Key takeaways

  • NIST published SP 800-171 Rev. 3 as final on May 14, 2024. It supersedes Rev. 2 as a NIST publication.
  • Which revision binds you is set by your contract or rule, not by NIST. The DFARS clause points to the version in effect when the solicitation is issued or as the contracting officer authorizes, and the CMMC program rule at 32 CFR Part 170 is built on Rev. 2.
  • Rev. 3 lists 17 control families, adding Planning, System and Services Acquisition, and Supply Chain Risk Management.
  • Rev. 3 introduces organization-defined parameters: blanks in a requirement (such as how often to review something) that the agency or the organization fills in, so you must know who sets the value.
  • Rev. 3 reorganizes and consolidates requirements and drops the old split between basic and derived requirements.
  • A sensible plan is to meet Rev. 2 for your contract, and use the Rev. 3 change analysis to see where your current work already counts.

What the standard is for

NIST Special Publication 800-171 lists security requirements for protecting controlled unclassified information (CUI) when it sits on systems that are not run by the federal government, such as a contractor's network. Federal agencies write these requirements into contracts. For defense work, the matching contract clause is DFARS 252.204-7012, and the program that checks you is CMMC. If those terms are new, the article on CMMC Level 2 and the SPRS score explains them.

The dates

Rev. 2 was published in February 2020 and updated in January 2021. NIST's publication page for Rev. 3 shows the document history: public drafts in July 2022, May 2023 and November 2023, and the final in May 2024. NIST also published a matching assessment document, SP 800-171A Rev. 3, and a companion primer for small businesses (SP 1318).

Which revision are you held to?

This is the question that matters most and it is not answered by the publication date. DFARS 252.204-7012 says the covered system must meet the requirements of NIST SP 800-171 in effect at the time the solicitation is issued or as authorized by the contracting officer. The CMMC rule in 32 CFR Part 170 sets Level 2 against the 110 requirements of Rev. 2, with assessment objectives from SP 800-171A. So, today, a contractor preparing for a CMMC Level 2 assessment works to Rev. 2. DoD also issued a class deviation (DFARS Class Deviation 2024‑O0013, May 2024) that keeps Rev. 2 in force for the DFARS 252.204-7012 clause until further notice. If you work for a civilian agency or have a contract that cites Rev. 3, the answer is different, so read the clause text in your own contract.

What changed in Rev. 3

  • More families. Rev. 3 groups requirements into 17 families. The three new ones, Planning, System and Services Acquisition, and Supply Chain Risk Management, bring in things such as security planning documents, secure development and acquisition practices, and managing supplier risk.
  • Organization-defined parameters. Many requirements now contain a variable that must be set, for example how long a session may be idle or how often a review is done. The value can be given by the federal agency in the contract, or if not, chosen by you and written down. This is the biggest practical change: you need to know who owns each value.
  • Consolidation and rewording. Related requirements in Rev. 2 are merged or reworded in Rev. 3, and the old labels basic and derived are gone. Counts are therefore not directly comparable: Rev. 2 has 110 requirements; Rev. 3 is a restructured set of 97 requirements.
  • Clearer separation from SP 800-53. Rev. 3 is tailored from the NIST SP 800-53 control catalog and ties each requirement to it, which helps if you also use that catalog.

NIST also publishes a change analysis spreadsheet that maps each Rev. 2 requirement to its Rev. 3 counterpart, and a CUI overlay. Those two files are the fastest way to see what a move would mean for you.

What to do now

  • Keep building to Rev. 2 for any contract or CMMC assessment that names it. Do not stop and wait.
  • Write your system security plan and policies so they are easy to re-map: one clear owner and evidence per requirement.
  • Ask each prime and each contracting officer in writing which revision your contract uses, and keep the answer.
  • When you buy or build something new, prefer controls that satisfy both revisions, such as strong multi-factor authentication, logging, configuration baselines and supplier reviews.
  • Use the NIST change analysis once to find the Rev. 3 requirements that have no Rev. 2 counterpart, mainly in planning, acquisition and supply chain. Start those documents early since they are low cost.

If you want a readiness review mapped to the revision your contract names, with a gap list you can show a prime, ask about our Cybersecurity service. We assess and help you fix; we are not an assessment body and cannot tell you which revision your contract uses.

Sources

This article is general information, not legal, contracting or technical advice for your environment. The revision that applies is set by your contract and DoD or agency rules; confirm it with your prime and contracting officer. Last reviewed .

Next article

Related reading

Need help with this?

We find out whether everything you run is safe from attackers, then we fix it.

Cybersecurity