What does NIST 800-171 Rev 3 require for supply chain risk management?

Architecture, engineering and construction firms on defense work depend on a long list of outside parties: structural and MEP consultants, subcontractors, CAD and project management software vendors, cloud file platforms, hardware resellers and an IT provider. NIST 800-171 Rev 3 adds a supply chain risk management family that asks you to plan for the risks those suppliers bring to Controlled Unclassified Information (CUI). DoD does not assess it yet, but it is the part of Rev 3 that most AEC firms have the least written down.

What is the supply chain risk management family in NIST 800-171 Rev 3?

It is requirement family 03.17, and it has three requirements: a supply chain risk management plan, acquisition strategies that address supply chain risk, and a process for finding and fixing supply chain weaknesses. Revision 2 had no equivalent family.

NIST's Rev 3 FAQ says three new families were added in Revision 3: Planning, System and Services Acquisition, and Supply Chain Risk Management. NIST added them to keep SP 800-171 consistent with the moderate control baseline in SP 800-53B. For a contractor, that means supplier risk moves from an informal habit to a written, assessable requirement.

What does each of the three requirements ask for?

Each requirement is short, but each one produces evidence an assessor can ask to see. The wording below comes from NIST's assessment guide, SP 800-171A Rev 3, published May 14, 2024.

03.17.01: supply chain risk management plan

Requirement 03.17.01 has three parts. Part a asks you to develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations, maintenance and disposal of the system, system components or system services. Part b asks you to review and update the plan at an organization-defined frequency. Part c asks you to protect the plan from unauthorized disclosure.

Part c matters more than it looks. A plan that lists your suppliers, their access and your weak points is a useful map for an attacker, so it belongs in a restricted location with the rest of your security documentation.

03.17.02: acquisition strategies, tools and methods

Requirement 03.17.02 asks you to develop and implement acquisition strategies, contract tools and procurement methods to identify, protect against and mitigate supply chain risks. In practice, this is your purchasing process: how you vet a vendor before it touches CUI, and which security terms go into the contract or purchase order.

03.17.03: supply chain requirements and processes

Requirement 03.17.03 asks you to establish a process for identifying and addressing weaknesses or deficiencies in supply chain elements and processes. It also asks you to enforce organization-defined security requirements that protect against supply chain risks and limit the harm from supply chain events. Because that second part is an organization-defined parameter, you decide which requirements apply, write them down and show you enforce them.

Does DoD assess these requirements today?

No. DoD contracts and CMMC assessments still use Revision 2, which has no supply chain family. DFARS 252.204-7012 requires NIST SP 800-171, and DoD's Class Deviation 2024-O0013 holds that clause to Revision 2. The CMMC rule at 32 CFR 170.2 also incorporates Revision 2 by reference.

DoD has said it will move to Revision 3 through rulemaking. The Unified Agenda listed an interim final rule, RIN 0790-AM01, for July 2026. As of early November 2026, it has not been published in the Federal Register. CMMC Phase 2 has also been suspended since July 13, 2026. Our guides on when DoD will require Rev 3 and what still applies during the Phase 2 suspension cover both in more detail.

Why should an AEC firm work on supply chain risk before it is assessed?

Because the plan takes time to build, and much of it is already expected of you in other forms. Starting now spreads the work out and gives you evidence to point to when the rule changes.

Three pressures already exist. First, DFARS 252.204-7012 paragraph (m) requires you to include the clause in subcontracts that involve covered defense information, so you already have to know which subcontractors and consultants receive CUI. Our article on how primes check subcontractors covers that flow-down. Second, prime contractors' security questionnaires increasingly ask how you vet your own vendors. Third, if you use NIST CSF 2.0, its Govern function already includes a supply chain category, covered in our piece on what GV.SC asks of small firms.

None of this changes what your current contracts require. It means the Rev 3 work overlaps with obligations and questions you already face.

What belongs in a supply chain risk management plan for a design or construction firm?

A useful plan names the suppliers that can affect CUI, explains how you vet and contract with them, and says how you find and fix problems. NIST's deeper guidance is SP 800-161 Rev 1, updated November 1, 2024, and its supply chain quick-start guide, SP 1305, is a shorter starting point for small organizations. A plan sized for a 20 to 200 person AEC firm usually covers:

• Scope: the systems that store or process CUI, and the suppliers that touch them, including consultants, subcontractors, cloud and SaaS platforms, CAD and BIM software vendors, hardware resellers and your IT provider.
• Lifecycle: how risk is handled when you buy, receive, set up, run, maintain and retire technology, including how drives and devices are disposed of.
• Vetting criteria: what you check before a vendor gets CUI access, such as its security attestations, where it stores data and who on its side can reach your files.
• Contract terms: the security, incident notification and flow-down language you require in purchase orders, subcontracts and service agreements.
• Weakness handling: how a supplier problem gets logged, assigned an owner and tracked to closure.
• Review cycle: the frequency you chose for 03.17.01 part b, and who signs off on each review.
• Protection: where the plan lives and who can read it.

How do you start a NIST 800-171 supply chain risk management plan this quarter?

Start with an inventory and one written process, and add the rest as part of normal purchasing. These steps fit into a quarter without a separate project:

• List every outside party that receives or can reach CUI, and note what each one touches.
• Compare that list with your subcontracts and check that DFARS 252.204-7012 is flowed down where CUI is involved.
• Add a short security check to your purchasing approval for any tool or vendor that will handle project data.
• Choose and record your review frequency for the plan, the same way you record other organization-defined parameters.
• Create a log for supplier issues, such as an expired attestation or a vendor breach notice, and review it with your other open findings.
• Store the draft plan with your system security plan, with access limited to the people who maintain it.

If you are still building the rest of your documentation, our guide to writing a system security plan an assessor can follow and our explainer on Rev 3 organization-defined parameters are good companions to this work.

How does s90 help?

s90 works with AEC firms on defense projects to keep their NIST 800-171 Rev 2 posture current while preparing for Rev 3. We help inventory the vendors and tools that touch CUI, review the security terms in technology contracts, and keep supplier issues tracked alongside your other findings. If you want a second look at your supplier list before the rule changes, we are happy to walk through it with you.