NIST published SP 800-171 Revision 3 in May 2024 and withdrew Revision 2 on May 14, 2024. CMMC Level 2 is still written against Rev 2 in 32 CFR 170.14(c)(3), as of the eCFR update of October 29, 2026. Counting the Chapter 3 entries not marked "Withdrawn", Rev 3 has 97 requirements in 17 families. Rev 2 has 110, the number 32 CFR 170.4 uses for CMMC Level 2.
What is the difference between NIST 800-171 Rev 2 and Rev 3?
Both revisions tell a nonfederal organization how to protect the confidentiality of Controlled Unclassified Information (CUI). They differ in status, size and structure.
| Rev 2 | Rev 3 | |
|---|---|---|
| Published | February 2020, with updates as of January 28, 2021 (NIST) | May 2024; final version dated May 14, 2024 (NIST) |
| NIST status | Withdrawn May 14, 2024; superseded by Rev 3 | Current. Supersedes Rev 2 |
| Requirements | 110 (the number 32 CFR 170.4 uses for CMMC Level 2) | 97 in Chapter 3, not counting entries marked "Withdrawn" |
| Families | Not covered here | 17 |
| Organization-defined parameters | Not covered here | Included in certain requirements |
| Used by CMMC Level 2 today | Yes (32 CFR 170.14(c)(3)) | No |
The Rev 3 figure of 97 comes from counting the requirement entries in Chapter 3 of the published text that are not marked "Withdrawn". The Rev 3 text keeps the withdrawn ones as numbered entries, each with a short note such as "Incorporated into 03.01.12" or "Recategorized as NCO."
Is Rev 2 still a valid publication?
NIST's page for Rev 2 reads "Withdrawn on May 14, 2024" and "Superseded by SP 800-171 Rev. 3" (NIST CSRC). That is NIST's status for the document. It doesn't decide which revision a contract or the CMMC program uses. The rule or the clause sets that, and the next two sections cover both.
Which revision does CMMC Level 2 use today?
Rev 2. The CMMC rule says "The security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2" (32 CFR 170.14(c)(3)). Section 170.4 refers to "the 110 Level 2 requirements from NIST SP 800-171 R2", and the incorporation-by-reference entry in 32 CFR 170.2 names "Revision 2, February 2020 (includes updates as of January 28, 2021)".
The eCFR showed Title 32 as current through October 29, 2026, last amended August 17, 2026. NIST SP 800-171 Rev 3 does not appear in these sections. Check eCFR again before you rely on this, because a rule change would show up there first.
Which revision does DFARS 252.204-7012 require?
The standard clause text does not name a revision. It says contractors must meet the requirements in NIST SP 800-171 "in effect at the time the solicitation is issued or as authorized by the Contracting Officer" (DFARS 252.204-7012, MAY 2024). DoD has also pointed this clause at Rev 2. Class Deviation 2024-O0013, Revision 1 has contracting officers use an alternate clause that requires NIST SP 800-171 Revision 2 instead of the version in effect when the solicitation is issued. Class Deviation 2026-O0025, Revision 3, signed September 3, 2026, describes a July 13, 2026 Department of War CIO memorandum that "Requires baseline compliance with NIST SP 800-171 Rev 2 in accordance with the clause at DFARS 252.204-7012."
So the answer for a given contract is in that contract and any deviation it cites. Read the clauses in your solicitation and ask your contracting officer if the revision is not clear.
What are organization-defined parameters?
Rev 3 states that "Organization-defined parameters (ODPs) are included in certain security requirements" (Section 2.2). In plain words, an ODP is a value a requirement leaves open, such as a time period or a frequency, for the organization or its contract to set. Appendix D of Rev 3 lists the ODPs. If you're working toward CMMC Level 2, this doesn't matter yet, because the rule points to Rev 2.
How did NIST build the Rev 3 requirements?
Section 2.2 of Rev 3 says it starts from the SP 800-53 controls in the SP 800-53B moderate baseline and tailors them. NIST removes controls that are primarily a federal responsibility, not directly related to protecting CUI confidentiality, adequately covered by other controls, or not applicable. Three SP 800-53 families are left out on that basis:
| Family left out | NIST's stated reason |
|---|---|
| PII Processing and Transparency (PT) | PII is a CUI category |
| Program Management (PM) | Not tied to any control baseline |
| Contingency Planning (CP) | It addresses availability |
Rev 3's 17 families are Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment and Monitoring, System and Communications Protection, System and Information Integrity, Planning, System and Services Acquisition, and Supply Chain Risk Management.
What should a contractor do now?
- Read your contract for the clauses that set the revision (DFARS 252.204-7012 and any CMMC clause).
- If CMMC Level 2 applies, the CMMC rule assesses against Rev 2's 110 requirements (32 CFR 170.14(c)(3)).
- Read Rev 3 so you know the direction. NIST published a small business primer in August 2025 that gives a high-level overview of Rev 3.
- Keep your system security plan and evidence organized by requirement, so you can map them to another revision if your contract changes.
- Recheck eCFR and your contract language each time you renew or bid.
Frequently asked questions
Do I have to move to Rev 3 now?
Not because NIST withdrew Rev 2. For CMMC Level 2, the rule names Rev 2 (32 CFR 170.14(c)(3)). For other contracts, follow the revision your contract and clauses name.
How many requirements does Rev 3 have?
Counting the entries in Chapter 3 that are not marked "Withdrawn" gives 97, in 17 families. Rev 2 has 110, the number 32 CFR 170.4 uses for CMMC Level 2.
Was Rev 2 withdrawn?
Yes. NIST's page says "Withdrawn on May 14, 2024" and "Superseded by SP 800-171 Rev. 3". CMMC Level 2 still cites Rev 2 in the eCFR text checked on October 29, 2026.
Does Rev 3 use organization-defined parameters?
Yes, in certain requirements (Rev 3, Section 2.2). Appendix D of the publication lists them.
Is NIST in charge of CMMC?
No. NIST's FAQ says it "is not involved in the design, development, or implementation of the CMMC model, accreditation body, or certification" (NIST CSRC FAQs).
Next step
ComplianceONE lists NIST SP 800-171 Rev 2 and Rev 3 as separate frameworks, so you can work in the one your contract calls for. Each control has a "Same requirement in your other frameworks" view. Between Rev 2 and Rev 3 it shows an equivalent where NIST renumbered a requirement or moved it into one other requirement, and a related control where it was split; a new or withdrawn requirement shows the reason instead. Nothing is copied until you click Import, Apply or Copy.
Book a demo and we will walk you through it.
This post explains public rules and is not legal advice. Check your contract for the revision and CMMC level it requires. Completing a checklist or reading a standard does not by itself make a system compliant, and ComplianceONE does not certify or assess you.