DIBCAC

DIBCAC stands for the Defense Industrial Base Cybersecurity Assessment Center. It's the DoD organization within DCMA (Defense Contract Management Agency) responsible for conducting high-level CMMC assessments — specifically, CMMC Level 3 (expert) assessments and oversight of the overall CMMC assessment process.

While C3PAOs handle Level 2 assessments, DIBCAC conducts the Level 3 assessments directly. DIBCAC also performs DCMA DIBCAC High assessments of contractors' cybersecurity programs and has the authority to verify that contractors are meeting their cybersecurity obligations.