NIST SP 800-171 Revision 2

NIST SP 800-171 Revision 2 is the standard DFARS 252.204-7012 points at, and the one you are assessed against. It contains 110 requirements across fourteen families, with 320 assessment objectives defined in the companion publication, NIST SP 800-171A.

It is also, confusingly, superseded — in NIST’s catalogue. Both statements are true, and the gap between them is the most common source of confusion in this space.

Why a superseded revision is the one that counts

NIST finalised Revision 3 on 14 May 2024. Ordinarily a DFARS clause pointing at a standard would float to whatever version is current, which would have moved every defense contractor to a new revision overnight.

DoD prevented that. It issued Class Deviation 2024-O0013, amending 252.204-7012 to name Revision 2 specifically. NIST’s catalogue therefore lists Rev 2 as superseded while DFARS continues to require it, and that pin has not been lifted.

The practical rule: build to Revision 2. Be aware of Revision 3. Do not implement Revision 3 in the belief it is safer, because you will be assessed against Rev 2 and will have spent effort on organisation-defined parameters nobody has yet required of you.

What Revision 3 changed, and why it does not help you

Revision 3 is not a tightening so much as a restructuring. NIST withdrew a number of requirements it judged to be either outside a non-federal system’s control or already covered elsewhere, folded others together, and introduced a new category: organisation-defined parameters. Where Rev 2 says to terminate a session after a period of inactivity, Rev 3 asks the organisation to define that period and then hold itself to the figure it set.

That change is reasonable in principle and awkward in practice, because a parameter you define is a parameter you can be assessed against. It also means a Rev 3 implementation is not a superset of a Rev 2 one — the mappings between the two are not one-to-one, requirement identifiers moved, and the tailoring discussion that accompanies Rev 3 is substantial reading in its own right.

The consequence for a defense contractor is straightforward. Building to Rev 3 today means implementing against identifiers that DFARS does not reference, producing a System Security Plan organised around a structure no assessor will be scoring, and then doing crosswalk work to demonstrate Rev 2 coverage anyway. If a future class deviation moves the pin, the migration will be a documented project with a stated effective date. Until then the requirement is Rev 2, and building to anything else is volunteering for translation work.

The shape of the standard

Fourteen families, 110 requirements, and a scoring methodology that assigns each requirement five, three or one point — with a single exception worth nothing at all.

Those weights total 313, which is what produces the SPRS range of 110 down to -203. The distribution is deliberately uneven: 44 requirements carry a five-point weight, 14 carry three, 51 carry one, and 3.12.4 carries none.

The full per-family breakdown — control counts, ID ranges, points at risk and the named five-point requirements — is on the control families page.

Requirements versus objectives

The most consequential thing to understand: you are not assessed against 110 requirements. You are assessed against 320 objectives in NIST SP 800-171A, and a requirement counts as implemented only when every objective beneath it is satisfied.

This is where self-assessment and real assessment diverge, and it explains almost every unpleasant surprise in this process. A requirement reads as one sentence; its objectives ask which systems, which account types, which access paths, how enforcement is verified, and how you know it is still true. Answer at requirement level and you will overstate.

What Rev 2 requires that people underestimate

Three things, consistently:

A System Security Plan. Requirement 3.12.4 is unscored, so it cannot lower your number. But the methodology treats a missing SSP as meaning the assessment could not be completed for want of information — no valid score at all. See the SSP template.

FIPS-validated cryptography, not merely strong cryptography. Requirement 3.13.11 asks for validated modules, which means a CMVP certificate and the product configured in FIPS mode. Using AES is not the same thing, and this is the most-failed requirement in DIBCAC’s published data.

Logging that someone actually reviews. The Audit and Accountability family carries the lowest point density in the standard and holds three of the ten most-failed requirements. Collecting logs is not the requirement; defining which events matter, alerting when logging fails, and reviewing what you collect is.

Where this sits after the suspension

Untouched. The July 2026 suspension and the September class deviation reached CMMC — the certification regime layered on top — not the underlying standard. DFARS 252.204-7012 still requires Revision 2, 7019 and 7020 still require a self-assessment and a posted score, and the 110 requirements are exactly as they were.

If anything the standard matters more now, because the score derived from it is no longer a preliminary figure ahead of third-party verification. It is the artefact the government relies on. See SPRS scoring and program status.

NIST has since published Revision 3 with 97 requirements across 17 families. What changed, and why it is not yet the contractual baseline, is covered in NIST SP 800-171 Revision 3.