Enhanced protection for specified procurements
Level 3 adds 24 selected enhanced security requirements from NIST SP 800-172 to the Level 2 foundation. The additional requirements address advanced persistent threats through measures such as threat-informed risk management, security operations, incident response capacity, supply chain risk management, and stronger asset visibility. Level 3 is required where the applicable procurement specifies it.
The Level 2 prerequisite
A Final Level 2 C3PAO status for the information systems within the Level 3 assessment scope is a prerequisite for the Level 3 assessment. The Level 3 boundary must be equal to or a subset of the Level 2 boundary. An open Level 2 POA&M must be closed before starting Level 3 assessment activities.
Who assesses Level 3
DCMA DIBCAC conducts the Level 3 certification assessment on behalf of the government. Maintaining the status involves the required three-year assessments and annual affirmations, including the continuing Level 2 assessment obligation. Readiness providers can help organize implementation and documentation, but they do not issue a DIBCAC assessment result.
Prepare around operational capability
Start by identifying the selected enhanced requirements, assigning owners, and defining how the organization demonstrates them in operation. Ask whether response staffing, threat hunting, asset discovery, and supplier risk practices function consistently. Buying a product or drafting a policy is one step; the assessment concerns the implemented environment and the relevant objectives.