NIST SP 800-171 Revision 3

NIST published SP 800-171 Revision 3 on 14 May 2024. It restructures the standard into 97 requirements across 17 families, introduces organization-defined parameters, and replaces the assessment procedures in SP 800-171A. It is the current NIST version. It is not, yet, what defense contractors are measured against.

DoD class deviation 2024-O0013 keeps DFARS 252.204-7012 pinned to Revision 2, and CMMC Level 2 assessments use Revision 2 as well. That divergence is the most important thing to understand about Revision 3: implement and score to Revision 2 today, plan with Revision 3 in mind.

Revision 2 vs Revision 3

• Requirements: 110 in Rev 2; 97 in Rev 3.
• Families: 14 in Rev 2; 17 in Rev 3, with Planning, System and Services Acquisition, and Supply Chain Risk Management added.
• Parameters: Rev 2 states fixed requirements; Rev 3 uses organization-defined parameters (ODPs) for frequencies, thresholds and time periods.
• Assessment: Rev 2 is assessed with 800-171A’s 320 objectives; Rev 3 uses a rewritten 800-171A with determination statements that do not map one-to-one.
• Source alignment: Rev 3 tracks the SP 800-53 Rev 5 moderate baseline more closely, which is why wording and structure changed.
• Contractual status: Rev 2 is required by DFARS today; Rev 3 is not.

A lower requirement count does not mean less work. Several Rev 2 requirements were merged, a number were withdrawn and folded into others, and the three new families bring in planning, acquisition and supplier obligations that Rev 2 touched only lightly.

The three new families

Planning (PL)

Formalizes security policies, rules of behavior and the system security plan as a managed set of documents rather than a single artifact. Organizations with an SSP that is rarely updated will feel this first.

System and Services Acquisition (SA)

Brings security engineering principles, unsupported system components and external system services into scope. Legacy operating systems and unmanaged vendor services become explicit findings rather than implicit risks.

Supply Chain Risk Management (SR)

Requires a supply chain risk management plan, acquisition strategies that address supplier risk, and notification agreements with suppliers. For contractors who already manage flow-down, see CMMC flow-down requirements.

Examples of what changed

• Withdrawn and merged requirements. Several narrow Revision 2 requirements were withdrawn and their intent folded into broader ones, which is most of the reason the count fell from 110 to 97.
• Documentation made explicit. Policies and procedures that Revision 2 implied are now stated requirements, with the planning family making the SSP part of a maintained set rather than a single deliverable.
• Unsupported components. Systems the vendor no longer supports must be replaced or justified with alternative sources of support, which matters for manufacturers running legacy shop-floor equipment.
• External system services. Cloud and managed services used for CUI must have their security requirements defined and monitored, tightening how providers are selected and overseen.
• Assessment language. The new 800-171A replaces the familiar objectives with determination statements, so evidence mapped to Revision 2 objectives will need re-mapping when the baseline moves.

Why organization-defined parameters matter

Revision 2 says what to do; Revision 3 often says what to do and leaves how often, how long or how many to be defined. Examples include how frequently audit logs are reviewed, how long accounts can sit inactive before they are disabled, and how many failed logins trigger a lockout. When DoD adopts Revision 3, contractors will need to know which values apply and evidence that they are enforced, which makes configuration management and documentation more important, not less.

What to do now

1. Keep your baseline on Revision 2. Your SSP, POA&M, evidence and SPRS score should all reference Revision 2, because that is the contractual standard. See NIST SP 800-171 Revision 2.
2. Design new systems for Revision 3. Architecture and tooling decisions made this year will still be in place when the baseline moves. Choosing tools that can enforce configurable parameters and produce supplier and acquisition evidence avoids rework later.
3. Watch the program status. A move to Revision 3 would come through DFARS rulemaking and CMMC program changes, with notice. The CMMC program status page tracks what has changed.
4. Do not run two scores. Scoring yourself against both revisions creates conflicting records. Score Revision 2; keep a Revision 3 gap list as a planning document.

The full Revision 2 baseline, with SPRS points per family, is on NIST SP 800-171 requirements. If you want to know where you stand against it today, a CMMC gap assessment scores all 110 requirements at objective level.