NIST 800-171 Rev 3: What's Changing and How to Prepare

Current rollout policy

Current policy, checked November 2, 2026: The Department’s CMMC policy suspends Phase II; Phase I self-assessment requirements remain. References to later rollout phases describe the original design, not a current deadline. Verify the applicable solicitation, amendments, and contract before scheduling an assessment.

NIST Special Publication 800-171 defines the security requirements for protecting Controlled Unclassified Information (CUI) in nonfederal systems and organizations. Every company that handles CUI as part of a Department of Defense contract is required to implement these controls. Rev 2 has been the operative version since February 2020, and its 14 control families and 110 security requirements have become deeply embedded in defense contractor compliance programs, DFARS self-assessments, and CMMC preparation efforts.

Rev 3, finalized in May 2024, restructures the standard in ways that affect every organization subject to it. This guide walks through the control families, the specific changes in Rev 3, and the practical steps organizations should take to prepare for the transition.

For the next operating decision, compare vCISO support for government contractors with CMMC certification timing. Confirm the work included, the evidence you need, and who will own implementation before committing to a provider.

What is the Rev. 2 baseline?

Before examining what is changing, it is worth establishing the Rev 2 baseline that most organizations are currently operating under.

Rev 2 Control Family Summary

Rev 2 organizes these 110 requirements into "basic" and "derived" categories. Basic requirements come directly from FIPS 200, while derived requirements provide additional specificity drawn from NIST SP 800-53. This distinction has caused confusion in practice -- many organizations have treated basic requirements as more important than derived ones, which was never the intent.

For a deeper dive into the current requirements, see our NIST 800-171 compliance guide.

What Is Changing in Rev 3?

Structural Reorganization

All requirements are now treated equally, which resolves the prioritization confusion that plagued Rev 2 implementations. Requirements are restructured to align more directly with NIST SP 800-53 Rev 5 controls, creating a cleaner traceability path between the two standards.

The 14 control families are retained in name but the requirements within them have been reorganized, consolidated, and in some cases expanded. The total count of distinct requirements changes, though the exact number depends on how you count consolidated versus net-new requirements.

Key Changes by Control Family

Organization-Defined Parameters (ODPs)

ODPs are placeholders within control requirements where organizations must specify values appropriate to their environment and risk profile.

Examples of ODPs include:

• Frequency of access reviews. Rather than a fixed requirement, Rev 3 allows organizations to define the review frequency based on their risk assessment (for example, quarterly, semi-annually, or annually).
• Audit event types. Organizations define which events must be logged based on their specific threat landscape and data sensitivity.
• Incident response timeframes. Instead of a single mandated timeline, organizations specify their own incident notification and escalation windows.
• Account inactivity thresholds. Organizations define how long an account can remain inactive before automatic disablement.
• Session lock and termination timeouts. Organizations set their own thresholds for session inactivity.

They provide the flexibility that Rev 2 lacked, but they also mean that organizations cannot simply check boxes anymore. You must justify your ODP selections based on your risk assessment, and assessors will evaluate whether your selections are reasonable.

Alignment with NIST SP 800-53 Rev 5

Rev 3 strengthens the traceability between 800-171 requirements and 800-53 Rev 5 controls. Each Rev 3 requirement maps directly to one or more 800-53 controls, with a formal mapping table provided in the publication. This has several practical benefits:

• Easier gap analysis for organizations already implementing 800-53 controls in other contexts (such as FedRAMP)
• Clearer assessment criteria because assessors can reference the 800-53 control catalog for implementation guidance
• A mapping resource for future planning, while maintaining the assessment baseline required by current CMMC guidance and the contract

New and Enhanced Requirements

Several areas receive materially new or significantly enhanced requirements in Rev 3:

Supply chain risk management. Rev 3 adds requirements for identifying and managing supply chain risks related to CUI processing. This includes requirements for system component inventory management and provenance tracking.

System and service acquisition. New requirements address security considerations in the system development lifecycle and third-party service agreements.

Planning. Rev 3 adds a planning control family that requires organizations to develop, document, and maintain system security plans that address the full Rev 3 requirement set.

Privacy. Enhanced requirements address privacy considerations for CUI that contains personally identifiable information, creating alignment with federal privacy requirements.

What determines the applicable transition schedule?

Current State

The current CMMC overview still identifies NIST SP 800-171 Revision 2 for Level 2. Publishing a new NIST revision does not automatically amend a contract or replace the CMMC assessment baseline.

Publication and adoption status

Transition Period Considerations

Keep a versioned mapping of existing controls and evidence. Treat any future transition date as unconfirmed until supported by official instructions and the applicable contract. Do not replace required evidence or reporting with a voluntary Rev 3 exercise.

For details on how CMMC and NIST 800-171 interact, see our guide on CMMC vs NIST 800-171.

