Share on LinkedInShare on LinkedIn

ARTICLE · 20 OCTOBER 2025

Recapping CMMC Level 3: Considerations For Government Contractors

Greenberg Traurig
Greenberg Traurig
Contributor
Greenberg Traurig

Greenberg Traurig

Greenberg Traurig, LLP has approximately 3,200 lawyers across 51 locations in the United States,...

View firm profile
Explore more from Greenberg Traurig

On Sept. 10, 2025, the Department Defense (DoD) issued a final rule amending the Defense Acquisition Regulation Supplement (DFARS) to implement the Cybersecurity Maturity Model Certification (CMMC)...

United StatesGovernment, Public Sector
Go-To Guide:
  • Starting November 2026, contractors and subcontractors handling controlled unclassified information (CUI) that must be protected against advanced persistent threats may be required to certify at the highest CMMC Level 3
  • The Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) will conduct CMMC Level 3 assessments, which will require a final CMMC Level 2 status as a prerequisite.
  • To meet the Level 3 requirements, a contractor must implement certain baseline security controls against NIST SP 800-171 rev. 2 and NIST SP 800-172, have a minimum assessment score of 80%, and annually affirm compliance with both Level 2 (C3PAO) and Level 3 security controls.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

See more popular content from