NIST 800-171 Rev 3: Requirements & Changes

For research universities, defense contractors, and laboratories handling Controlled Unclassified Information (CUI), NIST SP 800-171 Revision 3 is a major modernization of federal cybersecurity safeguarding standards. Published by the National Institute of Standards and Technology (NIST) under the title Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, Revision 3 aligns nonfederal security requirements with the modern federal baseline in NIST SP 800-53 Rev. 5. This operational guide details the revised control architecture, organization-defined parameters, the regulatory landscape under DoD Class Deviation 2024-O0013, and compliance pathways as described on the official NIST CSRC page on November 11, 2026.

What it is and who runs it

NIST SP 800-171 is maintained and published by NIST, an agency within the U.S. Department of Commerce, via its Computer Security Resource Center (CSRC). Authorized under the Federal Information Security Modernization Act (FISMA) and Executive Order 13556, it supports the government-wide CUI program overseen by the National Archives and Records Administration (NARA) under 32 CFR Part 2002.

NIST released NIST SP 800-171 Revision 3 on May 14, 2024, alongside its companion assessment guide, NIST SP 800-171A Revision 3. The standard was authored by Ron Ross, Victoria Pillitteri, Kelley Dempsey, Mark Riddle, and Gary Guissanie. Revision 3 is engineered specifically to protect CUI confidentiality on nonfederal systems, including university research clusters and contractor enterprise networks.

Eligibility

Compliance applicability for NIST SP 800-171 Rev 3 is established by federal statute, prime contract clauses, and grant terms rather than voluntary registration. Under 32 CFR Part 2002.14, any nonfederal entity processing, storing, or transmitting CUI under a federal award must implement NIST SP 800-171 standards.

Key categories of organizations subject to these mandates include:

Defense Contractors and Subcontractors: Entities subject to DFARS clause 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting).
Research Universities: Academic labs and supercomputing facilities conducting sponsored defense research or federal programs involving CUI, as examined in our guide to NIST SP 800-171 and CUI in university research.
Civilian Federal Contractors: Vendors serving civilian agencies such as NASA, DOE, DHS, and HHS under FAR CUI contract requirements.
Commercial Cloud and Service Providers: Managed service providers (MSPs) hosting systems that process or store covered federal data.

What it funds or requires

NIST SP 800-171 Rev 3 does not distribute financial grants; rather, it prescribes binding technical, physical, and administrative security requirements. In total, Revision 3 specifies 97 security requirements organized across 17 security requirement families, shifting from the 110 requirements and 14 families in Revision 2.

The 17 Security Requirement Families

Revision 3 restructures the requirement catalog to mirror the families of NIST SP 800-53 Rev. 5:

Access Control (AC): Limits system access to authorized users and processes.
Awareness and Training (AT): Ensures personnel are trained on security risks.
Audit and Accountability (AU): Retains and analyzes audit records to track unauthorized activity.
Assessment, Authorization, and Monitoring (CA): Requires continuous monitoring and authorizations.
Configuration Management (CM): Enforces baseline configurations and change tracking.
Identification and Authentication (IA): Requires multi-factor authentication (MFA) and user verification.
Incident Response (IR): Enforces incident detection, handling, and reporting.
Maintenance (MA): Regulates routine and remote system maintenance.
Media Protection (MP): Protects media through sanitization.
Physical and Environmental Protection (PE): Restricts physical facility access.
Planning (PL): Newly elevated family; mandates formal security planning.
Personnel Security (PS): Governs background checks and employee screening.
Risk Assessment (RA): Identifies and documents technical vulnerabilities.
System and Services Acquisition (SA): Newly elevated family; governs security in outsourced systems.
System and Communications Protection (SC): Controls network boundaries and cryptographic protection.
System and Information Integrity (SI): Monitors and remediates malicious code.
Supply Chain Risk Management (SR): Newly elevated family; manages supplier and component risks.

Organization-Defined Parameters (ODPs) and NFO Elimination

Revision 3 introduces two foundational structural changes:

88 Organization-Defined Parameters (ODPs): Rather than hardcoding static limits, Revision 3 incorporates 88 configurable parameters. Agencies or organizations assign numerical values based on risk (e.g., maximum failed login attempts or audit log review intervals).
Elimination of Non-Federal Organization (NFO) Tailoring: In Revision 2, NIST assumed organizations maintained basic IT policies under unassessed “NFO controls.” Revision 3 integrates these controls directly into the catalog.

Application or compliance steps

Achieving compliance with NIST SP 800-171 Rev 3 involves five operational steps:

Boundary Scoping: Isolate systems processing CUI into segmented enclaves or dedicated virtual private clouds to minimize compliance scope.
System Security Plan (SSP) Update: Document how the 97 requirements are met and define institutional values for all 88 Organization-Defined Parameters (ODPs).
Gap Remediation and POA&M: Address technical deficiencies and document remaining gaps in a Plan of Action and Milestones with clear resolution timelines.
Assessment via SP 800-171A Rev 3: Evaluate controls against the 422 determination statements using examine, interview, and test methods.
Governance Integration: Coordinate oversight with the designated research security officer and compliance directors.

