Revision 3 of NIST SP 800-171 is out, but defense work still uses Revision 2

Checked on 8 October 2026.

What happened

  • 14 May 2024. NIST (the National Institute of Standards and Technology) published Revision 3 of Special Publication (SP) 800-171. It sets security requirements for protecting CUI (Controlled Unclassified Information: sensitive government information your contract marks or describes, such as drawings, specifications or technical data). At NIST, Revision 3 replaced Revision 2.
  • 23 June 2026. A proposed rule for federal contracts named Revision 3 for CUI. It is not final. Our article on the proposed CUI rule explains it.
  • 13 July 2026. The Department of War (the new name of the Department of Defense) paused Phase 2 of CMMC, the Cybersecurity Maturity Model Certification program. Its memo, as the official contracting memo describes it, requires “baseline compliance with NIST SP 800-171 Rev 2” under the clause DFARS 252.204-7012 (DFARS: the Defense Federal Acquisition Regulation Supplement, the Department’s own contract rules).

Revision 3 is not a copy of Revision 2: NIST’s page links to a change analysis between the two. Revision 3 has its own assessment guide, SP 800-171A Revision 3. It also leaves some values in its requirements open, which NIST calls organization-defined parameters. Under the proposed rule, the government would set them.

What it means for you

NIST writes the requirements. Your contract decides which revision you must meet. NIST itself says its requirements are meant for agencies to use in contracts and agreements.

  • Defense contracts: Revision 2. The text of DFARS 252.204-7012 that the Department’s contracting officers now use, dated June 2026, names Revision 2.
  • CMMC Level 2: Revision 2. The CMMC rule says the Level 2 requirements are identical to the 110 requirements of Revision 2. Level 2 assessments use NIST’s assessment guide of June 2018, SP 800-171A, not the Revision 3 guide.
  • Federal contracts under the proposal: perhaps Revision 3, later. The proposed rule would ask for Revision 3, with set values for the choices it leaves open. On CUI, it names defense contracts only to say where incident reports go, and it does not say how it would sit beside DFARS 252.204-7012. It can change before it is final.

So for defense work, what you have done to Revision 2 is still what your contracts ask for.

What comes next

The proposed rule says its values for Revision 3 match the values the Department will write into the CMMC rule (32 CFR Part 170) through its own rulemaking. As of 8 October 2026, the CMMC rule still names Revision 2. Whether and when defense contracts move to Revision 3 is not known as of 8 October 2026.

What to do now

  1. Keep working to Revision 2 for your defense contracts. It is what DFARS 252.204-7012 and CMMC Level 2 name today.
  2. We suggest you do not rebuild your work around Revision 3 until a rule or your contract asks for it.
  3. Check which revision each new contract or request for bids names. If one names Revision 3, ask the contracting officer named in it, or your contact at the company you supply, what they expect.
  4. If you have CUI work for any federal agency, defense or civilian, keep an eye on the proposed rule. It names Revision 3.

Sources