NIST 800-171 Rev 3: What Changed from Rev 2 (and What CMMC Still Uses)

What Changed from Rev 2 to Rev 3

Per NIST's Rev 3 FAQ and the final publication:

• Families: 14 to 17 — added Planning (PL), System and Services Acquisition (SA), and Supply Chain Risk Management (SR); Security Assessment renamed Assessment, Authorization, and Monitoring (CA)
• Eliminated the basic vs derived distinction and the NFO tailoring category; added ORC (other related controls)
• Introduced organization-defined parameters (ODPs) — NIST does not assign ODP values; agencies (or nonfederal orgs if the agency is silent) must
• Requirements restructured against SP 800-53 Rev 5 / SP 800-53B moderate baseline (NIST publishes a Rev 2 to Rev 3 change-analysis spreadsheet)

Final Rev 3 count: 97 active security requirements across 17 families (enumerated from the final May 2024 PDF).

Rev 3's 17 Security Requirement Families

Source: NIST SP 800-171 Rev 3, Table 1 / Section 3.

Not 800-171 requirement families (tailored out): Contingency Planning (CP), Program Management (PM), and PII Processing and Transparency (PT).

Why It Matters for DoD Suppliers

DoD suppliers must not “upgrade” CMMC Level 2 assessments to Rev 3 today. Keep SPRS scoring and SSP/POA&M evidence on Rev 2, while crosswalking early to Rev 3 for ODPs and SCRM readiness.

How CyberSilo Helps

• Compliance Standards Automation — Rev 2 evidence packs plus Rev 3 readiness crosswalk
• ThreatHawk SIEM — AU/IR-style logging and monitoring evidence

Frequently Asked Questions

Does CMMC Level 2 use 800-171 Rev 3?

No. Under 32 CFR 170.14, CMMC Level 2 security requirements are identical to NIST SP 800-171 Revision 2 until a published rule changes that baseline.

How many requirements are in final Rev 3?

97 active security requirements across 17 families, per the final May 2024 publication.

Who sets organization-defined parameters (ODPs)?

A federal agency or consortium may specify ODP values. If they do not, the nonfederal organization must assign values to complete the requirement. NIST does not assign ODP values.

Related NIST Resources

NIST hub · What Is NIST CSF 2.0? · CSF Function Guides · 800-53 Rev 5 Families