In May 2024, NIST published Revision 3 of SP 800-171 — and immediately created the most common compliance question of the following two years: which version am I supposed to follow? The answer is unambiguous and worth stating up front: Revision 2 governs your DoD obligations in 2026. Here's why, what Rev 3 actually changed, and the strategy that follows.
Why Rev 2 Still Governs
DFARS 252.204-7012 invokes NIST 800-171, and when Rev 3 was finalized, DoD issued a class deviation explicitly directing contractors to keep complying with Revision 2 rather than letting the clause drift to the newest version. SPRS scoring runs on the DoD Assessment Methodology, which is built for Rev 2's 110 requirements. CMMC assessments are defined against Rev 2. Adopting Rev 3 for any of it requires formal rulemaking — proposed rules, comment periods, transition timelines — which has not happened and is expected to take years.
What Rev 3 Actually Changed
| Rev 2 (governs today) | Rev 3 (published 2024) | |
|---|---|---|
| Requirements | 110 | 97 (consolidated, not reduced in substance) |
| Families | 14 | 17 — adds Planning, System & Services Acquisition, Supply Chain Risk Management |
| Parameters | Fixed in the text | Organization-defined parameters (ODPs) — the agency sets values like timeout lengths |
| Alignment | Derived from 800-53 rev 4 | Tightly mapped to 800-53 rev 5 |
| DoD status | Required — DFARS, SPRS, CMMC | Not adopted; rulemaking pending |
The "97 vs 110" difference misleads people: Rev 3 mostly merged and reorganized requirements rather than deleting obligations, and the three new families add genuinely new territory (supply chain risk in particular). Net effort under Rev 3 is comparable or higher — another reason not to jump early.
What This Means for Your 2026 Decisions
- Assessing now? Use Rev 2's 110 requirements — here they are in plain English — and the current scoring methodology.
- Buying tools or templates? Confirm they're Rev 2-based and say so. Anything marketed as "Rev 3-ready" should mean "will update when rulemaking lands," not "assesses you against Rev 3 today."
- Writing policies? Cite "NIST SP 800-171 Revision 2" explicitly in your SSP and policies, so a future revision doesn't silently invalidate your references.
- Watching for the switch? The trigger is a DFARS rule change, and between the CMMC reform review and Rev 3 rulemaking, requirements churn is likely over the next few years — the durable investment is the underlying security work, which transfers across revisions almost entirely.
Assessed against the version that actually governs
CMMC Map assesses you against Rev 2 — the 110 requirements your contracts, SPRS score, and any future CMMC assessment are based on — and tracks rule changes so your documents don't go stale when the transition finally comes.
Start free →