KIERI
Sign In
Schedule a Consultation

NIST SP 800-171 Revision 2 and Revision 3

NIST SP 800-171 is the foundational cybersecurity standard for defense contractors handling
Controlled Unclassified Information. CMMC Level 2 is currently mapped directly to Revision 2.
Revision 3 was published in May of 2024 and introduces a restructured framework with new
control families and Organization-Defined Parameters. Understanding the differences and
knowing what Revision 3 means for your assessment timeline, is now a planning requirement
for any organization working toward CMMC certification.

Request a Gap Analysis
View our Assessment Services
0

NIST SP 800-171 Rev 2 requirements

0

Control families in Rev 3

0

New families added in Rev 3

0 +

CMMC assessments completed by Kieri

Current status as of the CMMC Final Rule (effective December 16, 2024): CMMC Level 2 is formally aligned to NIST SP 800-171 Revision 2. Rev 2 contains 110 requirements across 14 control families and is the standard that assessors use today. Rev 3 has been published but has not yet been incorporated into the CMMC program. Organizations preparing for assessment should comply with Rev 2 now while planning for the transition to Rev 3 when it is formally adopted.

What You Need to Know at a Glance

Rev 2 governs your assessment today

CMMC Level 2 is built on Rev 2. Your System Security Plan, policies, procedures, and evidence must address the 110 requirements in Rev 2. An assessor evaluating your organization today will use Rev 2 assessment objectives. Being current with Rev 2 is the immediate priority.

Rev 3 is published but not yet in CMMC

NIST published Rev 3 as a final document in May 2024. It introduces structural changes, new control families, and Organization-Defined Parameters. CMMC has not yet formally adopted Rev 3. NIST and DoD will define the transition timeline and any CMMC-specific implementation guidance.

Start planning for Rev 3 now

The transition from Rev 2 to Rev 3 will require updates to your System Security Plan, policies, and documented control implementations. Organizations that have built a well-structured Rev 2 program will have a shorter path to Rev 3 compliance. Organizations building from scratch today should understand both.

Rev 2 and Rev 3 Side by Side

The table below summarizes the structural differences between the two revisions. These are framework-level changes. The specific control family changes are covered in the section that follows.

Area

Publication date

CMMC alignment

Total requirements

Control families

New families

ODPs

Alignment to 800-53

SSP impact

KCD coverage

Rev 2 (current CMMC standard)

February 2020

CMMC Level 2 current standard

110 requirements

14 families

None

None — requirements are prescriptive

Partial

110-requirement SSP structure

Full Rev 2 coverage included

Rev 3 (published May 2024)

May 2024

Not yet incorporated into CMMC

Restructured — requires ODP documentation

17 families — 3 new families added

Planning (PL), System and Services Acquisition (SA), Supply Chain Risk Management (SR)

Many requirements include Organization-Defined Parameters that organizations must set and document

Stronger alignment to NIST SP 800-53 Rev 5

SSP must document ODP values for each applicable requirement

Rev 3 updates in progress — included in KCD subscription

Control Family Changes from Rev 2 to Rev 3

Rev 3 expanded the framework from 14 to 17 control families. Three entirely new families address planning, supply chain risk, and system acquisition. Several existing families gained new requirements. The table below shows how each family maps across the two revisions.

Abbreviation

AC

AT

AU

CA

CM

IA

IR

MA

MP

PE

PL

PS

RA

SA

SC

SI

SR

Family name

Access Control

Awareness and Training

Audit and Accountability

Security Assessment

Configuration Management

Identification and Authentication

Incident Response

Maintenance

Media Protection

Physical Protection

Planning

Personnel Security

Risk Assessment

System and Services Acquisition

System and Communications Protection

System and Information Integrity

Supply Chain Risk Management

Status in Rev 3

Expanded

Unchanged

Expanded

Expanded

Expanded

Expanded

Expanded

Unchanged

Unchanged

Unchanged

New

Unchanged

Expanded

New

Expanded

Expanded

New

Key changes

New requirements added around privileged access and least privilege enforcement

Minor clarifications only

Additional audit event requirements and log management specifics

Expanded to include continuous monitoring requirements

New requirements around software inventory and change control

Additional MFA requirements and authenticator management controls

New requirements for incident response testing and reporting

Minor clarifications only

Minor clarifications only

Minor clarifications only

Entirely new family. Requires documented security plans and security plan reviews

