In this series of articles, we explore the different certification requirements of CMMC Levels 1, 2 and 3; the impact on contractors and external service providers; and proposed next steps. Read our initial summary here, our Level 1 summary here and our Level 2 summary here.

On December 26, 2023, the US Department of Defense (DoD) published its long-awaited proposed rule codifying the Cybersecurity Maturity Model Certification (CMMC) Program. Comments on the proposed CMMC rule were due February 26, 2024.

In addition to incorporating the largest number of individual security requirements, CMMC Level 3 applies some of the strictest scoping requirements, while lacking clarity in its standard of applicability. Additionally, Level 3 requires Federal contractors to obtain a perfect score on a Level 2 Certification Assessment by a CMMC Third-Party Assessment Organization (C3PAO) before the Defense Contract Management Agency’s Defense Industrial Base Cybersecurity Assessment Center (DCMA DIBCAC) will conduct the Level 3 assessment. While the uncertainty of applicability and the strict scoping requirements appear burdensome, the narrow subset of contractors to whom Level 3 will apply and the likelihood that these contractors have been tracking CMMC developments may mitigate any burdens. Those contractors required to certify as Level 3 will likely already have a history of compliance with Defense Federal Acquisition Regulation Supplement (DFARS) requirements and experience with government-led assessments.

Commenters on the proposed CMMC rule seem to believe that the DoD will not be able to consistently identify critical information, which would lead to unpredictable application of Level 3. Given the significant financial burden created by Level 3 implementation, the DoD may wish to address this uncertainty.

In Depth

APPLICABILITY

Practically speaking, because the DCMA DIBCAC will perform CMMC Level 3 assessments itself, rather than a third party as with CMMC Level 2 Certification Assessments, it is likely that only contractors required to have a Level 3 assessment for their contract performance will be able to obtain one. This likely means that contractors cannot obtain their certification in advance of their contract, which may be troublesome for contractors that fail their assessment.

Level 3 does not have a clear-cut scope of applicability, unlike Level 1, which is applicable to contractors that handle Federal Contracting Information, and Level 2, which is applicable to contractors that handle Controlled Unclassified Information (CUI). Under the proposed CMMC rule, Level 3 is applicable to contractors that handle particularly sensitive CUI. As a result, CUI requires defense against sophisticated threat actors, or Advanced Persistent Threats (APTs). The proposed CMMC rule does not specify which CUI is considered “particularly sensitive,” providing little insight for contractors to determine whether they would be subject to Level 3. Since this is a subjective standard, it is not clear that Level 3 applicability will be evenly applied across all contractors. Level 3 will most likely be required for the programs and contracts already subject to the National Institute of Standards and Technology’s (NIST) Enhanced Security Requirements for Protecting Controlled Unclassified Information (SP 800-172), as the source of the Level 3 controls. NIST SP 800-172 is intended to apply to programs and contracts processing CUI associated with “a critical program or a high value asset.”

However, most contractors will not need to worry about the additional requirements for Level 3. DoD estimated that Level 3 would only apply to a small subset of government contractors: roughly 1% (CMMC Proposed Rule Preamble, Table 3 – Estimated Number of Entities by Type and Level). The CMMC requirements will not be imposed until DoD updates the related implementing rule, DFARS 252.204-7021. Perhaps more information about when Level 3 will be available will be revealed in the coming months, possibly when updates or replacements to DFARS 252.204-7021 are made to require specific CMMC certification levels in future contracts.

SCOPE

The CMMC Assessment Scope for Level 3 includes the following assets as in scope: CUI Assets, Security Protection Assets and Specialized Assets. For a more in-depth look at the definitions of these assets, please consult our article on CMMC Level 2. These assets are assessed against all CMMC security requirements. Contractors may, however, use intermediary devices (devices that serve as a bridge between a contractor’s operational technology and network) to provide the capability for a Specialized Asset to meet one or more CMMC security requirements. In addition, the Level 2 Certification Assessment must occur prior to the Level 3 assessment and must include the same scope as the Level 3 assessment. This means that a Level 2 Certification Assessment in preparation for Level 3 may have a larger scope than a standard Level 2 Certification Assessment. For example, Specialized Assets undergo a review of the system security plan (SSP) only in a Level 2 Certification Assessment but are assessed against all CMMC security requirements in a Level 3 assessment. When obtaining the precursor Level 2 assessment, those Specialized Assets must be fully assessed during the Level 2 Certification Assessment.

Assets that cannot process, store or transmit CUI and that do not provide security protection for CUI assets are considered out of scope. Contractors should prepare to justify the inability of an Out-of-Scope Asset. For a table of asset categories and their associated descriptions and requirements, see 32 C.F.R. § 170.19(d)(1), Table 2.

REQUIREMENTS

In order to undergo a Level 3 assessment, a contractor must first achieve a Level 2 Final Certification Assessment on systems in the Level 3 assessment scope. A Level 2 Final Certification can only be achieved with a perfect score for the Level 2 assessment by a C3PAO (i.e., an assessment that has closed any open plan of action and milestones (POA&M) items and is not a self-assessment). All Level 2 requirements must result in a finding of MET prior to the Level 3 assessment (more on assessment findings and the MET requirement below).

