The Framework5 min read

NIST SP 800-171 Rev 2 vs Rev 3: What Changed

NIST published Rev 3 in May 2024, but CMMC still uses Rev 2 as of 2026. Here's what Rev 3 changes, when DoD will transition, and what contractors should do now.

NIST published SP 800-171 Revision 3 in May 2024. The changes are meaningful, but contractors should understand that CMMC 2.0 is still anchored to Revision 2 as of mid-2026. A transition to Rev 3 will require DoD rulemaking.

Key changes in Revision 3

✓Organization-Defined Parameters (ODPs): Rev 3 introduces customizable parameters in many controls, allowing organizations to define specifics (e.g., password length, review frequency) based on their risk context
✓New control families: Rev 3 adds Planning (PL) and Supply Chain Risk Management (SR) families, which did not exist in Rev 2
✓Control restructuring: some controls were split, merged, or renumbered. The total count changed from 110 to 83 primary requirements (plus 11 organization-defined parameter controls)
✓Stronger outcomes-based language: Rev 3 emphasizes security outcomes over checkbox compliance

When will DoD transition to Rev 3?

As of June 2026, DoD has not initiated rulemaking to transition CMMC from Rev 2 to Rev 3. A transition would require a new CMMC rulemaking cycle, which typically takes 12–24 months from proposal to final rule. Plan to achieve CMMC Level 2 compliance against Rev 2 controls for all near-term certifications.

Strategic advice

Implement Rev 3 supply chain risk management practices proactively if you have the capacity — they represent security best practices regardless of the regulatory timeline. But do not wait for Rev 3 to begin your Rev 2 compliance work.

Ready to start your CMMC journey?

Book a free 30-minute call with Rick to get a straight answer on where you stand and what to do next.

Book a Call with Rick Get a Gap Assessment