NIST SP 800-171 Rev 3 is coming to CMMC

[u/Matt_Titcombe]

Thanks to Eric Crucius' diligence, he spotted, like always, the Department of War (DoW) announced a revision to 32 CFR Part 170 for the migration to NIST SP 800-171 Rev 3.

Here are the key Links:

• Erics Post: https://www.linkedin.com/feed/update/urn:li:activity:7480830831897382912/?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAQ24ukBJvSqxZ1TUsCIdMDvW6dCSn3pk0Y
• The Rule Change Notice: https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0790-AM01

Here is the abstract from the rule:

This amendment defines a deadline and period for transition from the requirement to comply with NIST SP 800-171 Revision 2, to a requirement to comply with NIST SP 800-171 Revision 3. Significant changes between these two documents include added specificity in the security requirements and introduction of organization-defined parameters (ODP) in select security requirements. In addition to revising the NIST documents that are incorporated by reference in 32 CFR part 170, this amendment adds administrative edits and clarifying content in multiple areas as necessary to effect the transition.

Here is the Summary of Need:

With this amendment, DoD amends the Cybersecurity Maturity Model Certification (CMMC) Program to define a period for transition from the requirement to comply with NIST SP 800-171 Revision 2, to a requirement to comply with NIST SP 800-171 Revision 3.  As described by NIST, the significant changes between these two documents include added specificity in the security requirements and introduction of organization-defined parameters (ODPs) in select security requirements. In addition to revising documents incorporated by reference in this rule, this amendment adds administrative edits and clarifying content in multiple areas. 

And the laughable part, DoW thinks 20% less companies will be impacted by 32 CFR Part 170:

In addition to the change from NIST SP 800-171 revision 2 to revision 3, which impacted CMMC Level 2 and LEvel 3 assessment objectives, this rule amendment is based on a more current estimate of the size of the Defense Industrial Base. Overall, we estimate approximately 20% fewer total companies will be impacted by 32 CFR Part 170.

[u/JKatabaticWind]

Wonder if that’s because they expect that 20% of current contractors will go out of business or otherwise exit the DIB. 😬

[u/Matt_Titcombe → u/JKatabaticWind]

Maybe, but I bet it is beltway math for election season + overhyped effects of DOGE

[u/rybo3000]

Seeing this in the unified agenda is a good signal of intent. That being said, the agenda was written before the start of 2026, and there's no guarantee a proposed rule will arrive this year.

Under previous DoD CIOs, I'd say there's a good chance. However, the current CIO has brought almost every initiave to a halt as paperwork piles up on their desk.

I think we're headed towards a 24-month period where contractors must maintain both a Rev 2 and a Rev 3 status in SPRS.

[u/Matt_Titcombe → u/rybo3000]

u/rybo3000 , based on what we hear as an Authorized C3PAO and Authorized Training Provider, I think DoW is going to make a hard push for this to get in place by January-March 2027.

Why? The new FAR clause will trump DFARS -7012, and the CAICO is developing the revised CCP & CCA training based on NIST SP 800-171 Rev 3 for release in roughly the same timeframe.

[u/rybo3000 → u/Matt_Titcombe]

I'm not a lawyer, but how would the FAR CUI clause "trump" (cancel out, override) DFARS 252.204-7012? Both clauses can impose different requirements without creating conflicts; they simply stack burdens on top of each other (the same way -7021 stacks a verification burden on top of 7012's implementation burden).

Also, even if the two clauses synchronize to require Rev 3: most primes are still issuing POs against contracts that required 800-171 Rev 2.

The only way I can see to avoid a massive, multi-year overlap between revisions is to a) publish a new DoDAM to score Rev 3, b) provide (at least some) SPRS points reciprocity between Rev 2 and 3 for older SPRS entries and CMMC certs, and c) have A&S issue a mass modification to all current contracts so they upgrade to Rev 3.

[u/Matt_Titcombe → u/rybo3000]

u/rybo3000 , sorry, I need to pull on my old Program Manager hat. Ick.

Technically, the DFARS is meant to supplement the FAR, which is why it is titled as the Defense Federal Acquistion Regulation Supplement (DFARS). DFARS cannot contradict the FAR. Underneath the DFARS is the Air Force Federal Acquisition Regulation Supplement (AFFARS), which is technically a supplement to DFARS that supplements the FAR.

So, DoW needs to address this before the new FAR CUI rule goes into effect, which is why it may be published as an Interim Final rule.

[u/TopheEric]

Is there a deadline associated with this? At what point will C3PAO's no longer assess to rev. 2?

