NIST SP 800-171 Rev. 3: What Changed and When It Applies

Short answer: NIST published SP 800-171 Revision 3 on May 14, 2024. It reorganizes the CUI security requirements into 97 requirements across 17 families, adds three families (Planning, System and Services Acquisition, and Supply Chain Risk Management), and introduces organization-defined parameters. But DoD contracts still require Revision 2. A DoD class deviation keeps DFARS 252.204-7012 tied to Rev. 2, and CMMC Level 2 is assessed against Rev. 2’s 110 requirements. Implement Rev. 2 now, and use Rev. 3 to plan ahead.

What is NIST SP 800-171 Rev. 3?

NIST SP 800-171 sets the security requirements nonfederal organizations use to protect Controlled Unclassified Information (what is CUI?). Revision 3 is the first major update since Rev. 2 in 2020. NIST released it alongside SP 800-171A Rev. 3, the companion that defines how each requirement is assessed. Rev. 3 aligns the requirements more closely with NIST SP 800-53 Rev. 5 and its moderate baseline, which is where the 800-171 requirements come from.

What changed from Rev. 2 to Rev. 3?

Fewer requirements doesn’t mean less work

The drop from 110 to 97 comes mainly from consolidation, not removal of protections. Many Rev. 3 requirements combine several Rev. 2 requirements and add detail drawn from SP 800-53 Rev. 5. Expect the same or more effort, not less.

The three new families

• Planning (PL): security policies and procedures, rules of behavior, and the system security plan as an explicit family.
• System and Services Acquisition (SA): security engineering principles, handling of unsupported system components, and requirements for external system services.
• Supply Chain Risk Management (SR): a supply chain risk management plan, acquisition strategies, and controls over the suppliers and components you rely on.

For small contractors, SR is the biggest shift. Rev. 2 had little to say about suppliers; Rev. 3 expects a documented approach.

Organization-defined parameters

Many Rev. 3 requirements include placeholders such as “[Assignment: organization-defined frequency].” The organization, or the agency through its contracts, fills them in. In April 2025, DoD published its own ODP values for Rev. 3, signaling what it would expect if Rev. 3 is adopted. Those values aren’t a contract requirement today.

Which revision do DoD contractors have to follow?

Revision 2. Here’s why:

1. DoD class deviation. In May 2024, DoD issued Class Deviation 2024-O0013, which keeps DFARS 252.204-7012 tied to NIST SP 800-171 Rev. 2 until further notice, even though NIST now lists Rev. 2 as superseded.
2. CMMC rule. 32 CFR Part 170 incorporates NIST SP 800-171 Rev. 2 by reference. CMMC Level 2 assessments, self or third-party, are against Rev. 2’s 110 requirements.
3. Later deviations kept Rev. 2. DoD’s 2026 class deviation implementing the CMMC Phase II suspension (2026-O0025, revised most recently in September 2026) continues to require Rev. 2 where DFARS 7012 applies.

Your SPRS score is also calculated on Rev. 2 using the DoD Assessment Methodology (what is an SPRS score?). Check your contract’s clauses and the DoD CIO CMMC page for any change. Until DoD acts, Rev. 2 is the version that counts.

Civilian agencies can also reference NIST SP 800-171 in their own contracts. If you hold non-DoD contracts with CUI requirements, check which revision each one names.

How should we prepare for Rev. 3 without wasting effort?

1. Finish Rev. 2 first. Your score, SSP, and any CMMC assessment depend on it (NIST 800-171 compliance checklist).
2. Build your SSP so it can be re-mapped. Describe how controls actually work in your environment rather than copying requirement text. Good implementation descriptions carry over to Rev. 3 with little rework.
3. Start a supplier inventory. List the vendors, cloud services, and IT providers that touch CUI. It helps under Rev. 2 (external services and flow-down) and is the foundation of the Rev. 3 SR family.
4. Note where you’d set frequencies. Rev. 3’s ODPs ask you to define review and update intervals. Writing them down now (for example, how often you review logs or accounts) strengthens your Rev. 2 evidence too.
5. Watch for an official transition. Don’t implement Rev. 3 instead of Rev. 2. An assessment against Rev. 2 won’t credit Rev. 3 numbering or wording.

Frequently Asked Questions

Is NIST 800-171 Rev. 3 required for CMMC?

No. CMMC Level 2 is assessed against NIST SP 800-171 Rev. 2, which 32 CFR Part 170 incorporates by reference. Changing that would require DoD action.

Why did NIST withdraw Rev. 2 if DoD still uses it?

NIST publishes and updates standards; it doesn’t control which version a contract requires. NIST marked Rev. 2 as superseded when Rev. 3 was published, and DoD used a class deviation to keep its contracts on Rev. 2.

How many requirements are in Rev. 3?

97 security requirements across 17 families, compared with 110 requirements in 14 families in Rev. 2.

Should a new contractor start with Rev. 2 or Rev. 3?

Rev. 2, because that’s what DoD contracts and CMMC assessments use. Design your documentation so it can be mapped to Rev. 3 later.

How USCIBER can help

USCIBER assesses your environment against the Rev. 2 requirements DoD requires today and documents it in a way that maps cleanly to Rev. 3 later. Start with a CMMC Readiness Review (from $7,500), or see NIST 800-171 & DFARS compliance. For how the pieces connect, read CMMC vs. NIST 800-171.

Sources

• NIST SP 800-171 Rev. 3 — Final publication (May 2024)
• NIST SP 800-171A Rev. 3 — Assessing Security Requirements for CUI
• NIST SP 800-171 Rev. 2 — Final publication
• 32 CFR Part 170 — CMMC Program (eCFR)
• DoD CIO — Organization-Defined Parameters for NIST SP 800-171 Rev. 3
• Defense Pricing, Contracting, and Acquisition Policy — DFARS class deviations
• DoD CIO — CMMC program

This article is general information, not legal advice.