NIST 800-171 Revision 3 is out. Defense contracts still hold you to Revision 2.
By Sid Varma, Founder - AllyMatter.com
Published September 26, 2026
The short version
- NIST published SP 800-171 Revision 3 in May 2024 and withdrew Revision 2 on May 14, 2024. Revision 3 has 97 requirements in 17 families; Revision 2 has 110 in 14.
- Defense contractors are still held to Revision 2. The DFARS 252.204-7012 clause that contracting officers must use names "Revision 2", and the CMMC rule at 32 CFR Part 170 incorporates Revision 2 by reference.
- The July 13, 2026 memorandum suspending CMMC Phase 2 says the Department will enforce baseline compliance with NIST SP 800-171 Rev 2 during the suspension.
- The Department has listed a CMMC amendment to move from Revision 2 to Revision 3, with an interim final rule targeted for July 2026. As of September 25, 2026 it has not been published.
- A government-wide FAR rule that would require Revision 3 was proposed on June 23, 2026. It is a proposal, not a requirement.
NIST, the standards body, replaced its guide to protecting Controlled Unclassified Information (CUI) in May 2024. Revision 3 of Special Publication 800-171 rewrote the requirements, cut the count from 110 to 97 and added three families. NIST marked Revision 2 as withdrawn the same month.
Defense contracts did not follow. On September 25, 2026 the clause in Department of War contracts, and the CMMC program rule, still point to Revision 2. This article sets out what changed between the two revisions, which one each kind of contractor is held to today, and what is pending.
What did NIST change in Revision 3?
It rewrote the requirements to track the moderate baseline of the federal control catalog, SP 800-53B, and made them more specific.
NIST's change log for Revision 3 lists, among other things, that it "eliminated the distinction between basic and derived security requirements", "introduced organization-defined parameters (ODPs)", "removed outdated and redundant security requirements" and "added new security requirements".
| Revision 2 | Revision 3 | |
|---|---|---|
| Published | February 2020, updated January 28, 2021 | May 2024 |
| Status at NIST | Withdrawn on May 14, 2024 | Current |
| Requirements | 110 | 97 (some retired numbers are kept and marked "Withdrawn") |
| Families | 14 | 17: adds Planning, System and Services Acquisition, and Supply Chain Risk Management |
| Numbering | 3.1.1, 3.5.7 | 03.01.01, 03.05.07 |
| Fill-in values (ODPs) | None | Yes. NIST sets no values; the agency, or failing that the contractor, assigns them |
| Assessment guide | SP 800-171A, June 2018 | SP 800-171A Revision 3, May 2024 |
The organization-defined parameters are the change most people notice first. Where Revision 2 says "enforce a minimum password complexity", Revision 3 asks for "[Assignment: organization-defined composition and complexity rules]". NIST states that it "does not establish or assign values for ODPs".
The Department of Defense published its own values in a memorandum signed on April 10, 2025. For that password requirement, the Department's value includes a "minimum length of 16 characters".
Which revision do defense contracts require today?
Revision 2. Three documents say so, and none has changed on that point.
First, the contract clause. The published text of DFARS 252.204-7012 in the eCFR refers to the version of SP 800-171 "in effect at the time the solicitation is issued". Read literally, that wording would have brought Revision 3 into new solicitations once NIST released it.
The Department prevented that with Class Deviation 2024-O0013 of May 2, 2024 (revised May 22, 2024), which told contracting officers to use a version of the clause requiring "NIST SP 800-171 Revision 2". That deviation now sits on the archived 2024 page of the Defense Pricing, Contracting, and Acquisition Policy office.
The same pin is carried in the version of 252.204-7012 attached to Class Deviation 2026-O0025, Revision 3, of September 3, 2026, which names "Revision 2" and links to the Revision 2 PDF.
Second, the CMMC rule. 32 CFR 170.2 incorporates by reference SP 800-171 "Revision 2, February 2020 (includes updates as of January 28, 2021)", and 170.14(c)(3) says the Level 2 requirements "are identical to the requirements in NIST SP 800-171 R2".
