Editor's note: CMMC has been updated several times since this post was first published, most recently when the Department of War suspended Phase 2 in July 2026. We have also rebranded: Intech Hawaii is now Intech Pacific. We updated this post in October 2026 to reflect the current state of the program. For the latest information, see our CMMC Overview and our CMMC Calendar.
Last updated: October 2026
CMMC Level 3 is the highest of the three CMMC Levels. Guam contractors will see it least often, but it is the hardest to reach. It applies to contractors handling CUI on the Department of War's most sensitive programs. To reach Level 3, a contractor must first hold a Level 2 certification from a C3PAO, then meet 24 additional requirements from NIST SP 800-172. The Level 3 assessment is performed by the government's DIBCAC, not by a C3PAO, and repeats every three years. Very few companies will need it: the DoD estimated about 1,487 entities. For Guam contractors supporting high-priority defense work in the region, it is worth understanding now, because the path runs through Level 2 first.
What Is CMMC Level 3?
CMMC Level 3 protects Controlled Unclassified Information against advanced persistent threats (APTs). These are well-resourced, often state-sponsored attackers who target specific programs over long periods.
Level 3 builds on Level 2. It does not replace it. A Level 3 contractor must meet:
- All 110 requirements of NIST SP 800-171 Revision 2, verified by a C3PAO at Level 2.
- 24 selected requirements from NIST SP 800-172, verified by DIBCAC.
The original version of this post said Level 3 had 130 practices made up of "72 Level 2 controls plus 58 advanced practices," and that a C3PAO performs the assessment. Both statements are wrong. Level 2 has 110 requirements, Level 3 adds 24, and DIBCAC performs the Level 3 assessment.
What Do the 24 NIST SP 800-172 Requirements Cover?
NIST SP 800-172 is a set of enhanced security requirements designed to resist APTs. CMMC Level 3 uses 24 of them, with parameters defined by the DoW.
The selected requirements focus on capabilities beyond the Level 2 baseline, including:
- Threat hunting and a security operations capability that actively looks for intrusions.
- Penetration testing and resistance to persistent attackers.
- Supply chain risk management.
- Advanced security awareness training focused on APT tactics and social engineering.
- Automated asset inventory and detection of unauthorized components.
- Stronger isolation and segmentation of systems that handle CUI.
These are not tools you buy and switch on. Most require staff, processes, and evidence that the capability is used continuously.
CMMC Levels in Guam: Who Needs Level 3 Certification?
You need Level 3 only if a DoW solicitation or contract specifies it. Level 3 is reserved for a small set of programs where the DoW has determined the CUI is a high-value target.
Some indicators that Level 3 could be in your future:
- You support high-priority programs as a prime or a key subcontractor.
- Your prime has told you to expect Level 3 requirements.
- You already hold, or are pursuing, Level 2 C3PAO certification for related work.
Most small contractors in Guam and Hawaii will need Level 1 or Level 2, not Level 3. A subcontractor working under a Level 3 prime contract generally needs at least Level 2 (C3PAO) for the CUI it handles.
Guam deserves a specific note. Local resources are thinner than in Hawaii. Guam has fewer providers, higher costs, and longer lead times. A Level 3 program requires capabilities, such as continuous security monitoring, that are harder to staff locally. Plan earlier than you think you need to. Our CMMC Guam team can help you map out what that plan looks like on island.
Where Does Level 3 Stand After the 2026 Pause?
Level 3 was scheduled to begin appearing in solicitations in Phase 3, on November 10, 2027. The July 13, 2026 DoW memo suspended Phase 2 and all pending and future implementation milestones, which includes that date.
What remains in place:
- 32 CFR Part 170, which defines Level 3.
- DIBCAC's authority to conduct assessments.
- DFARS 252.204-7012 and NIST SP 800-171 obligations.
- Voluntary Level 2 C3PAO assessments, which are the prerequisite for Level 3.
At the time of this update, the CMMC Reform Task Force report has not been published and no new rule has been proposed. Any Level 3 timeline is uncertain. The Level 2 prerequisite is not.
Steps to Prepare for CMMC Level 3
If Level 3 is likely for your company, this is the order of work.
- Confirm the requirement. Get written confirmation from your contracting officer or prime that Level 3 applies, and to which systems.
- Scope carefully. Define exactly which people, systems, and locations handle the high-value CUI. A tight scope reduces cost at both Level 2 and Level 3.
- Achieve Level 2 C3PAO certification. All 110 requirements must be met for a final certification, and any POA&M items must close within 180 days. Without this, there is no Level 3.
- Run a gap assessment against the 24 NIST SP 800-172 requirements. Identify which capabilities you have, which you can build, and which you should obtain from a qualified provider.
- Build the capabilities. Threat hunting, security operations, and supply chain risk management take time to stand up and produce evidence.
- Document everything. Update the System Security Plan to cover the enhanced requirements in detail. In my experience, SSPs are most often not detailed enough, and Level 3 raises the bar further.
- Prepare people for DIBCAC. Assessors examine documents, interview staff, and test controls. Someone must be able to explain the program clearly.
- Maintain it. Level 3 is reassessed every three years, with annual affirmations in between.
For most companies, step 3 is where the real work is, and it is where our support usually begins.
Build Your Path to Level 3 With Intech Pacific
The path to Level 3 starts with a strong Level 2 program. Intech Pacific is the only CMMC Level 2 certified MSP in Hawaii and Guam, and we have taken more companies through C3PAO certification than every other company in Hawaii and Guam combined.
To see how we help contractors in Hawaii and Guam, from a free readiness session to fully managed compliance, visit our CMMC Solutions page.
