NIST 800-171 Rev 2 vs Rev 3: Which One Applies to CMMC Right Now?

The short answer

For CMMC Level 2 today, the baseline is NIST SP 800-171 Revision 2. Revision 3 exists and will matter eventually, but the Department of Defense has kept contractors on Rev 2 for now. If you are organizing evidence or building documentation in 2026, build it around Rev 2.

This article is generic and educational. It points you to the authoritative sources and explains the landscape; it does not interpret the requirements for you or determine what applies to your organization.

Why Rev 2 is still the one that counts

When NIST published Revision 3, the DoD issued a class deviation directing contractors subject to the safeguarding clause to continue complying with Rev 2. The move to Rev 3 will happen through future rulemaking, and by most accounts that is years away rather than months. The practical guidance across the community is consistent: prepare against Rev 2 until the DoD formally sets a Rev 3 requirement.

What actually changed in Rev 3

Revision 3 is a real restructuring, which is exactly why jumping early can waste effort:

• The total number of requirements dropped (Rev 2’s 110 were reorganized down to roughly 97 in Rev 3).
• Rev 3 introduced Organization-Defined Parameters (ODPs) — places where the requirement leaves a value (like a time period) for the organization or DoD to set.
• Some requirements were consolidated, withdrawn, or moved, and new structure was added.

None of this changes what you should be doing right now, but it does mean a program rebuilt prematurely for Rev 3 may not match the requirement you are actually assessed against.

What to do in the meantime

• Organize against Rev 2. Your 14 families, your SSP, your evidence — all map to Rev 2 today.
• Keep your structure flexible. Good evidence organization (consistent folders, owners, dated files) transfers cleanly to Rev 3 whenever it lands. You are organizing your own evidence, not hard-coding control numbers.
• Watch for the rulemaking. When the DoD formally moves the baseline, that is the signal to revisit — not before.

Read it at the source

• NIST SP 800-171 Rev. 2 (current Level 2 baseline): https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final
• NIST SP 800-171 Rev. 3 (future-planning reference): https://csrc.nist.gov/pubs/sp/800/171/r3/final
• 32 CFR Part 170 — CMMC Program Rule: https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170

More in our regulatory sources guide.

Built on the current baseline

The DIBStack Evidence Binder is organized around the 14 NIST SP 800-171 families as they stand under Rev 2 today, as blank templates you complete yourself. It helps you organize evidence on your side; it does not reproduce control text, determine compliance, or tell you which revision applies to your contracts.