NIST 800-171 Rev 2 vs Rev 3: what are organization-defined parameters?

If your architecture, engineering, or construction firm holds CUI on defense work, your system security plan already sets dozens of values: how many failed logons lock an account, how long an idle screen stays open, how often staff repeat security training. In NIST 800-171 Rev 2 vs Rev 3, one of the most practical changes is who decides those values, and that change will reach every workstation in the office once DoD adopts Rev 3.

What is an organization-defined parameter?

An organization-defined parameter (ODP) is a blank inside a requirement that someone has to fill in with a specific value. In NIST SP 800-171 Rev 3, ODPs appear in brackets such as "[Assignment: organization-defined number]" or "[Selection (one or more): ...]". Once a value is set, NIST says, it becomes part of the requirement.

Requirement 03.01.08 is a good example. It requires the system to "enforce a limit of [Assignment: organization-defined number] consecutive invalid logon attempts by a user," and then to take a selected action when the limit is exceeded, such as locking the account or node for an organization-defined time period. The requirement is incomplete until those values are filled in, and an assessor tests against them.

Who fills in the values?

A federal agency can, and if it does not, the contractor must. NIST SP 800-171 Rev 3 states that NIST does not establish or assign values for ODPs. If an agency or group of agencies does not specify a value, nonfederal organizations must assign one to complete the requirement.

For defense contractors, the Department has already done this. Its CMMC FAQ (answer B-A4) says companies can implement Revision 3 but must use the Department's organization-defined parameters, defined in an April 2025 memorandum titled "Department of Defense Organization-Defined Parameters for National Institute of Standards and Technology Special Publication 800-171 Revision 3."

Did Rev 2 have organization-defined parameters?

Not in the requirement text. Rev 2 left the values out of the requirements and placed the decisions in the assessment objectives instead. Rev 2 requirement 3.1.8 says only "limit unsuccessful logon attempts," with no number.

The companion assessment guide, NIST SP 800-171A (June 2018), breaks 3.1.8 into determination statements. The first, 3.1.8[a], asks whether "the means of limiting unsuccessful logon attempts is defined." For session lock, 3.1.10[a] asks whether "the period of inactivity after which the system initiates a session lock is defined." In other words, Rev 2 asked the contractor to pick a value and document it, without saying what the value should be.

That is why two firms with identical tools could both pass 3.1.8 under Rev 2 with very different lockout settings. Each had defined its own value and enforced it.

What changes between NIST 800-171 Rev 2 and Rev 3?

The source of the value changes. Under Rev 2 as DoD assesses it today, the contractor picks the value and the assessor checks that it was defined and enforced. Under Rev 3 for DoD work, the Department supplies the values, and the contractor's configuration has to meet them.

Three practical shifts follow from that:

• Values move from the firm's judgment to a published DoD standard. A lockout threshold or session timeout that was defensible under Rev 2 may not match the DoD value under Rev 3.
• More requirements carry explicit frequencies and timeframes. Rev 3 requirement 03.02.01, for example, requires literacy training "as part of initial training for new users and [Assignment: organization-defined frequency] thereafter," and 03.03.04 requires alerting personnel to audit logging failures within an organization-defined time period.
• Some Rev 2 requirements are restructured. In Rev 3, 03.05.08 and 03.05.09 are withdrawn, and 03.05.10 is incorporated into 03.05.07, the password management requirement. Values that a firm documented against the old numbering need to be mapped to the new structure.

Which revision does DoD assess against today?

Revision 2. The CMMC rule at 32 CFR 170.2 incorporates Rev 2 by reference, and a May 2024 DoD class deviation holds DFARS 252.204-7012 to Rev 2. DoD's FAQ (answer B-A3) says the Department will incorporate Revision 3 through future rulemaking and will maintain Revision 2 as the assessment standard until then.

The same FAQ adds a condition for firms that move early: because assessments will be conducted against Revision 2 until the class deviation is rescinded, companies must ensure any gaps between Revision 2 and Revision 3 are addressed. In practice, a Rev 2 requirement that Rev 3 withdrew or folded elsewhere still has to be met. The July 2026 suspension of CMMC Phase 2 did not change that: Rev 2 self-assessments remain in force.

Why should a firm care about ODPs before Rev 3 is required?

Because ODP values drive configuration changes, and configuration changes take time to test across a whole office. A lockout or session timeout change touches every workstation and every user. Password and authenticator values can force resets and new enrollment. Scan and patch timeframes can require new tools or a different service arrangement with an IT provider.

Firms that compare their current settings to the DoD values now can phase those changes in on their own schedule. Firms that wait for the rule will be doing all of it at once, against a transition deadline set by someone else.

What should a defense contractor do this quarter?

Build a parameter register and compare it to the DoD memo. This is mostly a documentation exercise, and it makes the eventual Rev 3 move far smaller.

• List every Rev 2 requirement where your system security plan sets a value: lockout thresholds, session lock time, password rules, log retention, scan frequency, patch timeframes, training frequency, and review cycles.
• Record the value you use today and where it is enforced (Group Policy, Intune, Entra ID, the firewall, the vulnerability scanner).
• Pull the matching values from DoD's April 2025 ODP memorandum and mark each one as met, stricter, or looser than your current setting.
• For each looser setting, note the change required, who it affects, and when you plan to make it.
• Keep Rev 2 values in force and documented until DoD rescinds the class deviation, since Rev 2 is still the assessed standard and the basis of your SPRS score.

How does s90 help?

s90 maintains system security plans and parameter registers for architecture, engineering, and construction firms on defense work, and makes the configuration changes behind them across Windows, Microsoft 365, and network devices. We track the DoD rulemaking so your plan stays aligned with whichever revision is in force, and our agreements commit to producing assessment evidence within 24 hours of a request. If you would like to see how your current settings compare with the DoD values, we can walk through it with you.