NIST SP 800-171 Rev 3 and CMMC: What Changes If You're Already Compliant

NIST published Revision 3 of SP 800-171 in May 2024. If you've built your program on Revision 2, the question is whether you now have to rebuild it. For CMMC, the answer today is no. The CMMC rule and the DFARS clause both still point to Revision 2, and no date has been set to change that. Revision 3 still matters, though, because it shows where the requirements are headed, and the Department has already started preparing for it.

What did Revision 3 change?

Revision 3 is a substantial rewrite, not a light update. NIST realigned the requirements with its current control catalog, and the structure changed along with the wording.

Fewer requirements doesn't mean less work. Many Revision 2 requirements were merged into broader ones, and Revision 3 introduced organization-defined parameters: values, such as how often something happens, that the requirement leaves for the organization (or its customer) to set. NIST also published a matching assessment guide, SP 800-171A Revision 3, the same day.

Why doesn't Revision 3 apply to CMMC yet?

Because the CMMC rule names a specific revision. It incorporates "NIST SP 800-171 R2" by reference and says plainly that "the security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2" (32 CFR § 170.14(c)(3)). Assessments use the June 2018 version of SP 800-171A, which is where the 320 assessment objectives come from.

When the Department published the final rule, it addressed Revision 3 directly. The preamble states that "NIST SP 800-171 Revision 3 is not currently applicable to this rule," and that "DoD will issue future amendments to this rule to incorporate the current version at that time" (89 FR 83092). A federal rule that incorporates a standard by reference has to name a specific revision, so a change means rulemaking, not a quiet switch.

The scoring shows it too. CMMC's point values follow the Revision 2 split between basic and derived requirements, and the rule refers to requirements by their Revision 2 numbers, such as SC.L2-3.13.11 for FIPS-validated encryption (32 CFR § 170.24). Revision 3 removed that split, so the scoring method itself would have to change.

What about DFARS 252.204-7012?

This is the part that trips people up. The clause as codified asks you to implement the version of NIST SP 800-171 "in effect at the time the solicitation is issued," which, read alone, would mean Revision 3 for newer solicitations.

The Department closed that gap the same month Revision 3 came out. In May 2024, it issued a class deviation requiring contractors to comply with Revision 2 "instead of the version… in effect at the time the solicitation is issued." That instruction now sits in the Department's current DFARS deviation, 2026-O0025 (revision 3, September 2026), whose 7012 clause names Revision 2. The same deviation describes the July 2026 Phase 2 suspension memo as requiring "baseline compliance with NIST SP 800-171 Rev 2."

So in practice: if your contract carries the deviation version of 7012, Revision 2 is your standard. If you're unsure which version your contract has, read the clause date in the contract itself, and ask your contracting officer in writing if it isn't clear.

How the two revisions got here

1. Feb 2020Revision 2 published. The 110 requirements CMMC Level 2 assesses, updated in January 2021.
2. May 2024Revision 3 published, and a DoD class deviation keeps DFARS 252.204-7012 on Revision 2.
3. Oct 15, 2024CMMC final rule. Level 2 is defined as identical to Revision 2; Revision 3 is “not currently applicable.”
4. Apr 10, 2025DoD sets Revision 3 parameter values “in preparation to implement” Revision 3 as the minimum requirement for contractors.
5. Sep 2026Current DFARS deviation still names Revision 2 in the 7012 clause.
6. NextA rule amendment. No date has been announced.

The April 2025 memo is the clearest signal of direction. The DoD CIO published values for Revision 3's organization-defined parameters, and said it did so "in preparation to implement" Revision 3 as the minimum requirement for contractors. That's preparation, not a deadline. It also means that when the change comes, many of the values you'd otherwise have to choose will already be set by the Department.

What should you do now?

Treat Revision 3 as a direction to plan toward, not a standard to switch to.

• Keep your program on Revision 2. Your SSP, your evidence and your self-assessment score all map to the 110 requirements and 320 objectives your assessor uses. Renumbering to Revision 3 now would make your assessment harder, not easier.
• Read the 7012 clause in each contract. Know which version you signed, and get any ambiguity resolved in writing.
• Use Revision 3 when you change systems. When you replace a tool, redesign a network, or write a new procedure, check the matching Revision 3 requirement and choose an approach that satisfies both where you reasonably can.
• Start on the new families early. Supply chain risk management, planning, and system acquisition are new as requirements. A short written process for each is easier to grow than to start from nothing under a deadline.
• Read DoD’s parameter values. Where you already set a value for Revision 2, such as how often you review something, compare it with the value DoD defined for the matching Revision 3 requirement.
• Watch for the rulemaking. A change to CMMC will come as an amendment to 32 CFR Part 170, published in the Federal Register. That's your early warning.

Want an impact review when the rule changes?

Program changes like this are part of Continuous Compliance: when a new revision, a new contract clause or a new system lands, our CMMC Certified Assessors review what it changes for your scope, your SSP and your next affirmation, so the answer is on file before anyone asks for it.

Sources: NIST SP 800-171 Revision 3 and SP 800-171A Revision 3 (May 14, 2024); NIST SP 800-171 Revision 2 (February 2020, updated January 28, 2021); 32 CFR Part 170, § 170.2(b), § 170.14(c)(3) and § 170.24; CMMC Program final rule, 89 FR 83092 (October 15, 2024); DFARS 252.204-7012; DoD Class Deviation 2024-O0013 (May 2024) and DFARS Class Deviation 2026-O0025, revision 3 (September 3, 2026); DoD CIO, Organization-Defined Parameters for NIST SP 800-171 Revision 3 (April 10, 2025).