The honest answer: you probably need Level 2
The most useful thing we tell contractors asking "Level 2 or Level 3?" is that the question usually answers itself. Level 3 is not a tier you opt into for extra assurance — it applies to a narrow set of programs where the adversary threat model justifies the enhanced control set, and the contract designates it explicitly.
The vast majority of the roughly 76,600 organizations that need CMMC certification need Level 2 — the 110 NIST SP 800-171 Rev 2 controls across 14 families, assessed by a C3PAO. If your DFARS 252.204-7021 flowdown involves CUI and the contract does not specifically call for Level 3, Level 2 is your target.
Pursuing Level 3 on speculation is expensive and usually unnecessary. The right move is to build Level 2 to a genuine 110/110, which also positions you cleanly if a future contract does require Level 3.
What Level 3 actually adds
Level 3 is Level 2 plus a selected subset of NIST SP 800-172 controls. NIST 800-172 is the enhanced security requirements publication aimed at protecting CUI against advanced persistent threats — the controls assume a sophisticated, well-resourced adversary rather than opportunistic compromise.
The 800-172 enhancements push into areas like enhanced monitoring and threat hunting, more rigorous access control and isolation, supply-chain protections against sophisticated tampering, and dual-authorization controls for high-impact actions. They are operationally heavier than the 800-171 baseline — more continuous, more analyst-driven, more architecturally demanding.
Critically, Level 3 is assessed by DIBCAC — the Defense Contract Management Agency's assessment center — not by a commercial C3PAO. This is a government-led assessment reserved for the programs that warrant it.
The path: Level 2 first, always
Even contractors who know they need Level 3 build Level 2 first. The 110 NIST 800-171 controls are the foundation; the 800-172 enhancements layer on top. There is no shortcut that skips the Level 2 baseline.
So the practical sequence for a Level 3-bound contractor is: design and implement the Level 2 program to a genuine 110/110, then scope the 800-172 enhancement delta as a second phase. For everyone else — the majority — Level 2 is the destination.
Our [realistic CMMC Level 2 timeline](/insights/cmmc-level-2-timeline-realistic/) covers what the Level 2 engagement looks like month by month, and the [CMMC self-assessment vs C3PAO](/insights/cmmc-self-assessment-vs-c3pao/) piece covers when third-party assessment is required.