Skip to content

Guides DFARS and FAR

NIST SP 800-171 Rev 2 vs Rev 3: which one does DoD require?

DoD contracts and CMMC still require NIST SP 800-171 Revision 2, though NIST withdrew it in May 2024. What Revision 3 changed, and what to assess against today.

By Chris Edwards, Edwards Consulting Group · Updated

DoD requires NIST SP 800-171 Revision 2. The DFARS 252.204-7012 text that DoD contracting officers use names "Revision 2", the CMMC rule at 32 CFR part 170 incorporates Revision 2 and the June 2018 edition of SP 800-171A by reference, and the Department's July 2026 CMMC suspension memo says it will enforce "NIST SP 800-171 Rev 2". NIST withdrew Revision 2 on May 14, 2024 when it published Revision 3, but no DoD rule or deviation has adopted Revision 3. A DoD supplier assesses against Revision 2 today.

This guide explains the rules as of October 21, 2026. It is not legal advice: the clauses in your contract decide what applies to you.

What NIST published, and when

PublicationPublishedStatus on csrc.nist.gov
SP 800-171 Rev. 2February 2020, "includes updates as of January 28, 2021""Withdrawn on May 14, 2024. Superseded by SP 800-171 Rev. 3"
SP 800-171 Rev. 3May 2024 (final May 14, 2024)Current; "Supersedes: SP 800-171 Rev. 2"
SP 800-171AJune 2018"Withdrawn on May 14, 2024." Superseded by SP 800-171A Rev. 3
SP 800-171A Rev. 3May 2024Current; "Supersedes: SP 800-171A (06/13/2018)"

NIST's withdrawal is a statement about NIST's catalogue. What a contractor must implement is set by the contract clause and the regulation, and both still point at the withdrawn edition.

What DFARS 252.204-7012 says

The codified clause, dated MAY 2024 on acquisition.gov, says in (b)(2)(i) that a covered contractor information system "shall be subject to the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, 'Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations' (available via the internet at https://csrc.nist.gov/publications/sp800) in effect at the time the solicitation is issued or as authorized by the Contracting Officer." Read alone, that sentence would have moved new solicitations to Revision 3 on May 14, 2024.

DoD stopped that with a class deviation. Class Deviation 2024-O0013, Revision 1, dated May 22, 2024, "revises and supersedes Class Deviation 2024-O0013, issued on May 2, 2024". Its memo says: "The deviation clause requires contractors, who are subject to 252.204-7012, to comply with NIST SP 800-171 Revision 2, instead of the version of NIST SP 800-171 in effect at the time the solicitation is issued or as authorized by the contracting officer." It "remains in effect until rescinded." As of October 21, 2026 that deviation sits on DPCAP's archived 2024 page, not on its list of current deviations, which the class deviations page describes as "all the current DoW class deviations in effect"; "All other deviations are archived by year."

The Revision 2 wording now lives in the Part 240 deviation. Class Deviation 2026-O0025 (Revision 3, September 3, 2026, on the DPCAP overhaul page) carries 252.204-7012 as "(JUN 2026) (DEVIATION 2026-O0025)", and its (b)(2)(i) reads: "the covered contractor information system shall be subject to the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, 'Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations' Revision 2 (available at https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r2.pdf) in effect at the time the solicitation is issued or as authorized by the Contracting Officer." DoD contracting officers have used this deviation since February 1, 2026. The clause numbers around it are explained in DFARS and FAR cybersecurity clauses, as of 2026.

What the CMMC rule says

32 CFR part 170 names its edition by incorporation by reference. 32 CFR 170.2(a)(9) incorporates "SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, Revision 2, February 2020 (includes updates as of January 28, 2021), (NIST SP 800-171 R2)", and 170.2(a)(10) incorporates "SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information, June 2018 (NIST SP 800-171A Jun2018)" for the assessment sections 170.15 through 170.18.

32 CFR 170.14(c)(3) then says: "The security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2." The definitions in 170.4 count them: "the 110 Level 2 requirements from NIST SP 800-171 R2". Changing CMMC to Revision 3 would take a rulemaking that amends 170.2.