Minor clarifications only

Expanded vulnerability management and risk response requirements

Entirely new family. Covers external service provider evaluation and supply chain security

New requirements for encrypted communications and network segmentation specifics

Additional malware protection and security alert requirements

Entirely new family. Addresses supply chain risk assessments and component authenticity

The three new families in Rev 3 (PL, SA, SR) do not have direct equivalents in Rev 2. Organizations with a strong Rev 2 program will likely have some controls that satisfy these requirements informally. Rev 3 formalizes them as explicit requirements that must be documented.

Organization-Defined Parameters

One of the most significant structural changes in Rev 3 is the introduction of Organization-Defined Parameters, referred to as ODPs. Where Rev 2 requirements are largely prescriptive, Rev 3 builds flexibility directly into many controls by allowing organizations to set specific values based on their environment and risk posture.

An ODP is a bracketed placeholder within a requirement that the organization must fill in with a specific value. That value then becomes part of your documented security program and must be consistently implemented and evidenced.

What an ODP looks like in practice

Rev 2 states account lockout requirements in fixed terms. The requirement either exists or it does not. Rev 3 structures the same control with an ODP that looks like this

Example ODP requirement
(IA family):

“Enforce a limit of [ODP: number of consecutive invalid logon attempts] consecutive invalid logon attempts by a user during a [ODP: time period] time period.”

The organization must document the specific values chosen and justify them against their risk assessment.

ODPs affect your compliance program in three concrete ways

  • Your SSP must document the specific ODP value chosen for each applicable requirement, not just confirm the control is implemented
  • Your implemented technical controls must match the documented ODP value exactly. If your SSP says five failed login attempts trigger a lockout, your systems must enforce exactly five
  • Assessors will verify ODP values against both your documentation and your actual system configuration. A mismatch is a finding, even if the implemented value is reasonable

How many ODPs are in Rev 3

Rev 3 contains ODPs across multiple control families, with concentration in Access Control, Identification and Authentication, and Configuration Management. The exact count depends on which requirements apply to your specific environment. Your System Security Plan must enumerate and justify each ODP value as part of the Rev 3 documentation structure.

ODP documentation is not optional and it is not a formality. Assessors treating Rev 3 requirements will check that ODP values are defined, justified in your risk assessment or SSP, and consistently implemented across all systems in scope. Organizations that treat ODPs as fill-in-the-blank exercises without implementation verification will fail those objectives.

The Three New Control Families in Rev 3

Planning, System and Services Acquisition, and Supply Chain Risk Management are entirely new to Rev 3. They do not map directly to any Rev 2 requirement. For most defense contractors, these will require net-new documentation and implemented processes, not just updates to existing ones.

PL  Planning

Rev 3 formalizes security planning as a distinct control family. Requirements under PL address the creation and maintenance of system security plans, rules of behavior for system users, and documented security architecture decisions. In practice, most organizations with a well-maintained SSP already satisfy the intent of these requirements informally. Rev 3 makes the planning activity an explicit, auditable requirement rather than an assumed precondition.

What you need: A formally structured SSP that documents security architecture decisions and is reviewed at defined intervals. Rules of behavior for all system users, documented and acknowledged. A defined process for updating the SSP when the system or its environment changes.

SA  System and Services Acquisition 

This family formalizes how organizations evaluate and manage external service providers, software vendors, and technology acquisitions. It addresses supply chain considerations at the acquisition stage rather than only during operation. Under SA, organizations must define criteria for evaluating vendor security before acquisition, not just document existing vendors in the SSP after the fact.

What you need: A documented vendor evaluation process that applies before new software or services are adopted. Security requirements included in contracts with external service providers. A process for reviewing and updating vendor assessments when provider security posture changes. This family has significant overlap with the CMMC Rule’s external service provider requirements, which are already in effect under Rev 2’s DFARS clause.