Practical Steps to Prepare for the Transition

Step 1: Conduct a Rev 2 to Rev 3 Mapping

Start by mapping your current Rev 2 implementation to the Rev 3 requirement structure. NIST provides a formal mapping table in the Rev 3 publication. For each Rev 2 requirement, record the corresponding Rev 3 requirement, reusable evidence, implementation differences, and any parameter values supplied by the contracting agency. Track gaps separately from the current required assessment.

Step 2: Define Your ODP Selections

This is the most labor-intensive aspect of the transition. For each requirement that includes ODPs, you must:

1. Review the ODP placeholder and understand what value is needed
2. Assess your current implementation to determine what value you are effectively operating at today
3. Evaluate whether your current value is reasonable given your risk profile
4. Document and justify each ODP selection in your System Security Plan

In our experience, organizations that have mature risk assessment programs find ODP definition relatively straightforward. Those without robust risk assessments will need to invest in that capability before they can credibly define ODPs.

Step 3: Address Net-New Requirements

Identify the requirements in Rev 3 that have no direct equivalent in Rev 2. These are the areas where new implementation work is required. Common gaps include:

• Supply chain risk management processes and documentation
• System development lifecycle security requirements for custom-developed systems
• Enhanced incident response testing and coordination procedures
• Vulnerability scanning at defined frequencies (an ODP)
• Software allow-listing implementation

Step 4: Update Your System Security Plan

Your SSP must be restructured to reflect the Rev 3 organization. This means:

• Reorganizing the plan to follow the Rev 3 requirement structure
• Documenting all ODP selections with justification
• Updating control implementation descriptions where requirements have changed
• Adding new sections for net-new requirement areas
• Ensuring the SSP accurately reflects your current operational state

Step 5: Confirm the Required SPRS Baseline

Continue using the assessment methodology and baseline required for the applicable contract and SPRS submission. A voluntary Rev 3 gap assessment does not establish a new SPRS scoring method or authorize replacing a required Rev 2 score. Confirm current official instructions before updating the submission.

Step 6: Confirm the Required Assessment Baseline

For a CMMC assessment, confirm the required revision and assessment objectives before changing the plan. Keep any voluntary Rev 3 preparation separate from current certification evidence.

• Check the current official assessment guide and contract clauses
• Preserve evidence for the required baseline
• Maintain a versioned mapping for future changes
• Confirm any transition instructions before changing the assessment scope

For a full breakdown of CMMC requirements, see our CMMC requirements explained guide.

Common Transition Challenges

ODP Justification

The most common challenge we see is organizations struggling to justify their ODP selections. "We've always done it this way" is not a sufficient justification. Assessors will expect ODP values to be traceable to your risk assessment. If you define a 90-day vulnerability scanning frequency, you need a documented rationale for why 90 days is appropriate given your threat environment and data sensitivity.

Documentation Debt

Organizations that have accumulated documentation debt under Rev 2 -- operating with outdated SSPs, incomplete POA&Ms, or missing policy documents -- will find the Rev 3 transition significantly more painful. The restructured requirements expose documentation gaps that may have been hidden under Rev 2's less precise language.

Scope Creep

Rev 3's expanded requirement areas (supply chain, system development, enhanced planning) may pull additional systems and processes into scope that were previously not considered part of the CUI environment. Organizations should carefully evaluate whether their CUI boundary needs to be updated.

Resource Constraints

Defense contractors, particularly small and mid-sized businesses, face the challenge of transitioning while maintaining current Rev 2 compliance and potentially preparing for CMMC assessments. We advise clients to treat the transition as an integrated program rather than three separate efforts.

Rev 3 Transition Checklist

Use this checklist for a voluntary Rev 3 readiness exercise. Retain the SSP, evidence, reporting, and assessment baseline required by current contracts until official instructions change them:

• Obtain and review the final NIST SP 800-171 Rev 3 publication
• Obtain and review NIST SP 800-171A Rev 3 assessment procedures
• Complete Rev 2 to Rev 3 requirement mapping
• Identify all ODP placeholders across Rev 3 requirements
• Define and document ODP selections with risk-based justification
• Identify net-new requirements with no Rev 2 equivalent
• Perform gap assessment against net-new requirements
• Develop implementation plan for identified gaps
• Update System Security Plan to Rev 3 structure
• Update Plan of Action and Milestones to reference Rev 3
• Confirm the required SPRS baseline and scoring instructions before any submission
• Conduct internal assessment against Rev 3 requirements
• Update evidence repository to align with Rev 3 assessment procedures
• Confirm the applicable CMMC assessment revision with the assessor and contract owner

Conclusion

Rev 3 planning should start with the obligation that actually applies. Maintain the current required controls and evidence, document how the newer publication differs, and act on verified contract and program instructions. This guide does not establish a mandatory CMMC Rev 3 date or a Rev 2 sunset.

The Rev 3 changes ultimately make the standard more flexible and more aligned with how modern organizations actually implement security controls. The investment in transitioning pays dividends in a compliance program that is better tailored to your organization's actual risk profile.

DFARS 252.204-7012 governs safeguarding and incident reporting when it is included in the contract. Read the actual clauses and scope rather than assuming that a certification label replaces contractual duties.