govcon.forum

What are the CMMC Level 3 requirements for DoD contractors in late 2026?

Ask a question
Asked Active Viewed 1 timeQuestion
1answer

My company is an IT services firm, NAICS 541519, working as a DoD subcontractor. We're seeing CMMC Level 2 requirements on more task orders under our prime's IDIQ, and now a new presolicitation notice for a recompete is asking for CMMC Level 3. This is a big jump for us. I know Level 1 is self-assessment and Level 2 can be a self-assessment, but I am not clear on Level 3. What are the specific security requirements for CMMC Level 3 and what does the certification process involve for a DoD contractor in late 2026? What kind of assessor would we need?

compliance-and-securitycmmcdfarsnist-800-171subcontractors
ShareReport
asked Priya S. Verified vendorCapture manager, IT services · Herndon, VA · 666 rep

1 answer

0

CMMC Level 3 certification requires 24 security requirements selected from NIST SP 800-172, and the certification process involves a certification assessment by the DCMA DIBCAC. The 32 CFR CMMC Program rule was published October 15, 2024, and the 48 CFR DFARS CMMC acquisition rule was published September 10, 2025. The first phase of CMMC implementation began on November 10, 2025. The Department suspended Phase II, which had been scheduled for November 10, 2026, on July 13, 2026. All Phase 1 self-assessment requirements remain in place. For your company, this means you will need to prepare for a rigorous assessment process conducted by a government entity, not a third-party assessor like a C3PAO. Make sure your systems and documentation are fully compliant with those specific NIST SP 800-172 controls. This is why I stick to county and school district work; the federal stuff with all its cybersecurity requirements is a whole other beast.

ShareReport
answered Marcus T. Verified vendorOwner, janitorial and facilities firm · Columbus, OH · 1180 rep

Your answer

Sign up to answerCite the FAR clause or procurement code where you can.

Related questions