Blog · 2026-11-11 · Gardience Engineering · How we test

NIST SP 800-171 Rev 3 and CMMC: what is decided and what is not

CMMC Level 2 software

We keep this page current. The Department of War has not decided when CMMC and DFARS 7012 move to NIST SP 800-171 Revision 3. When it does, we update this page the same week. Last checked: November 11, 2026.

• Rev 3 is final. NIST published SP 800-171 Revision 3 in May 2024. It replaces Revision 2 as NIST's current version.
• Your contract still says Rev 2. On May 2, 2024, DoD issued class deviation 2024-O0013, which keeps DFARS 252.204-7012 tied to Revision 2. It has no end date.
• CMMC Level 2 is assessed against Rev 2. The 110 Rev 2 requirements are what your SPRS score counts today.
• The Phase 2 pause did not change that. When DoD suspended CMMC Phase 2 on July 13, 2026, it said it would keep enforcing baseline compliance with Rev 2 through self-assessments and some government-led assessments.
• DoD has said what values it wants in Rev 3. Rev 3 leaves many settings for the organization to choose (organization-defined parameters). In 2025 DoD published the values it expects defense contractors to use.

• When DFARS 7012 and CMMC switch to Rev 3. No date has been announced.
• What the CMMC reform brings. The CMMC Reform Task Force's 60-day review ended in September 2026. Its recommendations have not been published, so anything you read about them is reporting, not policy, until DoD announces a decision.

• Fewer, broader requirements: 97 instead of 110. Many Rev 2 requirements were merged or withdrawn, so the lower number is not a lighter standard.
• Three new families: Planning, System and Services Acquisition, and Supply Chain Risk Management. The supply chain family asks for a supply chain risk management plan, acquisition strategies that address supply chain risk, and processes to find and respond to supply chain weaknesses.
• Specific values instead of "periodically": organization-defined parameters turn vague wording into numbers you must meet, such as how often something is reviewed. DoD's published values tell you which numbers it expects.

1. Keep scoring against Rev 2. That is what your contract and your SPRS score use until DoD says otherwise.
2. Fix the machine settings first. Audit logging, account lockout, session locks, encryption, patching, and malware protection are in both revisions. Work done on your servers now carries over.
3. Start the paperwork Rev 3 adds. A supply chain risk management plan and the new planning documents take people time, not machine time. Starting them now costs little.

4. Watch for the decision. A class deviation change, a DFARS rule, or a change to the CMMC rule (32 CFR Part

   1. will be the signal. This page will say so when it happens.

Gardience checks the machine settings behind your Rev 2 SPRS score on every Windows and Linux machine in scope, fixes what it can with one approved click, and keeps dated evidence of each check and change. Because those settings are in both revisions, the work you do in Gardience today still counts when the switch comes.

Not for DFARS 7012 or CMMC Level 2. Both use Rev 2 today. Check your own contract for anything different.

DoD has not said how scoring will work under Rev 3. We will add it here when it does.

The machine settings are the same work either way. The new supply chain and planning documents are the part to start early, because they take the longest.

Sources: NIST SP 800-171 Rev. 3, Crowell & Moring on class deviation 2024-O0013, Holland & Knight on DoD's Rev 3 parameters, Greenberg Traurig on the Phase 2 suspension, Cloud Security Alliance on Rev 3 changes.