NIST SP 800-171 Rev 2 vs Rev 3: Which Revision DoD Requires Now

Does DoD require Rev 2 or Rev 3 now?

For CMMC Level 2, the program incorporates Revision 2. A contract adopting a different safeguarding baseline would not, by itself, rewrite the CMMC assessment requirement.

For DFARS safeguarding, read the applicable deviation as well as the codified clause. Class Deviation 2026-O0025 Revision 3, in its 252.204-7012(b)(2)(i) text, expressly names Revision 2. The codified clause page instead uses the version in effect when the solicitation was issued, or another version authorized by the contracting officer. Quoting that older wording alone misses the deviation.

The practical check is the instrument actually incorporated into the procurement. Record its edition and any amendment rather than assuming the newest NIST publication controls.

“The security requirements apply to components of nonfederal systems that process, store, or transmit CUI, or that provide protection for such components.” NIST SP 800-171 Rev 3

What changed between Rev 2 and Rev 3?

The count change does not mean 13 protections disappeared. Rev 3 consolidates and restructures requirements. A crosswalk needs to trace the operating practice and evidence, not merely match control names.

Why is Rev 2 still used after NIST published Rev 3?

NIST’s publication lifecycle and a contract requirement are separate. NIST lists Rev 3 as the current publication and describes it as superseding Rev 2. CMMC Level 2 and the deviation cited here use the Rev 2 baseline described above. As of September 30, 2026, the DoW CIO program page still identifies Revision 2 for Level 2 and describes the Phase II suspension. An assessment scheduling change should not be treated as evidence that a different safeguarding revision was adopted.

How should a contractor prepare without getting ahead of the contract?

1. Identify the precise clause, solicitation date, system scope, and contractual version.
2. Maintain the Rev 2 SSP, evidence, and assessment record required for that scope.
3. Build a separate Rev 3 crosswalk for internal planning. Mark every mapping as planning until a contract or agency direction makes it operative.
4. Capture organization-defined parameter choices as decisions with an owner and source. Do not silently substitute a preferred value for a DoD value.
5. Recheck the rulemaking and the contract before representing the work to a prime, customer, or assessor.

Explain the baseline to a prime or assessor

State the version and scope plainly: “Our current contract requirement is Rev 2. Our Rev 3 crosswalk is a planning record.” That gives a reviewer something testable. Read the DFARS 252.204-7012 guide, SSP guide, and CMMC overview. Deep Fathom can retain the requirement, work, decisions, and evidence. A contracting officer and assessor determine what the contract requires and whether the evidence is sufficient.

Don’t use a newer publication date to override incorporated contract text. Don’t call a planning crosswalk an adopted baseline. The CMMC assessment timeline keeps the related scheduling question separate.