See the table below for an in-depth description of the Level 3 security requirements (32 C.F.R. § 170.14 (c)(4), Table 1).

ORGANIZATION-DEFINED PARAMETERS

The proposed rule revises the concept of organization-defined parameters (ODPs). Under NIST’s Assessing Enhanced Security Requirements for Controlled Unclassified Information (SP 800-172A), each organization defines its own ODPs to allow for flexibility in assessing the controls of an organization based on its needs. However, for CMMC Level 3, the DoD has defined these ODPs to ensure a level of security commensurate with its expectations for contractors seeking Level 3 certification.

Levels 1 and 2 do not use ODPs. Since Level 2 codifies NIST SP 171 Rev. 2, the ODPs introduced by NIST SP 171 Rev. 3 will not be used by contractors for Levels 1 or 2. However, if the DoD revises the rule to take into consideration updates to NIST SP 171, ODPs may come into play for Levels 1 and 2. Draft Rev. 3 of NIST SP 800-171 adds ODPs and, as we discussed in our CMMC Level 2 article, this may introduce some tension when NIST SP 171 Rev. 3 becomes the current version of NIST SP 800-171 because DFARS 252.204-7012 follows the current release version of NIST SP 800-171, while CMMC specifically codifies Rev. 2 for Level 2, which may require contractors to satisfy the requirements of both Rev. 2 and Rev. 3 at the same time.

ASSESSMENT

To achieve a CMMC Level 3 Certification Assessment, all Level 3 security requirements must be MET or have a POA&M in place. Level 3 Certification Assessments are performed by the DCMA DIBCAC, which issues the Level 3 Certification Assessment certificates and uploads Level 3 Certification Assessment results into the CMMC instantiation of eMass (32 C.F.R. § 170.7(5)). Level 3 uses the CMMC scoring methodology: each control has a finding of MET, NOT MET or NOT APPLICABLE. However, unlike Level 2, the Level 3 assessment does not assign different scores to different controls; each control is only worth one point when MET. The Level 3 scoring methodology accounts for all Level 2 security requirements already being MET as a requirement for a Level 3 assessment, so points are only assigned for requirements unique to Level 3.

Contractors may implement a POA&M in the place of a security requirement only if the contractor has a finding of MET for 80% or more of Level 3 security requirements. Because only 24 controls were selected from NIST SP 800-172 as Level 3 controls, a contractor must have at least 20 controls pass the assessment (i.e., the POA&M can only have up to four controls on it). In addition, the contractor will fail if the following controls are not passed (i.e., if they are placed on the POA&M):

• IR.L3–3.6.1e Security Operations Center
• IR.L3–3.6.2e Cyber Incident Response Team
• RA.L3–3.11.1e Threat-Informed Risk Assessment
• RA.L3–3.11.6e Supply Chain Risk Response
• RA.L3–3.11.7e Supply Chain Risk Plan
• RA.L3–3.11.4e Security Solution Rationale
• SI.L3–3.14.3e Specialized Asset Security

If a contractor uses a POA&M and achieves the minimum score necessary to be certified, the contractor has a Conditional Certification Assessment; if the contractor meets the minimum score and has no POA&M, then it has a Final Certification Assessment. Where a POA&M is used, it must be closed out within 180 days of the initial assessment by arranging for the DMCA DIBCAC to perform a closeout inspection.

During the assessment, the DCMA DIBCAC may perform checks to ensure that all Level 2 security requirements are MET for in-scope assets. If the DCMA DIBCAC determines that a Level 2 security requirement is NOT MET, the assessment may be placed on hold or terminated (32 C.F.R § 170.18(c)(ii)).

REQUIRED AFFIRMATIONS

Like CMMC Levels 1 and 2, CMMC Level 3 introduces a requirement for affirmations that must be provided by a contractor’s senior official who is responsible for ensuring the contractor’s compliance with the CMMC Program.

These affirmations present a heightened risk to Federal contractors of False Claims Act violations (31 U.S.C. §§ 3729-3733). The annual affirmation, in particular, requires Federal contractors to be vigilant in maintaining their assessed environments, to identify and surface any changes that would affect the environment’s compliance with CMMC requirements and to have a process to ensure that the senior officials making the affirmations have accurate and complete information regarding the entity’s CMMC compliance.

EXTERNAL SERVICE PROVIDERS

Like CMMC Level 2, an External Service Provider (ESP) must be certified to the level of the contractor utilizing it. For Level 3, this means a contractor must only use an ESP that has a Level 3 Final Certification Assessment (32 C.F.R. § 170.19(c)(2)).

KEY TAKEAWAYS

• ODPs are no longer defined by each organization, but instead by DoD.
• ESPs that exist outside of the Federal contracting ecosystem and have clients who seek to become CMMC Level 3 certified may have a substantial amount of work ahead of them, including getting on the DCMA DIBCAC’s schedule for CMMC Level 3 assessments.
• Uncertainty surrounding the type of data that requires a CMMC Level 3 certification may make it difficult for contractors processing CUI to predict the level of security they need to implement.

Since a government entity is performing the assessment, the Level 3 certification process may not be as quick as it is for Levels 1 or 2.