What Is the Relationship Between NIST SP 800-172 and CMMC?

CMMC Level 3: The Highest Tier

CMMC Level 3 is reserved for contracts involving the most sensitive CUI — typically programs related to critical national security capabilities. NIST SP 800-172 provides the enhanced security requirements that go beyond the baseline 800-171 controls.

What Makes Level 3 Different

• 134 total requirements: 110 from NIST SP 800-171 + 24 selected from NIST SP 800-172
• Focus on APTs: 800-172 controls are specifically designed to counter Advanced Persistent Threats (nation-state actors)
• DIBCAC assessment: Level 3 assessments are conducted by the Defense Industrial Base Cybersecurity Assessment Center, not C3PAOs
• Higher technical bar: Requirements include dual authorization, system hardening beyond baseline, and advanced monitoring

Who Needs Level 3?

Very few contracts will require Level 3. The DoD has indicated that Level 3 will be applied to specific programs where the consequences of CUI compromise would be severe. If your contract requires Level 3, it will be explicitly stated in the solicitation.

Most defense contractors will only need Level 1 or Level 2. Don't over-invest in Level 3 preparation unless your contracts specifically require it.