Third, the suspension. The implementing memorandum of July 13, 2026 says "CMMC Level 2 is aligned with NIST SP 800-171 Rev 2" and that the Department will enforce baseline compliance with Rev 2 through self-assessments and select government-led assessments. Our article on the CMMC Phase 2 suspension, published today, covers the rest of that memorandum.
| Who | Revision on September 25, 2026 | Where it comes from |
|---|---|---|
| DoD contractor or subcontractor under DFARS 252.204-7012 | Revision 2 | Clause text in Class Deviation 2026-O0025, Rev 3 (earlier, Class Deviation 2024-O0013) |
| CMMC Level 2 (Self) assessment | Revision 2, assessed with SP 800-171A of June 2018 | 32 CFR 170.2 and 170.14(c)(3) |
| CMMC Level 3 (suspended) | Selected requirements from SP 800-172 of February 2021 | 32 CFR 170.14(c)(4) |
| Civilian agency contract under the FAR | No government-wide FAR CUI clause in force; a June 2026 proposal would require Revision 3 | FAR proposed rule, June 23, 2026 |
Is the Department of War moving to Revision 3?
It has said it plans to, but the rule has not appeared. The Department's entry in the 2026 Unified Agenda (RIN 0790-AM01) describes a CMMC amendment that "defines a deadline and period for transition from the requirement to comply with NIST SP 800-171 Revision 2, to a requirement to comply with NIST SP 800-171 Revision 3", and would revise the NIST documents incorporated by reference in 32 CFR Part 170.
It lists an interim final rule for "07/00/2026", meaning July 2026 with no fixed day.
As of September 25, 2026 we found no such rule in the Federal Register, and the eCFR shows no amendment to Part 170 since it took effect on December 16, 2024. The April 2025 memorandum setting the Department's parameter values says they were defined "in preparation to implement" Revision 3 "as the minimum requirement for contractors". Preparation is not a requirement.
Until the rule and the contract clause change, the contract text governs, and a contracting officer is the person who can confirm what a particular contract requires.
What about the government-wide FAR CUI rule?
It is still a proposal, and it has switched from Revision 2 to Revision 3. The FAR Council first proposed a CUI rule for all federal contracts on January 15, 2025 (FAR Case 2017-016). That version referred to "NIST SP 800-171, Revision 2".
On June 23, 2026 the FAR Council folded that case into its Revolutionary FAR Overhaul proposal for Part 40. The proposed clause at FAR 52.240-7 would require contractors running their own systems to "comply with the security requirements of NIST SP 800-171 Revision 3" and to apply the parameter values the Department of War publishes.
The preamble says the rule "aligns to the values that will be codified in 32 CFR part 170 via DoD rulemaking". Comments closed on July 23, 2026. We found no final rule as of September 25, 2026, so the clause has no legal effect yet.
What else did NIST publish in 2025 and 2026?
Two things matter here. On August 18, 2025 NIST released a small business primer for Revision 3, which includes the key differences between Revision 2 and Revision 3. On May 13, 2026 it published final SP 800-172 Revision 3 and SP 800-172A Revision 3, the enhanced requirements for high-value programs and their assessment procedures, together with a CUI control overlay.
The CMMC rule has not caught up with that either. Level 3 still draws on the February 2021 edition of SP 800-172, as 32 CFR 170.14(c)(4) states. While the Phase 2 suspension lasts, Level 3 cannot be designated, and existing Level 3 requirements are to be removed by contract modification.
What are others saying?
These are the pieces we found best argued. Each takes a position of its own, and none of them is the basis for a fact in this article; every fact rests on the sources listed below.
Eric S. Crusius of Hunton Andrews Kurth argues that the move to Revision 3 in the FAR proposal leaves contractors who are already compliant with Revision 2 needing to work through the difference between the two, so that they can satisfy both control regimes. He also reads the rule as reaching most federal contractors that handle CUI, and says companies with mature DFARS 7012 programs will have a head start.
Tracye Winfrey Howard and colleagues at Wiley write that the proposal would put SP 800-171 obligations on a broader group of contractors than ever before, and that by adopting Revision 3 it foreshadows the Department of Defense making the same shift in a separate rulemaking.
