When will DoD require NIST 800-171 Rev 3? Plan for both revisions

If your firm designs or builds for DoD and handles controlled unclassified information, you may have read that NIST 800-171 Rev 3 replaced Rev 2 in 2024. For your DoD contracts, it has not yet. Your SPRS score, your CMMC assessment and the affirmation your senior official signs all still measure Revision 2, and the rule that sets the switch date has not been published. Here is what the primary sources say about timing, and how to run one program that works for both revisions.

Has DoD adopted NIST 800-171 Rev 3?

No. NIST published Revision 3 on May 14, 2024, and NIST lists it as superseding Revision 2. DoD moved first to keep its contractors on the older version. In May 2024 it issued Class Deviation 2024-O0013, an alternative DFARS 252.204-7012 clause that requires contractors to comply with Revision 2 rather than whatever version is current when a solicitation is issued. DoD said the goal was to give industry time for a more deliberate transition.

The CMMC Program rule locks in the same version. 32 CFR 170.2 incorporates by reference NIST SP 800-171 Revision 2 (February 2020, with updates as of January 28, 2021) and NIST SP 800-171A from June 2018. As long as that text stands, CMMC Level 2 self-assessments and certification assessments measure Revision 2, and so does the SPRS score you report under DFARS 252.204-7019 and 7020.

What has DoD said about timing?

Only that it will happen through rulemaking. In its CMMC FAQs, the Department says it "will incorporate Revision 3 with future rulemaking" and will keep Revision 2 as the assessment standard until Revision 3 has been incorporated into the 32 CFR CMMC Program rule.

The regulatory agenda gives the clearest signal. RIN 0790-AM01 describes an amendment to the CMMC rule that "defines a deadline and period for transition" from Revision 2 to Revision 3, citing added specificity in the requirements and the introduction of organization-defined parameters. The agenda listed it as an interim final rule for July 2026. As of mid-October 2026, it had not been published in the Federal Register.

The program around it is also in motion. On July 13, 2026, the Department of War suspended CMMC Phase 2, pausing third-party Level 2 certification as a condition of award. When the transition rule does appear, the agenda language suggests it will include a transition period, which means contractors should expect some notice before Revision 3 becomes the measuring stick. How long that period will be is not public. Our Phase 2 suspension briefing covers what still applies in the meantime.

Is Revision 3 showing up anywhere else?

Yes, on the civilian side, in proposed form. On June 23, 2026, the FAR Council published FAR Case 2026-001 (91 FR 37550) as part of the FAR overhaul. It would set government-wide CUI safeguarding terms, includes a standard form updated "to identify the applicable organizational defined parameters for NIST 800-171 Revision 3," and would standardize CUI incident reporting at 72 hours from discovery. Comments closed July 23, 2026. It is still a proposal, and it does not change what DFARS 252.204-7012 requires today.

For AEC firms that hold both DoD work and civilian agency contracts, such as GSA or VA projects, this matters. You could face Revision 3 on a civilian contract before DoD makes the switch.

What are the key differences between NIST 800-171 Rev 2 and Rev 3?

The structure, the detail and who sets the numbers. Revision 2 has 110 requirements in 14 families. Revision 3 consolidates them into 97 requirements across 17 families, adding families such as Planning, System and Services Acquisition, and Supply Chain Risk Management. Many requirements are more specific, and some now contain organization-defined parameters: blanks such as how often to review logs or how many failed logons to allow before lockout.

Those parameters are the practical crux. A requirement with an open parameter cannot be assessed until someone fills it in. DoD has already done that for its contractors: it published its own organization-defined parameter values for Revision 3 in April 2025. Your policies and configurations will eventually be checked against those values, which may differ from the values a firm chose for itself under Revision 2.

Can you implement Revision 3 now?

Yes, with two conditions. DoD's FAQ says companies "can implement Revision 3 but must use the Department's Organization-Defined Parameters," and that assessments will still be conducted against Revision 2, so any gaps between the two revisions must be addressed. In other words, moving early is allowed, but you cannot drop a Revision 2 requirement because Revision 3 merged or reworded it. Your SPRS score and any CMMC assessment still measure Revision 2.

What does a two-revision roadmap look like?

One control set, documented two ways. The goal is to stay fully compliant with Revision 2 today while making every new decision in a way Revision 3 will accept later:

• Keep the system security plan, POA&M and SPRS score anchored to the 110 Revision 2 requirements. That is what you are assessed and what you affirm. If your score has gaps, start with the gaps worth closing first during the CMMC pause.
• Add a crosswalk column to the plan that maps each Revision 2 requirement to its Revision 3 counterpart and flags requirements that are new in Revision 3.
• When you change a setting or write a policy, use DoD's organization-defined parameter value if it also satisfies Revision 2. That way the work does not have to be redone later.
• Budget for the new families, especially supply chain risk management, which asks for documented processes around the vendors and products in your environment.
• Track civilian contracts separately, since a final FAR CUI rule could bring Revision 3 to them first.
• Watch the Federal Register for RIN 0790-AM01. The transition period it sets becomes your deadline.

What should you do this quarter?

• Confirm your SPRS score is current and based on Revision 2, and that your affirming official knows Revision 2 is still the standard. Our guide to keeping your SPRS score and affirmation current walks through the check.
• Download DoD's organization-defined parameter values and compare them with your current policies and configurations.
• Build the Revision 2 to Revision 3 crosswalk into your system security plan and list the requirements that are new to you.
• Identify any civilian agency contracts that involve CUI and note which FAR clauses they carry.
• Put Revision 3 gap work into next year's budget so the transition rule does not arrive as an unfunded project.

How does s90 help?

s90 maintains NIST SP 800-171 programs for AEC firms on defense work, keeping the Revision 2 score accurate while building the Revision 3 crosswalk and parameter settings into the same system security plan. When the transition rule is published, we will tell you what it changes for your environment. If you want a read on how far your current controls are from Revision 3, we are glad to take a look.