Typical timeline phases

Compliance implementation progresses through five distinct operational phases:

Phase 1: Enclave Scoping and Data Discovery: Identify all awards, contracts, and data flows carrying CUI obligations. Inventory all systems within the boundary.
Phase 2: Gap Analysis and Parameter Definition: Compare existing NIST SP 800-171 controls against the 97 Rev 3 requirements. Define values for the 88 ODPs and assess readiness for the Supply Chain (SR) family.
Phase 3: Control Implementation and Remediation: Deploy technical configurations, enforce multi-factor authentication, and update procurement policies for vendor risk management.
Phase 4: Assessment and POA&M Finalization: Conduct assessments using SP 800-171A Rev 3 procedures and finalize the POA&M.
Phase 5: Continuous Monitoring and Federal Alignment: Execute ongoing audit log reviews and access re-evaluations while tracking federal acquisition rule updates.

Common mistakes

Organizations implementing Revision 3 should avoid several critical pitfalls:

Overlooking DoD Class Deviation 2024-O0013: Assuming defense contracts immediately enforce Revision 3. On May 2, 2024, DoD issued Class Deviation 2024-O0013, mandating that contractors continue complying with Revision 2 for DFARS 252.204-7012 and CMMC Level 2 until formal DFARS rulemaking updates. Prematurely converting SPRS scores to Rev 3 can disrupt current defense awards.
Leaving Organization-Defined Parameters (ODPs) Blank: Failing to define parameter values in the SSP. Assessors cannot validate requirements without defined thresholds.
Over-Scoping Enterprise Networks: Applying requirements across an entire campus or corporate network rather than constraining scope to an isolated CUI enclave.
Neglecting Supply Chain Risk Management (SR): Failing to establish formal supplier vetting and component provenance verification procedures required by the new SR family.

Related programs

The table below summarizes how NIST SP 800-171 Rev 3 relates to prior standards and related compliance frameworks:

Framework / Standard	Governing Body	Requirement Count	Primary Scope	Operational Role vs. Rev 3
NIST SP 800-171 Rev. 3	NIST / CSRC	97 requirements (17 families)	Nonfederal systems handling CUI	Current NIST baseline with 88 ODPs and elevated Supply Chain (SR) controls.
NIST SP 800-171 Rev. 2	NIST / CSRC	110 requirements (14 families)	Nonfederal systems handling CUI	Prior standard; remains the active baseline under DoD Class Deviation 2024-O0013.
NIST SP 800-171A Rev. 3	NIST / CSRC	422 determination statements	Assessment procedures for Rev 3	Companion guide detailing examine, interview, and test assessment methods.
CMMC Level 2	U.S. Department of Defense	110 controls (pegged to Rev 2)	Defense Industrial Base (DIB)	DoD certification framework requiring third-party (C3PAO) or self-assessment.
NIST SP 800-53 Rev. 5	NIST / CSRC	1,000+ controls (20 families)	Federal information systems	Comprehensive federal control catalog from which SP 800-171 is tailored.

FAQ

What is NIST 800-171 Rev 3?

NIST SP 800-171 Revision 3 is the federal standard published on May 14, 2024, specifying 97 security requirements across 17 families to protect Controlled Unclassified Information (CUI) in nonfederal systems.

What is the difference between NIST 800-171 Rev 2 and Rev 3?

Revision 3 reduces the requirement count from 110 to 97 while expanding families from 14 to 17 by adding Planning (PL), System and Services Acquisition (SA), and Supply Chain Risk Management (SR). It also introduces 88 Organization-Defined Parameters (ODPs) and eliminates unassessed NFO assumptions.

Does CMMC Level 2 require NIST SP 800-171 Rev 3?

No. Under DoD Class Deviation 2024-O0013 issued on May 2, 2024, defense contractors subject to DFARS 252.204-7012 and CMMC Level 2 must adhere to Revision 2 until DoD updates its acquisition regulations to adopt Revision 3.

How many Organization-Defined Parameters are in Rev 3?

NIST SP 800-171 Rev 3 contains 88 Organization-Defined Parameters (ODPs). These parameters enable contracting agencies or organizations to specify quantitative security values, such as session timeout durations and audit log retention periods.

What are the new control families in NIST SP 800-171 Rev 3?

Revision 3 introduces three new requirement families: Planning (PL), System and Services Acquisition (SA), and Supply Chain Risk Management (SR). In addition, it expands the Security Assessment family into Assessment, Authorization, and Monitoring (CA).

Sources

NIST Computer Security Resource Center: SP 800-171 Rev. 3 Final Publication — Official publication page for Special Publication 800-171 Revision 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, published May 14, 2024. Read on November 11, 2026.
NIST Computer Security Resource Center: SP 800-171A Rev. 3 Final Publication — Official publication page for Special Publication 800-171A Revision 3, Assessing Security Requirements for Controlled Unclassified Information, published May 14, 2024. Read on November 11, 2026.
DoD Defense Pricing and Contracting: Class Deviation 2024-O0013 — Official memorandum issued May 2, 2024, directing contracting officers to require compliance with NIST SP 800-171 Revision 2 for DFARS 252.204-7012. Read on November 11, 2026.
National Archives and Records Administration: Controlled Unclassified Information (CUI) Registry — Executive Agent federal guidance and 32 CFR Part 2002 framework establishing safeguarding requirements for nonfederal entities. Read on November 11, 2026.