SR  Supply Chain Risk Management

Supply chain risk management addresses the security of hardware and software components before they enter your environment. Under SR, organizations must assess the risk of using components from potentially untrusted suppliers, implement counterfeit component detection, and maintain documentation of supply chain risk decisions. This family reflects DoD’s increasing concern about hardware and software supply chain integrity following incidents involving compromised components.

What you need: A supply chain risk assessment process covering hardware procurement and software acquisition. Documented procedures for verifying component authenticity. Incident response procedures specific to supply chain compromise scenarios. For most small defense contractors, this will be a new documentation requirement with minimal technical implementation overhead, but it requires deliberate attention.

The Transition Timeline

As of the CMMC Final Rule effective December 2024, CMMC Level 2 is aligned to NIST SP 800-171 Revision 2. Rev 3 has been published by NIST but has not yet been incorporated into the CMMC program through a formal rulemaking update.

The transition path from Rev 2 to Rev 3 in the CMMC context will require

  • A DoD rulemaking update that formally adopts Rev 3 as the CMMC Level 2 standard
  • CMMC Assessment Objectives for Rev 3 to be published by the Cyber-AB, which is the companion document that assessors use during formal assessments
  • A defined compliance transition period during which organizations can plan and implement Rev 3 changes

None of these steps have a firm published date as of the CMMC Final Rule. The DoD and NIST have signaled that Rev 3 adoption in CMMC is on the roadmap, but the mechanism and timeline remain to be formally defined.

Kieri monitors CMMC rulemaking and Cyber-AB publications and updates this page when transition dates are formally announced. Organizations should not delay Rev 2 compliance while waiting for Rev 3 transition guidance. Rev 2 certification provides contract eligibility now and creates the documented program that Rev 3 will build on.

What is already known about the transition

  • Organizations that achieve CMMC Level 2 certification under Rev 2 will not be required to immediately re-certify under Rev 3 when it is adopted. A grace period for existing certifications is expected, though the duration has not been formally defined
  • NIST intends for the transition from Rev 2 to Rev 3 to be a structured process, not an abrupt cutover
  • Assessors will not apply Rev 3 requirements in formal assessments until Rev 3 Assessment Objectives are formally published by the Cyber-AB

What to Do Now

The answer to Rev 3 is not to wait. Organizations that build a disciplined Rev 2 program today will transition to Rev 3 with significantly less effort than organizations that delay and attempt to address both revisions simultaneously.

If you are not yet Rev 2 compliant

Focus entirely on Rev 2. Achieve CMMC Level 2 certification. A Rev 2 certification protects you from the False Claims Act and creates the documented, implemented program that Rev 3 will require you to extend, not rebuild. When Rev 3 transition guidance is published, you will be updating an existing program rather than constructing one from scratch.

 

If you are Rev 2 compliant and certified

Begin a gap assessment against Rev 3 requirements. The most practical starting point is the three new control families: PL, SA, and SR. These have no Rev 2 equivalent, meaning your existing documentation will not address them at all. Review your existing requirements against the ODP structure and begin documenting the parameter values your organization will adopt.

 

If you are in the middle of Rev 2 implementation

Build your documentation with Rev 3 in mind where the additional effort is minimal. The Kieri Compliance Documentation supports both revisions. Your SSP structure and policy framework can be designed now to accommodate ODPs and the new families without requiring a full rebuild when Rev 3 is formally adopted.

 

Kieri’s assessors track Rev 3 developments actively. Our gap analysis service includes a Rev 3 readiness component that identifies where your current Rev 2 program will carry forward and where net-new work will be required.

How the Kieri Compliance Documentation Addresses Both Revisions

The KCD was built on Kieri’s own CMMC Level 2 program and has been structured to support both Rev 2 and Rev 3 as Rev 3 adoption in CMMC progresses. KCD subscribers receive updates as Rev 3 guidance is published.

KCD subscribers receive all Rev 3 updates at no additional cost as part of their active subscription. Organizations purchasing a KCD license today receive both the complete Rev 2 documentation package and Rev 3 updates as they are released. You do not need to purchase a separate product for the transition.

