NIST SP 800-171 Rev 3: What Changed and What It Means for CMMC

NIST SP 800-171 Rev 3 Is Published — Should You Panic?

No. But you should pay attention.

NIST published SP 800-171 Revision 3 in May 2024, replacing the Rev 2 standard that has governed CUI protection since 2020. Rev 3 is a significant structural overhaul — more controls, new families, and tighter alignment with the broader NIST SP 800-53 framework.

However, CMMC Level 2 assessments still reference Rev 2 as of early 2026. The DOD has not yet updated DFARS or the CMMC assessment methodology to require Rev 3. Your immediate priority remains certifying against the 110 Rev 2 controls before the November 2026 Phase 3 deadline.

That said, Rev 3 is coming. Here's what changed and how to prepare.

What Changed in Rev 3

More Requirements

Rev 2 had 110 controls across 14 families. Rev 3 expands to 156 requirements across 17 families. Many existing controls were split into more granular requirements, and new requirements were added for threat areas that didn't exist (or weren't prioritized) when Rev 2 was written.

Three New Control Families

Rev 3 adds three families that didn't exist in Rev 2:

• Planning (PL): Requires documented security plans describing system boundaries, operational environments, and control implementations. If you're building an SSP for CMMC today, you're already doing most of this.

• Program Management (PM): Organization-wide security program requirements including risk management strategy, insider threat programs, and security workforce planning. This formalizes what many mature organizations already practice.

• Supply Chain Risk Management (SR): Addresses ICT/OT supply chain risks — component authenticity, supplier assessments, provenance tracking, and acquisition strategies. This is the biggest net-new area for most contractors.

Zero Trust and Cloud

Rev 3 significantly strengthens network security requirements. New requirements address:

• Zero-trust architecture principles and microsegmentation
• Cloud service provider oversight and shared responsibility documentation
• FedRAMP alignment for cloud-hosted CUI environments
• Software supply chain integrity including SBOM requirements

Alignment with SP 800-53 Rev 5

Rev 3 control identifiers now map directly to NIST SP 800-53 Rev 5. If your organization also follows FedRAMP or FISMA, this simplifies cross-framework compliance significantly.

The Transition Timeline

Here's what we know about the DOD's path from Rev 2 to Rev 3:

Date	Event
May 2024	NIST publishes SP 800-171 Rev 3 (final)
December 2024	CMMC 32 CFR Final Rule takes effect — references Rev 2
October 2025	CMMC Phase 2 begins — Level 2 in select contracts
November 2026	Phase 3 deadline — Level 2 required for all CUI contracts
~2027	Expected: DOD begins DFARS rulemaking to adopt Rev 3
~2028	Expected: CMMC assessments updated to reference Rev 3

The key takeaway: you have roughly 2 years after your Rev 2 certification before Rev 3 becomes mandatory. That's enough time to prepare if you start tracking the changes now.

What Should You Do Now?

1. Certify Against Rev 2 First

This is non-negotiable. The November 2026 deadline is real, and CMMC assessors will evaluate you against Rev 2's 110 controls. Don't get distracted by Rev 3 at the expense of your current certification.

2. Understand the Gap

Once you're Rev 2 compliant, the jump to Rev 3 is incremental — not a restart. Most of the 156 Rev 3 requirements map to existing Rev 2 controls. The net-new areas are primarily:

• Supply chain risk management
• Formal security planning documentation
• Program management governance
• Enhanced zero-trust and cloud controls

3. Start Building Supply Chain Practices

The Supply Chain Risk Management (SR) family is the biggest new area and the hardest to implement quickly. Start by:

• Inventorying your critical ICT/OT suppliers
• Documenting your acquisition and procurement processes
• Establishing supplier assessment criteria

4. Document Your Cloud Architecture

If you use cloud services for CUI processing (and most contractors do), start documenting:

• Which cloud services handle CUI
• FedRAMP authorization status of each provider
• Shared responsibility matrix for each service
• Data flow diagrams showing CUI boundaries

5. Follow the DOD Rulemaking

When DOD begins the DFARS rulemaking process to adopt Rev 3, there will be a public comment period. This is when the actual transition timeline will become clear.

How CMMC Command Is Preparing

We're tracking the Rev 3 transition closely. Our roadmap includes:

• Rev 3 control mapping — showing exactly how your current Rev 2 controls map to Rev 3 requirements
• Gap identification — highlighting the net-new Rev 3 requirements you'll need to address
• Updated SPRS scoring — when DOD publishes Rev 3 weights, we'll implement the new scoring model
• Transition planning tools — helping you prioritize the new requirements by effort and impact

In the meantime, every hour you invest in Rev 2 compliance pays forward. The controls don't disappear in Rev 3 — they get restructured and expanded. A strong Rev 2 foundation makes Rev 3 transition straightforward.

Start your free CMMC assessment — get Rev 2 certified first, and we'll guide you through Rev 3 when the time comes.