NIST published SP 800-171 Revision 3 in May 2024, and it supersedes Revision 2 as NIST’s current version. NIST does not decide which revision you are held to, though. Your contract does. This page explains the differences in plain terms and how to plan the move without rebuilding work you have already done.
Revision 2, today. DoD tied DFARS 252.204-7012 to Revision 2 in May 2024 (Class Deviation 2024-O0013), and the CMMC program rule (32 CFR Part 170) scores Level 2, including the current Phase 1 self-assessment path, against Revision 2’s 110 requirements. Your SPRS score is calculated the same way.
Agency by agency, today. There is no single FAR clause for CUI yet. A proposed FAR rule (FAR Case 2026-001) would make Revision 3 the governmentwide baseline through a new clause, FAR 52.240-7. It is proposed, not final. See the FAR CUI rule below.
The agreement controls. A prime, an agency, or a commercial customer can write Revision 3 into a subcontract, agreement, or questionnaire. If yours has, that is the revision you are measured against for that work, whatever your DoD contracts say.
| Aspect | Revision 2 (2020) | Revision 3 (May 2024) |
|---|---|---|
| Requirements | 110 | 97, after many Revision 2 requirements were consolidated into others |
| Families | 14 | 17: adds Planning, System and Services Acquisition, and Supply Chain Risk Management |
| Source | Split into basic and derived requirements | Tailored directly from the SP 800-53 Revision 5 moderate baseline, in one format |
| Parameters | Most values left to the organization’s judgment, unstated | More than 80 organization-defined parameters, set by the agency or, if it does not, by you |
| Numbering | 3.1.1 through 3.14.7 | 03.01.01 through 03.17.03; withdrawn identifiers are kept and marked withdrawn |
| Assessment guide | SP 800-171A (2018) | SP 800-171A Revision 3 |
| Who requires it today | DoD: DFARS 252.204-7012 and CMMC Level 2 | Contracts and agreements that name it; proposed FAR rule for civilian agencies |
Revision 3 builds organization-defined parameters into the requirements: how often audit logs are reviewed, how many failed logons trigger a lockout, how often baselines are revisited. NIST sets none of them. If the agency on your contract does not specify a value, your organization must assign it, record it in the system security plan, and be assessed against it.
Planning: policy and procedures, the system security plan, rules of behavior. System and Services Acquisition: security engineering principles, unsupported system components, external system services. Supply Chain Risk Management: a supply chain risk management plan, acquisition strategies, and supply chain requirements and processes. For a small company, supply chain is usually the largest new piece of work.
The count drops from 110 to 97 because requirements were merged, not removed. A single Revision 3 requirement can carry what took two or three in Revision 2, and assessors check each part of it.
Every artifact keyed to Revision 2 numbers needs a map: the system security plan, POA&M, evidence index, policy cross-references, and any tool or GRC platform mappings. Keep the crosswalk, especially if you will answer to both revisions at once.
Because Revision 3 is tailored straight from the SP 800-53 Revision 5 moderate baseline, its language matches what agencies use for their own systems. That makes requirements easier to trace to source and harder to satisfy with a loose reading.
SP 800-171A Revision 3 rewrites the assessment procedures to match. If you self-assess, use the guide for the revision your contract names; mixing the two produces a score nobody can rely on.
A defined CUI boundary or enclave, a maintained system security plan, multifactor authentication, encryption of CUI, centralized logging, configuration baselines, incident response, and the habit of keeping evidence current all carry straight into Revision 3. The boundary matters most: the smaller the set of systems that touch CUI, the fewer places any revision change has to be made.
On June 23, 2026 the FAR Council published a revised CUI proposed rule (91 FR 37550, FAR Case 2026-001) as part of the Revolutionary FAR Overhaul. It replaces the January 2025 proposal. The comment period closed July 23, 2026. As of October 23, 2026 no final rule has been published.
Until a final rule is published and agencies put its clauses in your contract, it is not a requirement. Your solicitation and contract still control what applies to you.
Only if a contract or agreement requires it. For Department of Defense work, DoD tied DFARS 252.204-7012 to Revision 2 in May 2024 (Class Deviation 2024-O0013), and CMMC Level 2 is scored against Revision 2's 110 requirements. For civilian-agency work, requirements are set agency by agency today; a proposed FAR rule would make Revision 3 the governmentwide baseline once it is final and inserted into contracts. Read the clauses in each contract: they decide which revision you are measured against.
Fewer, but not lighter. Revision 3 has 97 requirements against Revision 2's 110, because many Revision 2 requirements were consolidated into others. It also adds three families (Planning, System and Services Acquisition, and Supply Chain Risk Management) and more than 80 organization-defined parameters that each need a documented value.
A value inside a requirement that someone has to set, such as how often a review happens or how long before a session locks. NIST does not set these values. If the agency on your contract does not specify one, your organization must assign it, record it, and then be assessed against it.
No. The CUI boundary, system security plan, access control, multifactor authentication, logging, configuration baselines, incident response, and evidence habits all carry forward. The work is remapping to the new numbering, setting parameter values, and filling the new planning, acquisition, and supply chain requirements.
Build one boundary and meet each contract on its own terms. Keep a crosswalk so a single control implementation is documented against both revisions, and do not let a Revision 3 project disturb anything your Revision 2 SPRS score or CMMC affirmation depends on. Where a contract is unclear, ask the contracting officer in writing.
No. As of October 23, 2026, FAR Case 2026-001 is a proposed rule. It was published June 23, 2026 (91 FR 37550) and its comment period closed July 23, 2026. Until a final rule is published and the clauses appear in your contract, it is not a contract requirement.
Send Cyberneza the clauses or questionnaire language you have received and a short description of where CUI is received, stored, and transmitted today. Do not paste contract attachments or anything marked CUI into the contact form; documents are exchanged over an agreed channel once the engagement is scoped. Cyberneza will tell you which revision each contract requires, what your current Revision 2 work already covers, and what a Revision 3 gap would add.
