NIST SP 800-171 Rev 3 vs Rev 2: What a Program Lead Should Plan For and What to Ignore

Which revision am I actually held to today?

NIST published SP 800-171 Rev 3 and its companion assessment guide, NIST SP 800-171A Rev 3, in May 2024. Publication by NIST does not change your contract. Your obligation comes from the clauses in your contract, and for most defense work that clause is DFARS 252.204-7012. In May 2024, DoD issued a class deviation that told contracting officers to hold contractors to NIST SP 800-171 Rev 2 for that clause. The CMMC program rule at 32 CFR Part 170 also references Rev 2 for assessments.

When DoD will move the contractual baseline to Rev 3 is not settled. Anyone giving you a firm date is guessing. The practical answer is to read your contract clauses, confirm which revision they invoke, and treat that as your baseline until a contract action or rule says otherwise. Contracts that only carry FAR 52.204-21 fall under its basic safeguarding requirements, and Rev 3 does not change those.

What actually changed between Rev 2 and Rev 3?

Rev 2 has 110 security requirements in 14 families. Rev 3 has 97 requirements in 17 families. The three new families are Planning, System and Services Acquisition, and Supply Chain Risk Management. The lower count does not mean less work. Many requirements were merged or withdrawn into others, and Rev 3 now states expectations that Rev 2 left to the "non-federal organization" controls you were assumed to have in place.

The change with the most practical weight is the organization-defined parameter. Rev 2 often said "periodically" and left the frequency to you. Rev 3 puts a parameter in those places, and the parameter can be set by the federal agency. That is why the DoD values matter. Once DoD's values apply to you, how often you review, how long you retain, and how quickly you act stop being your choice. They become a stated expectation that an assessor can check. NIST SP 800-171A Rev 3 writes its assessment procedures around these parameters, so evidence will be judged against specific values, not against your reasonable judgment.

Rev 3 also removes the split between basic and derived requirements and aligns its wording more closely with the NIST SP 800-53 Rev 5 moderate baseline. The renumbering follows from that alignment.

What should a program lead plan for now?

Start with the gap analysis between your current Rev 2 implementation and the DoD parameter values. Where your current practice already meets or beats a DoD value, write that down and move on. Where it falls short, decide whether closing the gap now costs little. Often it does: tightening a review cycle or a retention period while you are already revising a procedure is cheap. Doing the same change under assessment pressure later is not.

Next, plan for the new families, especially supply chain risk management. Rev 3 expects a documented supply chain risk management plan and expects you to act on it. Most contractors already handle parts of this through procurement and subcontract flowdown, but rarely as one program with one owner. Building that program takes time because it involves procurement, legal and engineering, not just security. Of everything in Rev 3, it has the longest lead time, so start it early.

Finally, make sure every new investment is designed for both revisions. If you are replacing an identity platform, rewriting your incident response procedure or moving your CUI enclave, write the requirement against Rev 2 and confirm it also satisfies the matching Rev 3 requirement and DoD's parameter value. NIST publishes a comparison of the two revisions that makes this mapping straightforward. Tagging current documentation to both numbering schemes now will save you a full rewrite later.

What can a program lead safely ignore for now?

Do not re-baseline your system security plan to Rev 3 yet. Your assessment, your self-assessment score and your CMMC readiness are still measured against Rev 2. An SSP written to Rev 3 makes an assessor translate it back, and that adds risk without adding protection. Keep the Rev 2 SSP as the authoritative document and keep the Rev 3 mapping as a working appendix.

Ignore the requirement count. Going from 110 to 97 is a change in structure, not in scope, so do not let it inform staffing or budget decisions. Ignore tools and services sold as "Rev 3 ready." Rev 3 is a set of outcomes you have to own, not a feature a product can supply. Also ignore speculation about CMMC timing. The program's phasing is not something to plan around, and Phase 2 is currently suspended.

Who owns the decision on when to move?

The program lead owns the sequencing. That covers which gaps get closed early, which documents carry both mappings, and when the supply chain work starts. The executive sponsor owns the risk decision behind it, which comes down to accepting a period of dual tracking. The trade-off is plain. Moving early spends effort on requirements that are not yet contractual. Moving late compresses a multi-function program into whatever notice period the eventual rule or contract action allows.

For federal IT firms and systems integrators, there is one more owner question. Rev 3 lets the federal agency set the parameter values, so a firm with both defense and civilian agency work may end up facing different values for the same requirement. Someone needs to own the decision on whether to adopt the strictest value everywhere or to maintain values per contract. That is a governance call, and it belongs above the control owners.

Where are the sources?

NIST SP 800-171 Rev 3, final: https://csrc.nist.gov/pubs/sp/800/171/r3/final

NIST SP 800-171A Rev 3, final: https://csrc.nist.gov/pubs/sp/800/171/a/r3/final

NIST SP 800-171 Rev 2: https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final

32 CFR Part 170, CMMC Program: https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170