Status: Phase 2 is suspended, and it does not change the answer
On July 13, 2026 the Department of War CIO suspended the November 2026 CMMC Phase 2 transition and held all pending CMMC implementation milestones in abeyance pending a 60-day review. During the suspension, program managers may designate only Level 1 (Self) or Level 2 (Self) — not Level 2 (C3PAO) and not Level 3 (DIBCAC) — and solicitations already carrying those requirements are directed to be amended to remove them.
So the practical answer to "Level 2 or Level 3?" on new DoD work today is neither, in the sense that no third-party or government CMMC assessment can be designated at all. What the comparison below is still for: the rule at 32 CFR Part 170 has not been rescinded, DFARS 252.204-7021 has not been removed, primes remain free to require whatever assurance they want in a subcontract, and the review is chartered to recommend a reformed framework rather than nothing. The technical difference between the two levels is what it was.
Full read: [CMMC Phase 2 is suspended](/insights/cmmc-phase-2-suspended/).
The honest answer: you probably need Level 2
The most useful thing we tell contractors asking "Level 2 or Level 3?" is that the question usually answers itself. Level 3 is not a tier you opt into for extra assurance. It applies to a narrow set of programs where the adversary threat model justifies the enhanced control set, and the contract designates it explicitly.
The vast majority need Level 2: the 110 NIST SP 800-171 Rev 2 controls across 14 families. DoD's own estimate in the CMMC final rule is that roughly 76,600 entities would require a Level 2 certification assessment, against 1,487 at Level 3. If your DFARS 252.204-7021 flowdown involves CUI and the contract does not specifically call for Level 3, Level 2 is your target.
Pursuing Level 3 on speculation is expensive and usually unnecessary. The right move is to build Level 2 to a genuine 110/110, which also positions you cleanly if a future contract does require Level 3.
What Level 3 actually adds
Level 3 is Level 2 plus a selected subset of NIST SP 800-172 controls. NIST 800-172 is the enhanced security requirements publication aimed at protecting CUI against advanced persistent threats. Its controls assume a sophisticated, well-resourced adversary rather than opportunistic compromise.
The 800-172 enhancements push into areas like enhanced monitoring and threat hunting, more rigorous access control and isolation, supply-chain protections against sophisticated tampering, and dual-authorization controls for high-impact actions. They are operationally heavier than the 800-171 baseline: more continuous, more analyst-driven, more architecturally demanding.
Level 3 is assessed by DIBCAC, the Defense Contract Management Agency's assessment center, not by a commercial C3PAO. This is a government-led assessment reserved for the programs that warrant it.
The path: Level 2 first, always
Even contractors who know they need Level 3 build Level 2 first. The 110 NIST 800-171 controls are the foundation; the 800-172 enhancements layer on top. There is no shortcut that skips the Level 2 baseline.
So the practical sequence for a Level 3-bound contractor is: design and implement the Level 2 program to a genuine 110/110, then scope the 800-172 enhancement delta as a second phase. For everyone else, which is the majority, Level 2 is the destination.
Our [realistic CMMC Level 2 timeline](/insights/cmmc-level-2-timeline-realistic/) covers what the Level 2 engagement looks like month by month, and the [CMMC self-assessment vs C3PAO](/insights/cmmc-self-assessment-vs-c3pao/) piece covers when third-party assessment is required.