirmation in SPRS and a Level 2 (C3PAO) renewal every three years.

What the Enhanced Requirements Cover

NIST SP 800-172 targets advanced persistent threats (APTs). The selected requirements address threat intelligence and threat hunting, security operations and rapid incident response, penetration testing, supply chain risk management, APT-focused awareness training and stronger protection for critical assets. Our overview of NIST security standards explains how SP 800-172 builds on SP 800-171.

Level 3 also tightens scoping. Contractor Risk Managed Assets are treated as CUI assets in a Level 3 assessment, so the boundary often grows compared with Level 2.

Which Contracts Will CMMC Phase 3 Affect?

CMMC Phase 3 affects contractors holding option periods on contracts awarded since November 10, 2025, and contractors pursuing programs designated for Level 3.

Option-period holders: A contract awarded with only a self-assessment requirement could need Level 2 (C3PAO) certification before its next option is exercised, which puts awarded revenue at risk.
Level 3 candidates: The DoW assigns Level 3 based on the sensitivity of the CUI involved, so it will apply to a smaller set of programs.
Subcontractors: When a prime requires Level 3, any subcontractor that processes, stores or transmits CUI under that subcontract needs at least Level 2 (C3PAO).

How Should Contractors Prepare for CMMC Phase 3?

Contractors should secure Level 2 certification first, because a Level 3 assessment cannot start without Final Level 2 status, and then build Level 3 capabilities in stages.

Map option-period dates: List contracts awarded since November 10, 2025, and compare option dates with likely Phase 3 timing.
Confirm Level 3 exposure: Ask contracting officers and primes which programs may carry a Level 3 requirement.
Achieve Final Level 2 status early: C3PAO capacity is limited, and Level 3 depends on it.
Gap-assess the 24 requirements: Test current monitoring, response, testing and supply chain controls against NIST SP 800-172.
Build operational capabilities: Managed SOC and threat hunting services can close the hardest Level 3 gaps faster than building in-house.
Validate cloud dependencies: Confirm providers handling CUI meet FedRAMP requirements or equivalent.

What Are the Common CMMC Phase 3 Readiness Gaps?

Most Phase 3 gaps come from treating Level 3 as a small extension of Level 2 rather than a larger operational commitment.

Monitoring and incident response that cover business hours only.
Supply chain risk plans that exist in policy but not in practice.
Scoping plans that ignore how Contractor Risk Managed Assets change at Level 3.
Option-period dates that nobody tracks against CMMC milestones.
An assumption that the suspension cancelled Level 3.

What Should Organizations Do Next?

Organizations should use the suspension to complete Level 2 certification and assess Level 3 readiness, since both will take longer than the time between a revised schedule and the first affected award. Ampcus Cyber’s CMMC compliance services support scoping, Level 2 readiness and NIST SP 800-172 gap assessments.

Why CMMC Phase 3 Still Matters

CMMC Phase 3 is where certification reaches existing contracts and government-led assessment reaches the most sensitive programs. The date is suspended, but the requirements remain in the rule, and the preparation path runs through Level 2 regardless of timing.

Find out how far your environment is from Level 3 before Phase 3 is rescheduled.

Speak with Ampcus Cyber’s CMMC team for a Level 2 and NIST SP 800-172 readiness assessment.