CMMC Level 3 gap assessment: what DIBCAC actually evaluates
Amara OkaforApril 29, 2026
Key takeaways
CMMC Level 3 adds 24 practices from NIST SP 800-172 on top of the 110 SP 800-171 controls -- organizations that treat Level 3 as 'Level 2 plus paperwork' fail the DIBCAC assessment.
In Vulnox assessments, the most common Level 3 gap is not missing controls but missing evidence: automated tools are running but no one is retaining the correlated log artifacts auditors request.
Network micro-segmentation diagrams fail CMMC Level 3 reviews when they show design intent rather than enforced policy -- assessors test enforcement, not architecture drawings.
Incident response plans that have never been exercised against a simulated lateral movement scenario will not satisfy the proactive threat hunting requirements at Level 3.
Organizations that pass Level 2 C3PAO assessments and assume Level 3 readiness are typically 8 to 14 months of remediation work away from a credible DIBCAC review.
The evidence observation window for Level 3 is 12 months -- controls stood up 90 days before assessment produce a compliance artifact, not a compliance posture.
TL;DR
CMMC Level 3 is a DIBCAC government-led assessment against NIST SP 800-172, and the failure mode almost every organization hits is the same: controls exist but evidence of sustained operation does not. The 24 additional practices matter less than the evidence retention and threat hunting requirements that auditors actually dig into. If you are planning for Level 3, start with your evidence pipeline, not your control inventory.
What the assessment actually looks like
A mid-size defense subcontractor -- 200 employees, mature IT team, two years into their CMMC program -- gets their DIBCAC assessment date confirmed. They have passed a Level 2 C3PAO audit. Their SSP is current. Their policies cover every control domain. Six weeks before the assessment, they run an internal readiness review and find that their SIEM has been generating alerts for 14 months but the retention policy was set to 90 days. Eleven months of log data required for evidence of continuous monitoring is gone.
That is not a technical failure. The detection tooling worked. The configuration decision that set a 90-day retention window was made by someone optimizing storage costs, not audit readiness. CMMC Level 3 does not care about intent. It evaluates what you can demonstrate over a 12-month observation window, and a gap in that window is a gap in your assessment.
What Level 3 actually requires that Level 2 does not
CMMC Level 2 maps to NIST SP 800-171 r2 -- 110 practices across 14 domains. Level 3 adds 24 practices drawn from NIST SP 800-172, and the additions are not random hardening items. They target three specific capability gaps: proactive threat hunting, advanced configuration management, and enhanced resilience under attack conditions. The practical implication is that Level 3 assumes an adversary is already in your environment and evaluates whether your controls would detect and contain them. Level 2 largely assumes the adversary is outside and evaluates whether your perimeter controls are sound. That is a fundamentally different threat model, and it requires a fundamentally different evidence posture.
Example
Practice CA.L3-3.12.4 requires that organizations employ threat intelligence to inform the development and use of tailored threat models. This is not a checkbox. Assessors will ask what threat intelligence sources feed into your risk assessment process, when the last update occurred, and what specific adversary TTPs your controls are designed to counter. A generic reference to MITRE ATT&CK does not satisfy this. Neither does a threat model built 18 months ago and not updated since.
The 24 SP 800-172 practices cluster in four control families: Configuration Management (CM), Incident Response (IR), Risk Assessment (RA), and System and Communications Protection (SC). Organizations doing a Level 3 gap assessment should weight their effort accordingly -- these four families account for roughly 70% of the Level 3-specific findings in Vulnox assessment data.
What Vulnox assessment data shows
Assessment base: Vulnox assessment data, 2024-2025, defense contractor environments pursuing CMMC Level 2 and Level 3 readiness
Evidence retention gaps are more common than control gaps
Across defense contractor assessments where clients had already completed a Level 2 C3PAO audit, the most frequent Level 3 readiness failure was not a missing control. Controls were deployed. The failure was that evidence of sustained operation -- SIEM logs, vulnerability scan outputs, configuration baselines with change records -- was either not retained for 12 months or was retained but not correlated to specific control requirements. Assessors ask for artifacts, not architecture diagrams.
Organizations entering Level 3 readiness assuming their Level 2 audit means controls are in place need to run a separate evidence audit. The question is not 'do we have MFA?' but 'can we produce 12 months of MFA enforcement logs correlated to the specific systems in scope?'
Micro-segmentation documents intention, not enforcement
In assessments of environments claiming network micro-segmentation between CUI and non-CUI systems, a pattern appears consistently: the network diagrams are accurate and detailed, but the firewall rule sets and switch ACLs have not been reviewed since the segmentation was first implemented. Configuration drift means the documented architecture and the enforced boundary are different things. In several cases, firewall rules added for 'temporary' testing access had been in place for over a year.
Level 3 assessors do not evaluate diagrams. They request current configuration exports and test whether traffic that should be blocked is actually blocked. Segmentation documentation that has not been validated against current device configurations is not evidence -- it is a liability.
