CMMC Level 3 (DIBCAC): not designated during the suspension
Level 3 adds selected requirements of NIST SP 800-172, assessed by the DCMA DIBCAC. During the suspension requiring activities may not designate it. Under 32 CFR 170.23(a)(4), where a prime contract requires Level 3, the minimum for a subcontractor handling CUI is Level 2 (C3PAO).
The rule sentences
2 citedDoW CIO memorandum, 13 Jul 2026, Attachment 1memorandum, cleared for open publication 13 Jul 2026Program Managers and requiring activities may not designate CMMC Level 2 (C3PAO) or Level 3 (DIBCAC) assessments during this period. The allowed designations are CMMC Level 1 (Self) or CMMC Level 2 (Self).
32 CFR 170.23(a)(2)codified text, eCFR current to 24 Sep 2026If a subcontractor will process, store, or transmit CUI in performance of the subcontract, then a CMMC Status of Level 2 (Self) is the minimum requirement for the subcontractor.
Confirm which deviation your contracting officer's agency has adopted. The register records what a subcontractor declares; it does not look anything up in SPRS.