How CMMC Contractors Can Prepare for NIST SP 800-171 Revision 3

Summary

NIST SP 800-171 Rev. 3 is not yet the CMMC Level 2 baseline. Contractors should maintain Rev. 2 readiness while mapping changes, including new requirement families, organization-defined parameters and updated assessment procedures.

Key points

• CMMC Level 2 currently uses the 110 requirements in NIST SP 800-171 Rev. 2; the article says Phase I self-assessment obligations and contractual duties to protect covered defense information remain in place.
• NIST published Rev. 3 in May 2024, replacing Rev. 2 as its current requirements for protecting controlled unclassified information in nonfederal systems.
• Rev. 3 adds planning, system and services acquisition, and supply-chain risk management families, and makes many requirements more specific.
• Rev. 3 introduces organization-defined parameters that require documented decisions and consistent implementation in policies, configurations and evidence.
• Updated assessment procedures in SP 800-171A Rev. 3 change what organizations should prepare to show assessors.
• The article recommends continuing Rev. 2 readiness while building a requirement-by-requirement crosswalk, assigning new stakeholders, reassessing CUI system scope and improving evidence collection.

Vendors

Industries