Incident response plans are designed for breach response, not threat hunting
CMMC Level 3 requires proactive threat hunting, and most incident response plans assessed at the Level 3 readiness stage were written for reactive breach response. They describe escalation paths and containment steps well. They do not describe how analysts identify anomalous behavior before an alert fires, what hunt hypotheses are in rotation, or how findings from hunting exercises feed back into detection rule updates.
An IR plan that satisfies Level 2 will not satisfy Level 3. The difference is not polish -- it is whether the plan documents proactive detection activities that run between incidents, not just the response to them.
The control that looks hardest is not the one that fails assessments
Common belief
Most organizations preparing for Level 3 treat the advanced configuration management and system segmentation practices as the highest-risk items. They invest heavily in micro-segmentation architecture, zero trust pilots, and privileged access management upgrades. Those efforts are real and the controls matter. But they are not where assessments typically break down.
What we found
In readiness assessments, Vulnox has found that organizations with relatively modest technical control stacks but disciplined evidence management pipelines perform better in mock assessments than organizations with sophisticated tooling and informal evidence collection. The correlation between control maturity and assessment performance is weaker than most people expect. The correlation between evidence pipeline discipline and assessment performance is strong.
Assessments break down on evidence. Specifically, on the correlation between what a control does and what gets recorded, retained, and formatted in a way an assessor can evaluate against a specific practice ID. A mature SIEM generating 50,000 events per day is not useful to an assessor if those events are not tagged to control families, retained for 12 months, and retrievable without a multi-day data archaeology project. The organizations that fail Level 3 assessments after passing Level 2 are usually not failing on controls. They are failing on evidence infrastructure.
Where Level 3 readiness programs miss
The 12-month observation window starting date
Organizations frequently start serious Level 3 remediation 6 to 9 months before their target assessment date. New controls go in, evidence collection improves. But the observation window for demonstrating sustained operation is 12 months. Controls implemented 6 months before the assessment produce 6 months of evidence. Assessors note the gap. The remediation work is real but the evidence posture reflects implementation date, not assessment date. This is not a technical problem -- it is a planning problem that requires deciding on a Level 3 assessment timeline before starting remediation.
Supply chain risk management as a paper exercise
CMMC Level 3 includes supply chain risk management practices that require organizations to identify and respond to supply chain threats with specificity. In most readiness programs, supply chain risk management is addressed by a vendor questionnaire process and a policy document. Assessors ask for evidence of how specific supply chain threat intelligence influenced procurement or configuration decisions. That kind of documented decision trail almost never exists in organizations running a questionnaire-based program.
Threat hunting without a documented hunt program
Threat hunting at Level 3 is not asking your SOC analyst whether they look for anomalies. It is a documented program: named hunt hypotheses derived from current threat intelligence, records of hunts conducted, findings logged, and detection rules updated based on hunt outcomes. Most organizations that describe themselves as doing threat hunting are doing alert triage. Those are different activities, and assessors can tell the difference within the first 20 minutes of reviewing documentation.
Forgotten subdomains and cloud assets in the CUI boundary
Scope definition for Level 3 requires a credible asset inventory of everything that touches, stores, processes, or transmits CUI. In assessments, organizations routinely undercount cloud storage instances, development environments with CUI copies for testing, and collaboration tools where CUI has been shared informally. Assets outside the documented boundary are not protected by controls inside it. Digital footprint analysis before finalizing scope catches the assets that asset management processes miss -- usually because those assets were spun up outside normal procurement channels.
Where Level 3 compliance is heading
DIBCAC assessment capacity will become the binding constraint on Level 3 timelines by 2027, creating a market for fraudulent readiness certifications as contractors face contract deadlines they cannot meet through legitimate channels.
The number of organizations required to achieve Level 3 certification is growing faster than DIBCAC can staff assessors. Assessment queue times are already measured in months. Contractors facing contract performance deadlines that require Level 3 certification and assessment queues that do not fit their timeline will face intense pressure to misrepresent readiness status. The incentive structure for this failure already exists -- the enforcement capacity to detect it does not yet.
Confidence: highDIBCAC assessment completion rate data showing queue times exceeding 12 months for Level 3 assessments by Q4 2026, combined with any documented case of contract award based on misrepresented CMMC statusThe evidence correlation requirement -- linking control operation evidence to specific practice IDs -- will produce a new category of compliance tooling that nobody is building yet: CMMC evidence graph databases that map log artifacts to practices in real time rather than during audit preparation.
Current GRC tooling treats evidence collection as a manual pre-audit task. Level 3's 12-month observation window makes that model unworkable at scale. The organizations that pass Level 3 assessments efficiently will be those that automate the mapping from operational telemetry to specific practice IDs continuously, not the ones that run evidence collection sprints in the 60 days before assessment. Nobody is building this with the specificity CMMC Level 3 requires yet.