Current KCD coverage (Rev 2)

  • Pre-written policies and procedures for all 110 Rev 2 requirements
  • System Security Plan with specific implementation statements for each control
  • Maintenance checklists tied to weekly and monthly compliance tasks
  • Training library covering every Rev 2 control family
  • Evidence generation workflows that produce assessor-ready documentation as part of normal operations
  • Passed CMMC Level 2 assessment under Rev 2 by DCMA DIBCAC

KCD Rev 3 updates (in progress)

  • ODP documentation templates for each requirement containing an Organization-Defined Parameter
  • New policy and procedure sections for PL, SA, and SR control families
  • SSP structure updates to support ODP value documentation and justification
  • Rev 3 alignment mapping showing which existing Rev 2 policies satisfy Rev 3 requirements and where gaps exist
  • Updates released to all active KCD subscribers as Rev 3 CMMC Assessment Objectives are published

Frequently Asked Questions

No. CMMC Level 2 is currently aligned to Rev 2. Assessors conducting formal CMMC assessments evaluate organizations against Rev 2 requirements and Rev 2 Assessment Objectives. Rev 3 has been published by NIST but has not been incorporated into the CMMC program through formal rulemaking. Your immediate compliance obligation is Rev 2. Planning for Rev 3 is prudent, but compliance with Rev 3 is not yet a contractual requirement.

A grace period for existing certifications is expected when Rev 3 is formally adopted into CMMC, though the specific duration has not been published. Organizations that achieve certification under Rev 2 will not be required to immediately re-certify under Rev 3. The DoD and Cyber-AB will publish specific transition guidance when Rev 3 is formally incorporated. Kieri recommends pursuing Rev 2 certification now rather than waiting, because the grace period for certified organizations will be more favorable than the timeline for organizations that have not yet begun.

The number of ODPs applicable to your organization depends on your environment and which Rev 3 requirements apply to your systems. ODPs appear across multiple control families, with the highest concentration in Access Control, Identification and Authentication, Configuration Management, and Audit and Accountability. Your System Security Plan will need to document each ODP value, the rationale for that value, and how it is consistently implemented across all in-scope systems. A gap analysis against Rev 3 will identify the specific ODPs applicable to your environment.

Build for Rev 2 now and structure your documentation with Rev 3 in mind. Rev 2 certification gives you contract eligibility. Building a disciplined Rev 2 program creates the documented, implemented security posture that Rev 3 will require you to extend. The Kieri Compliance Documentation supports both revisions and is structured so that the Rev 3 additions layer onto the Rev 2 foundation rather than requiring a rebuild. Organizations that wait for Rev 3 before starting their compliance program will find themselves behind peers who have already achieved Rev 2 certification when contracts begin requiring it.

The most significant operational changes are in three areas. First, ODP documentation requires that your team define and justify specific parameter values rather than implementing a control at any reasonable level. Second, the three new families require net-new processes and documentation that most organizations do not have under Rev 2, particularly around supply chain risk management and formal security planning reviews. Third, the stronger alignment to NIST SP 800-53 means that organizations already familiar with 800-53 will find Rev 3 more intuitive, while organizations that have only worked with Rev 2 will need to familiarize themselves with the updated structure.

Yes. Kieri’s gap analysis service includes a Rev 3 readiness component that evaluates your current program against the Rev 3 framework, identifies which existing Rev 2 controls carry forward, highlights where ODP documentation will be required, and identifies the net-new work required for the three new control families. If you are preparing for Rev 2 certification now and want to understand the forward path to Rev 3, the gap analysis gives you both views in a single engagement.

Work with one of few organizations authorized to certify CMMC compliance.

Know Where Your Program Stands Against Both Revisions

Kieri’s certified assessors evaluate your compliance program against Rev 2 and identify your readiness for the Rev 3 transition. One engagement, two revision views, and a clear implementation roadmap.

Request a Gap Analysis
View Assessment Services

Kieri Solutions | Authorized C3PAO | Founded 2015 | Woodbine, Maryland