NIST 800-171 Rev 3: What Changed, and Why DoD Contractors Still Build to Rev 2

What is NIST SP 800-171?

NIST SP 800-171 is the National Institute of Standards and Technology’s list of security requirements for protecting Controlled Unclassified Information on systems the government doesn’t own. If you’re a contractor and CUI lands on your computers, this is the rulebook for how those computers are secured. NIST says it’s meant for use in federal contracts with nonfederal organizations.

For DoD contractors, two things point at it. DFARS 252.204-7012 requires “adequate security” on contractor systems that hold covered defense information, and NIST SP 800-171 sets the minimum. And CMMC Level 2 is an assessment against it. Our CMMC Level 2 requirements guide covers that assessment, and our DFARS 252.204-7012 guide covers the clause. This page is about the standard itself, and which version you should be building to.

What changed in NIST 800-171 Rev 3?

NIST published Revision 3 in May 2024. It has 97 security requirements in 17 families, down from 110 requirements in 14 families in Rev 2. The requirements now track the SP 800-53 moderate baseline more closely, and many of them are more specific about what you have to do.

The Rev 3 document’s change log (Appendix E) lists the big moves:

• No more basic vs. derived. Rev 2 split requirements into two types. Rev 3 dropped that distinction.
• Organization-defined parameters (ODPs). Some requirements now have blanks you fill in. More on that below.
• Grouped and withdrawn requirements. NIST grouped related requirements where it could and “removed outdated and redundant security requirements.” The old numbers stay in the document marked “Withdrawn,” so the numbering doesn’t shift.
• New requirements, and titles. Every requirement now has a name, like “03.01.08 Unsuccessful Logon Attempts.”
• Three new families. Planning, System and Services Acquisition, and Supply Chain Risk Management.

Those new families are where a small shop will feel the change. Planning includes 03.15.02, System Security Plan, and 03.15.03, Rules of Behavior. System and Services Acquisition includes 03.16.02, Unsupported System Components. Supply Chain Risk Management asks for a written supply chain risk management plan.

If you run old Windows on the plant floor, note that unsupported-components requirement. It’s not part of the standard CMMC scores you against today, but it’s the direction NIST is headed.

What are organization-defined parameters?

Organization-defined parameters are blanks inside a requirement that you have to fill in with your own value. NIST doesn’t set the values. Rev 3 says that if a federal agency doesn’t assign a value, the contractor “must assign the value or values to complete the security requirement.”

Here’s 03.01.08 from Rev 3. It says to “enforce a limit of [Assignment: organization-defined number] consecutive invalid logon attempts by a user during a [Assignment: organization-defined time period].” Then it gives you a list of actions to pick from when the limit is hit: lock the account for a set time, lock it until an admin releases it, delay the next prompt, and so on.

Password management works the same way. Rev 3 requires a list of commonly used or compromised passwords, a check against that list whenever someone sets a password, and an update to the list on a schedule you define.

In practice, ODPs move decisions out of an assessor’s head and into your policy. You pick the number, write it down, and configure your systems to match. That’s good discipline under Rev 2 as well.

Does CMMC use Rev 2 or Rev 3?

Rev 2. The CMMC program rule incorporates a specific edition by reference, and it isn’t the current one. 32 CFR 170.2 lists “SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, Revision 2, February 2020 (includes updates as of January 28, 2021).” It also incorporates the June 2018 edition of SP 800-171A, the assessment procedures that go with Rev 2.

That holds even though NIST withdrew Revision 2 on May 14, 2024 and lists Rev 3 as its replacement. A regulation that incorporates a dated document keeps pointing at that document until the regulation is amended. Moving CMMC to Rev 3 would take a rule change.

So a CMMC Level 2 assessment, whether self or C3PAO, checks the 110 Rev 2 requirements. Your score in SPRS is on the Rev 2 scale. Our SPRS score guide walks through how that number works.

Is there a DoD class deviation for Rev 3?

Yes. On May 2, 2024, DoD issued Class Deviation 2024-O0013, and on May 22, 2024 it issued Revision 1. The standard DFARS 252.204-7012 clause points to the version of 800-171 “in effect at the time the solicitation is issued,” which would have meant Rev 3. The deviation changes that.

In DoD’s words, the deviation clause “requires contractors, who are subject to 252.204-7012, to comply with NIST SP 800-171 Revision 2.” It also says the deviation “remains in effect until rescinded.” It was still on DoD’s list of active class deviations in the April 2026 archive of that page. I haven’t found a rescission.

DoD repeated the point more recently. Class Deviation 2026-O0025, Revision 3, signed in September 2026, tells contracting officers to follow the July 13, 2026 memo that suspended CMMC Phase 2. Per the deviation, that memo “requires baseline compliance with NIST SP 800-171 Rev 2 in accordance with the clause at DFARS 252.204-7012.” Our CMMC Level 1 guide covers the pause itself.

Which revision should I build to today?

If you hold or want DoD work, build to Rev 2. All 110 requirements, scored the Rev 2 way, documented in a system security plan written against Rev 2. That’s what DFARS 7012 requires under the deviation and what a CMMC assessment checks. Our system security plan template is set up for that.

Then borrow from Rev 3 where it’s cheap and makes you safer. Some examples:

1. Write down your parameters. Lockout threshold, session timeout, log review interval, patch windows. Rev 2 assessors ask how you decided anyway.
2. Keep a banned-password list and check new passwords against it.
3. Inventory unsupported systems and document how each one is isolated. That’s also what CMMC scoping wants for specialized assets under Rev 2.
4. Know your suppliers. List the vendors and service providers that touch your CUI environment, including us if we manage it.

Don’t rewrite your SSP to Rev 3 numbering. An assessor scoring you against Rev 2 needs to find each Rev 2 requirement where they expect it. Moving CMMC to Rev 3 would take a change to 32 CFR 170, and the 7012 deviation would have to be rescinded. If that happens, you’ll be starting from a working system instead of a blank page.

Key takeaways

What this looks like when we do it

Limehawk isn’t a C3PAO, an RPO, or an assessor, and we don’t score or certify anyone. We do the IT work under the requirements.

For a manufacturer with CUI drawings coming in, that means scoping first, then building to Rev 2: MFA everywhere, encryption with recovery keys escrowed (we’ve written up a BitLocker rollout across a fleet), logging, patching, and an asset inventory built from live data. Where Rev 3 is a cheap upgrade, like a written lockout threshold or a list of unsupported machines, we do that too.

The plant floor is usually where the real work is. If you’re a manufacturer handling CUI, that’s where we start. We keep legacy Windows and controllers running, isolated and documented, instead of forcing replacements. Our manufacturing IT support page covers how we segment OT from the office.

Not sure which revision your contract points at? Book a call and we’ll read the clause with you.