Confidence: mediumA GRC platform shipping a CMMC Level 3-specific evidence graph feature with practice-to-artifact mapping before 2027, or a C3PAO publishing assessment methodology that validates continuous evidence pipelines
The honest version of what Level 3 readiness costs
Most organizations pursuing CMMC Level 3 are underestimating the real cost by a factor of two to three, and the underestimate is concentrated in people and process rather than technology. The technology spend is visible and gets budgeted. The cost of disciplined evidence management, sustained threat hunting, and a supply chain risk program that produces documented decisions rather than vendor questionnaires is almost entirely people time -- and it does not end after the assessment. It is a continuous operational requirement. A defense subcontractor with 150 employees and a 3-person IT team pursuing Level 3 is not buying technology. They are buying a year of organizational change management, and the sticker price for that rarely appears in readiness project proposals.
Counterargument
The counterargument is that managed service providers can absorb most of this operational overhead, and for pure infrastructure controls that is often true. But evidence correlation, threat hunting hypothesis development, and supply chain risk decision documentation cannot be fully outsourced because they require decisions made by people with organizational context. An MSSP can run the SIEM. They cannot document why your organization chose not to purchase from a specific vendor based on threat intelligence about that vendor's supply chain exposure.
One thing to do before the assessment date moves
Run an evidence audit, not a control audit. Pull the last 12 months of operational telemetry for your five highest-risk control families -- CM, IR, RA, SC, and AC -- and test whether an assessor could map that data to specific Level 3 practice IDs without a guide from your team. If the answer is no, you have found your actual gap. Not a missing control. A missing evidence pipeline. Fix that before anything else, because controls without correlated evidence are not compliance -- they are overhead.
Further Reading
Gap Analysis
CMMC gap analysis serviceDigital Footprint
digital footprint analysisNIST SP 800-30 Risk Assessment Guide
NIST risk assessment guideNational Vulnerability Database Home
National Vulnerability DatabaseUnderstanding Compliance Gap Analysis
compliance gap analysis guide
Frequently Asked Questions
What does a CMMC Level 3 gap assessment evaluate that a Level 2 assessment does not?
CMMC Level 3 adds 24 practices from NIST SP 800-172 focused on proactive threat hunting, advanced configuration management, and supply chain risk. A Level 3 gap assessment evaluates whether controls operate against an assumed-breach threat model and whether 12 months of correlated evidence exists -- requirements absent from Level 2.
How long does evidence need to be retained for a CMMC Level 3 DIBCAC assessment?
DIBCAC assessors evaluate a 12-month observation window. Controls implemented or evidence collection started fewer than 12 months before assessment date will produce an evidence gap for that period, regardless of whether the underlying control is functioning correctly.
What is the most common CMMC Level 3 gap found in defense contractor assessments?
In Vulnox assessments of defense contractors pursuing Level 3 readiness, the most frequent failure is not a missing technical control but missing evidence correlation -- SIEM logs and scan outputs exist but are not retained for 12 months or are not tagged to specific CMMC practice IDs in a way assessors can evaluate.
Does passing a CMMC Level 2 C3PAO audit mean an organization is close to Level 3 ready?
No. Organizations that pass Level 2 assessments are typically 8 to 14 months of remediation work from a credible Level 3 DIBCAC review. The evidence posture, threat hunting program, and supply chain risk documentation required at Level 3 are materially different from what Level 2 evaluates.
What does CMMC Level 3 require for threat hunting that most organizations miss?
Level 3 requires a documented hunt program: named hypotheses derived from current threat intelligence, records of hunts conducted, findings logged, and detection rules updated based on hunt outcomes. Alert triage is not threat hunting. Assessors distinguish between the two in the first review of documentation.
How should organizations scope a CMMC Level 3 gap assessment?
Scope must cover all assets that touch, store, process, or transmit CUI -- including cloud storage, dev environments with CUI copies, and collaboration tools. Digital footprint analysis before finalizing scope routinely finds assets outside the documented boundary that are unprotected by the controls inside it.
What is the difference between micro-segmentation documentation and micro-segmentation evidence for CMMC Level 3?
Documentation shows intended architecture. Evidence for CMMC Level 3 means current configuration exports from firewalls and switches that show enforced policy, plus records showing those configurations have been reviewed for drift. Assessors test whether traffic that should be blocked is blocked -- not whether the diagram says it should be.
Related Articles
GovRAMP Moderate authorization: why the Significant Change Request process catches providers off guard
GovRAMP Moderate is the first tier where you need a government sponsor, annual 3PAO reassessment, and a Significant Change Request process that can pause normal product releases for months. Most providers who stall post-authorization were not prepared for what maintaining Moderate status actually costs operationally.
GovRAMP Low+ authorization: the impact level that punishes providers who get the CUI boundary wrong
GovRAMP Low+ is where providers handling limited Controlled Unclassified Information land — or discover they should not be there. The defining failure is not a missing control. It is a CUI boundary that was drawn before anyone asked what data the government actually sends through the system.
GovRAMP High authorization: why FIPS-validated crypto and personnel security controls catch providers off guard
GovRAMP High is where cloud providers discover that having strong encryption is not the same as having FIPS 140-2 validated encryption — and that distinction alone has derailed authorizations from vendors who passed every other control family. The architectural constraints at High are qualitatively different from every lower tier.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.