Susan B. Cassidy, Ashden Fein and colleagues at Covington say that, in a proposal that eases some obligations, the Revision 3 requirement could have a significant impact on contractors that have been working to Revision 2, and read it as a likely signal that the Department will move CMMC from Revision 2 to Revision 3. They expect contractors to need to check whether existing programs cover Revision 3 and to strengthen some controls.
What we could not verify
Whether the planned interim final rule (RIN 0790-AM01) is still on course after the July 13, 2026 suspension and the CMMC Reform Task Force review. Neither memorandum mentions Revision 3, and the Department has not published the review's findings.
How long the transition period in that rule would be, and whether existing Revision 2 self-assessment scores would carry over. The agenda entry says only that the amendment "defines a deadline and period for transition".
When, or in what form, the FAR Part 40 proposal will be finalized, and how its Revision 3 clause would sit alongside DFARS 252.204-7012 on a defense contract. The proposed rule does not say.
The exact date Class Deviation 2024-O0013 stopped being in effect. It appears on an archived page, and its Revision 2 wording now lives in the clause attached to Class Deviation 2026-O0025, but we found no document stating when it was rescinded.
Need a hand implementing it?
Find a consultant for CMMC/NIST 800-171
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.
What people ask.
Should our System Security Plan follow Revision 2 or Revision 3?
For a defense contract under DFARS 252.204-7012, the clause contracting officers must use names Revision 2, and CMMC Level 2 is defined as Revision 2. Nothing we found changes that as of September 25, 2026. Your contracting officer can confirm what your contract says.
Is Revision 2 still available if NIST withdrew it?
Yes. NIST keeps the Revision 2 page and PDF online, marked "Withdrawn on May 14, 2024". The clause attached to Class Deviation 2026-O0025 links directly to the Revision 2 PDF.
How many requirements are in Revision 3?
97, in 17 families. Revision 2 has 110 in 14 families. A lower count is not a lighter load. NIST grouped related requirements and removed outdated ones, but it also added new requirements, made them more specific and added parameters that must be filled in.
Where do the Department's Revision 3 parameter values come from?
A Department of Defense memorandum signed on April 10, 2025, titled "Department of Defense Organization-Defined Parameters for National Institute of Standards and Technology Special Publication 800-171 Revision 3". The June 2026 FAR proposal points to the same document.
Does the CMMC Phase 2 suspension change which revision applies?
No. The July 13, 2026 implementing memorandum keeps NIST SP 800-171 Rev 2 as the baseline and keeps DFARS 252.204-7012 in effect.
What each one is doing here.
NIST, SP 800-171 Rev. 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (publication page)NIST, SP 800-171 Rev. 3 (PDF), May 2024NIST, SP 800-171 Rev. 2 (publication page)NIST, SP 800-171 Rev. 2 (PDF)NIST, SP 800-171A Rev. 3 (publication page)NIST, Protecting Controlled Unclassified Information project pageNIST, SP 800-172 Rev. 3 (publication page)Defense Pricing and Contracting, Class Deviation 2024-O0013, Revision 1, Safeguarding Covered Defense Information and Cyber Incident ReportingDefense Pricing, Contracting, and Acquisition Policy, 2024 Class Deviations (archived page)Defense Pricing, Contracting, and Acquisition Policy, Class Deviation 2026-O0025, Revision 3, FAR Overhaul Part 40 and DFARS Part 240, September 3, 2026, with Attachment 1eCFR, DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident ReportingeCFR, 32 CFR 170.2 and 170.14Under Secretary of War for Acquisition and Sustainment, Implementing the Suspension of CMMC Phase 2 Requirements, July 13, 2026, with Attachment 1Department of Defense, Organization-Defined Parameters for NIST SP 800-171 Revision 3, memorandum signed April 10, 2025Reginfo.gov, Unified Agenda entry RIN 0790-AM01, Cybersecurity Maturity Model Certification (CMMC) ProgramFederal Register, Federal Acquisition Regulation: Controlled Unclassified Information, proposed rule, January 15, 2025 (90 FR 4278)Federal Register, Federal Acquisition Regulation: Revolutionary FAR Overhaul Parts 1, 2, 4, 33, 39, 40, and 53, proposed rule, June 23, 2026
What has changed on this page.
Changes
Corrections
None so far.
Found something wrong? [email protected]. We check it against the source, fix it, and record it here with the date.