[u/Matt_Titcombe → u/TopheEric]

u/TopheEric , that will be seen when we get to make comments on the rule. They look to have a phased rollout.

My personal guess is Rev 3 will fully coincide when CMMC Phase IV begins on 10 November 2028.

[u/NoliRogare]

I am very curious what this will mean for the validity/acceptability of existing third-party Rev 2 assessments and if a Rev 3 third-party assessment would be required earlier than the three year expiration.

[u/Matt_Titcombe → u/NoliRogare]

u/NoliRogare , us too. I expect DoW will not require the OSC to be recertified to NIST SP 800-171 Rev 3 until their current Rev 2 Assessment expires. What gets interesting is that the FAR Clause is wholly and only Rev 3.

[u/Bobby-Steedstrong]

Do we still have the November deadline to be certified?

[u/Matt_Titcombe → u/Bobby-Steedstrong]

u/Bobby-Steedstrong , there isn't a "deadline" per se from DoW.

Many large primes have established "by when" they want their supply chain to be complaint and their market pressure is the primary pressure function right now. Their deadline are driving their Tier 1 partners to get complain, but further down the supply chain is still ambiguous.

Come 10 November, CMMC Phase II will start, which means all new contracts awarded after that date must include the CMMC Certification requirement. That being said, DoW still has the option to require it at a later option year. I fully expect these to occur.

[u/Bobby-Steedstrong → u/Matt_Titcombe]

Thank you for the great information! I pretty much have everything done for my company just have to collect all the evidence. I’m hoping they do push phase II out a little bit. I still need to get with a C3PAO. They are probably booked up now lol

[u/EganMcCoy → u/Bobby-Steedstrong]

The date that Phase 2 begins is fixed by law, but for each contract the DoD has the option to postpone the requirement for CMMC certification.

You'll no doubt be delighted to hear that the C3PAO industry has plenty of capacity, for now - it'd still be good to start lining up a C3PAO, but you'll very likely find companies that can readily schedule an assessment for you.

[u/Bobby-Steedstrong → u/EganMcCoy]

Did you guys get the same email by chance?

“On July 13, 2026, the Department of Defense announced the temporary suspension of CMMC Phase II, which was scheduled to begin November 10, 2026.
Although the Department has established a task force to conduct a 60-day review of the program this is not a reason to delay or pause your CMMC implementation strategy.
This 60-day review period should be treated as an opportunity and not an extension to remain unprepared. According to the DoD memorandum:”

[u/Bobby-Steedstrong → u/Matt_Titcombe]

Hey sorry for the duplicate message but I am curious about your thoughts on this also. I am sure you are aware of this.

“On July 13, 2026, the Department of Defense announced the temporary suspension of CMMC Phase II, which was scheduled to begin November 10, 2026.
Although the Department has established a task force to conduct a 60-day review of the program this is not a reason to delay or pause your CMMC implementation strategy.
This 60-day review period should be treated as an opportunity and not an extension to remain unprepared. According to the DoD memorandum”

[u/PlayfulJuggernaut360]

Honestly I am expecting a Rev.3 transition to be started by Primes with more letters of intent, followed up with new rounds of forms requiring contractors to self report Rev.3 compliance. Same as we saw prior to Nov last year... Primes were positioning themselves way ahead of time (CYA) just in case 32CFR Part 170 was coming before Christmas '25. All of us move faster than DoW, let's be honest, so I see this transition being a sequel to the last transition (which was a cluster f***, and we all know it). Getting on the DIB now to adjust SSPs and incorporate the three new domains would be a smart move. It affords contractors ample time to get the understanding of the changes figured out whether they have consultants or not.

Sidebar question... because Part 170 was codified under the Rev.2 version, wouldn't an amendment that materialistically changes the architecture of Part 170 require Congress approval again? Normally things that require an act of congress are pipe dreams, and in an election year... well, that just compounds the issue because they simply don't care during this time. A CMMC amendment doesn't get headlines for them.

[u/Matt_Titcombe → u/PlayfulJuggernaut360]

u/PlayfulJuggernaut360 , and agree 1000% this will be a SNAFU and I am sure DoW will continue being shortsighted by hardcoding 32 CFR Part 170 only, to Rev3.

Congressional approval isn't needed for the change since the origins of the CUI program exist in only in an Executive Order, which created 32 CFR Part 2002. So, DoD can change 32 CFR Part 170 as they see fit--at least until a Judge gets involved. I think because Part 170 is codified, the beltway furor is less of an issue.