Home › CMMC FAQs › CMMC Model
CMMC Model — Official DoD FAQ

What Is the Relationship Between NIST SP 800-172 and CMMC?

💼
Facing Level 3 requirements? Jun Cyber has the expertise to help you meet the highest CMMC tier.
Schedule Free Consultation
Official DoD Answer
Source Source: DoD CIO CMMC FAQs v5 (B-Q5)

NIST SP 800-172 provides security requirements designed to address advanced persistent threats and forms the basis for CMMC Level 3 security requirements. Contractors must implement 24 selected enhanced security requirements from NIST SP 800-172 in addition to the 110 security requirements found in NIST SP 800-171 when the Department identifies CMMC Level 3 as a contract requirement.

In-Depth Analysis

CMMC Level 3: The Highest Tier

CMMC Level 3 is reserved for contracts involving the most sensitive CUI — typically programs related to critical national security capabilities. NIST SP 800-172 provides the enhanced security requirements that go beyond the baseline 800-171 controls.

What Makes Level 3 Different

  • 134 total requirements: 110 from NIST SP 800-171 + 24 selected from NIST SP 800-172
  • Focus on APTs: 800-172 controls are specifically designed to counter Advanced Persistent Threats (nation-state actors)
  • DIBCAC assessment: Level 3 assessments are conducted by the Defense Industrial Base Cybersecurity Assessment Center, not C3PAOs
  • Higher technical bar: Requirements include dual authorization, system hardening beyond baseline, and advanced monitoring

Who Needs Level 3?

Very few contracts will require Level 3. The DoD has indicated that Level 3 will be applied to specific programs where the consequences of CUI compromise would be severe. If your contract requires Level 3, it will be explicitly stated in the solicitation.

Most defense contractors will only need Level 1 or Level 2. Don't over-invest in Level 3 preparation unless your contracts specifically require it.

Have More Questions?

ChatCMMC can answer detailed questions about CMMC compliance, NIST 800-171, assessment preparation, and more — with source citations when available from selected official DoD and NIST sources.

Ask ChatCMMC →

CMMC Readiness Assessment

Find out where your organization stands and what steps you need to take. Jun Cyber's CMMC experts can help you interpret the requirements.

By submitting, you agree to be contacted by Jun Cyber. No spam, ever.

Related Questions

You Might Also Want to Know

CMMC Model

What Is the Relationship Between NIST SP 800-171 and CMMC?

→ CMMC Model

How Will My Organization Know What CMMC Level Is Required for a Contract?

→ CMMC Model

Will CMMC Update to Use NIST SP 800-171 Revision 3?

→
Jun Cyber

Ready to Start Your CMMC Journey?

Jun Cyber helps defense contractors prepare for applicable CMMC requirements. From scoping and gap assessments to documentation, remediation, and C3PAO assessment readiness — Jun Cyber provides hands-on compliance support.

📅 Schedule a Consultation Learn About CMMC Select →