The Department said the same after it suspended CMMC Phase II. Attachment 1 to the July 13, 2026 implementing memo states that "during this suspension the Department will enforce baseline compliance with NIST SP 800-171 Rev 2 through CMMC Level 1 and CMMC Level 2 self-assessment and select Government-led assessments", and that "CMMC Level 2 is aligned with NIST SP 800-171 Rev 2." The DoW CIO's CMMC page describes Level 2 as "the 110 security requirements in NIST SP 800-171 Revision 2". DC3's DCISE page adds: "Note the DoW is assessing compliance against Rev 2. A transition to Rev 3 will be announced by DoW in the future." See CMMC Phase II is suspended: what still applies.

What changed in Revision 3

NIST's change log (Appendix E of Revision 3) lists the edits "from the original edition (February 2020; updated January 28, 2021)". The ones that change how a supplier works:

Revision 2Revision 3
Families"fourteen families""17 families": Planning, System and Services Acquisition, and Supply Chain Risk Management are added
Structure"basic security requirements" and "derived security requirements" in each family"Eliminated the distinction between basic and derived security requirements"
Numbering3.1.1 to 3.14.703.01.01 onward; the requirements now carry titles, and 33 Revision 2 numbers are marked "Withdrawn"
Count110 (32 CFR 170.4)97, by our count of the numbered Section 3 headings not marked "Withdrawn"
ParametersNone"Introduced organization-defined parameters (ODPs) in selected security requirements"
Wording"stated at a high level of abstraction" (NIST FAQ)"Increased the specificity of security requirements to remove ambiguity, improve the effectiveness of implementation, and clarify the scope of assessments"
Assessment companionSP 800-171A (June 2018)SP 800-171A Rev. 3; where a requirement has an ODP, "the assessment objective begins with a determination statement related to the definition of the ODP"

The ODPs are the change with the longest reach. Revision 3 says they "provide flexibility through the use of assignment and selection operations to allow federal agencies and nonfederal organizations to specify values for the designated parameters in the requirements", and footnote 14 adds: "NIST does not establish or assign values for ODPs. If ODP values for selected security requirements are not formally established or assigned by a federal agency or a consortium of federal agencies, nonfederal organizations must assign those values to complete the requirements." For example, requirement 03.13.11 reads "Implement the following types of cryptography when used to protect the confidentiality of CUI: [Assignment: organization-defined types of cryptography]". Under Revision 3 a DoD supplier would need DoD's values to know what to build; under Revision 2 the requirement text is complete as written.

Fewer requirements does not mean less work. NIST's change log says it "Grouped security requirements, where possible" and "Added new security requirements", so a Revision 3 requirement is often several Revision 2 requirements with parameters attached.

What a DoD supplier should assess against today

  1. Assess against Revision 2, using SP 800-171A (June 2018). That is what 32 CFR 170.16 and 170.24 score, what 252.204-7012 under the deviation requires, and what DIBCAC assesses. Scoring is in The SPRS score explained.
  2. Write "NIST SP 800-171 Rev 2" in your system security plan and your SPRS entry. When DoD posts a Medium or High Assessment it records "The standard assessed (e.g., NIST SP 800-171 Rev 1)" (252.240-7997(d)(2)(i)); say which edition your own assessment used the same way, and do not let a template default to Revision 3.
  3. Do not assess against Revision 3 instead. A Revision 3 self-assessment has no place to go: SPRS and CMMC score the 110 Revision 2 requirements, and a Revision 3 result cannot be mapped back one to one.
  4. Read Revision 3 for what is coming. Its 17 families and its ODPs show where DoD's values will be needed when a transition is announced. Nothing in it is a contract requirement until a DFARS rule or deviation and an amendment to 32 CFR 170.2 say so.
  5. Watch three places for the change: the DPCAP class deviation pages, the Federal Register for a DFARS rule on 252.204-7012 and for a 32 CFR part 170 amendment, and the DoW CIO's CMMC page.

Where Tiermark fits

With Supplier Pro, the SPRS score calculator lists the 110 security requirements of NIST SP 800-171 Revision 2 in their 14 families and scores them by the 32 CFR 170.24 method, and the self-assessment workspace shows each requirement's SP 800-171A assessment objectives, 320 across the 110 requirements, for you to mark met, not met or not applicable. The system security plan outline is built from those answers. Tiermark follows the regulation, so it is Revision 2 until the regulation changes.

Sources

Still have a question?

Write to help@tiermark.io and a person will answer.