NIST SP 800-171 Rev. 3 and CMMC 2.0, explained

NIST SP 800-171 is the baseline NIST publishes for protecting Controlled Unclassified Information (CUI) on nonfederal systems, and CMMC (Cybersecurity Maturity Model Certification) 2.0 is the Department of Defense's contractual program for verifying that defense contractors actually meet it. They are frequently discussed together because CMMC does not define its own technical control set — its final rule text builds directly on SP 800-171 (plus a slice of SP 800-172 at the top tier) and adds an assessment-and-certification layer on top.

What SP 800-171 Rev. 3 actually requires

NIST's Revision 3, published May 2024, formally supersedes Revision 2 (February 2020, updated 28 January 2021). Its abstract states the publication "provides federal agencies with recommended security requirements for protecting the confidentiality of CUI when the information is resident in nonfederal systems and organizations," for use "in contractual vehicles or other agreements" between federal agencies and nonfederal organizations. The requirements are tailored down from the NIST SP 800-53B moderate control baseline.

Rev. 3 organizes its requirements into 17 families, per NIST's own Table 1:

Families

Access Control · Awareness and Training · Audit and Accountability · Configuration Management · Identification and Authentication · Incident Response · Maintenance · Media Protection · Personnel Security · Physical Protection · Risk Assessment · Security Assessment and Monitoring · System and Communications Protection · System and Information Integrity · Planning · System and Services Acquisition · Supply Chain Risk Management

Each requirement is identified with a code such as 03.01.01 (family 01 = Access Control, requirement 01) through 03.17.03 (family 17 = Supply Chain Risk Management, requirement 03). Counting those identifiers directly in NIST's published text gives 130 distinct requirements — up from 110 in Rev. 2's 14 families, reflecting three new families (Planning; System and Services Acquisition; Supply Chain Risk Management) that Rev. 2 did not have.

NIST's own Appendix E change log lists what changed from the 2020/2021 edition, including that it:

• "Eliminated the distinction between basic and derived security requirements" that structured Rev. 2;
• "Introduced organization-defined parameters (ODPs)" — assignment/selection values (e.g., an organization-defined time period or frequency) that an agency or the implementing organization must fill in to complete a requirement, documented in a new Appendix D;
• "Added new tailoring categories: Other Related Controls (ORC) and Not Applicable (N/A)" and revised the SP 800-53 tailoring tables (Appendix C) accordingly;
• Added, removed, retitled and regrouped individual requirements for clarity and to reduce redundancy with SP 800-53.

A companion assessment-procedures document, SP 800-171A Rev. 3, was published alongside it.

CMMC 2.0: the DoD program built on top

CMMC is the mechanism DoD uses to confirm that a defense contractor or subcontractor has actually implemented the required security measures for FCI and CUI, rather than relying on self-attestation alone. It was established as a final rule at 32 CFR Part 170 (Docket DoD-2023-OS-0063, RIN 0790-AL49), scheduled for Federal Register publication on 15 October 2024 as document 2024-22905 (89 FR 83092). The rule's own summary states its purpose is "to verify contractors have implemented required security measures necessary to safeguard Federal Contract Information (FCI) and Controlled Unclassified Information (CUI)."

The rule defines four CMMC statuses, summarized directly from its Table 1:

CMMC status	Source of requirements	Assessment
Level 1 (Self)	15 requirements required by FAR clause 52.204-21	Self-assessment by the Organization Seeking Assessment (OSA), annually; no POA&Ms permitted
Level 2 (Self)	110 NIST SP 800-171 R2 requirements required by DFARS clause 252.204-7012	Self-assessment every 3 years; POA&Ms permitted, must close within 180 days
Level 2 (C3PAO)	Same 110 NIST SP 800-171 R2 requirements	Independent assessment by an accredited CMMC Third-Party Assessment Organization (C3PAO) every 3 years
Level 3 (DIBCAC)	The Level 2 requirements plus 24 selected requirements from NIST SP 800-172 (Feb. 2021)	Government assessment by DoD's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC); requires a prior Final Level 2 (C3PAO) status

Level 1 applies to contractors handling only FCI; Levels 2 and 3 apply once a contractor processes, stores or transmits CUI. The rule's own text puts the practical weight of the program on Level 2: DoD estimated roughly 8,350 medium and large entities would need to meet the CMMC Level 2 C3PAO assessment requirement as a condition of contract award, ramping from 135 completed C3PAO assessments in year one to 4,452 by year four.

An OSA that cannot fully pass an assessment can still receive a Conditional status at 80% of the maximum score (with certain critical requirements still met), provided the remaining NOT MET requirements are logged in a Plan of Action and Milestones (POA&M) and closed out within 180 days via a follow-up POA&M closeout assessment — detailed directly in the rule text for each level.

The Rev. 2 / Rev. 3 gap that matters for compliance

This is the detail most worth getting right: CMMC's final rule ties its Level 2 and Level 3 requirements to NIST SP 800-171 Revision 2 by name, via DFARS clause 252.204-7012 — not the newer, reorganized 130-requirement Revision 3 that NIST itself now publishes. A contractor building a compliance program around the newest NIST text risks building against a baseline DoD contracts do not yet reference. Until DoD formally updates its DFARS clauses and CMMC's incorporated requirement set to point to Rev. 3, the 110-requirement/14-family Rev. 2 structure remains the one that actually counts for a CMMC assessment, even though Rev. 3 is NIST's current, non-withdrawn publication for every other purpose.

2026 status: Phase II suspended

As of this guide's research date, CMMC's rollout has changed from the phased plan the 2024 final rule describes. According to law-firm trackers of the program (Holland & Knight, WilmerHale) — DoD's own announcement pages returned access-blocked responses on every fetch attempt this run, so this detail is sourced to secondary reporting rather than the primary release itself, and should be re-verified against an official DoD/War Department source before being relied on for a compliance deadline: the Department of War announced on 13 July 2026 that it was suspending CMMC Phase II (the phase requiring formal third-party C3PAO certification of Level 2 status, originally due to begin 10 November 2026) and stood up a CMMC Reform Task Force to recommend a revised path forward. Reported coverage states that during the suspension, Phase I self-assessment requirements and the underlying DFARS 252.204-7012/7019 obligations to implement and self-report against NIST SP 800-171 Rev. 2 remain in force — only the mandatory third-party certification step is paused, not the contractual security obligations themselves.

What this means for a device or firmware maker

A manufacturer selling into the U.S. defense supply chain, or supplying a prime contractor who does, should treat SP 800-171 Rev. 2's 110 requirements (not the newer Rev. 3 text) as the current compliance target for any system handling CUI, while tracking whether the suspended CMMC Phase II C3PAO requirement returns on a revised timeline following the Reform Task Force's review. For a device maker without a US government contract, SP 800-171 and CMMC are still useful as a demonstrably rigorous, free, well-documented security baseline — see also our guides on NIST SP 800-53 security and privacy controls, the broader source baseline SP 800-171 tailors from, and NIST SP 800-161 C-SCRM for the supply-chain-risk angle that Rev. 3's new Supply Chain Risk Management family echoes.

SoftWSP's device and firmware security work can help map an embedded product's existing controls against SP 800-171 or CMMC Level 2 scope: see device firmware security.

This guide summarises public NIST and DoD/Department of War publications and third-party legal reporting on a fast-moving 2026 policy change; it does not constitute legal or compliance advice.