DoD Maintains NIST SP 800-171 Revision 2 for Current CUI Requirements

NIST SP 800-171 sets security requirements for nonfederal organizations that process, store, or transmit Controlled Unclassified Information (CUI) under federal awards and contracts. Its users include defense contractors and subcontractors, research universities, laboratories, civilian agency vendors, and service providers handling covered information. The National Institute of Standards and Technology (NIST) published Revision 3 on May 14, 2024, alongside the companion assessment guide, NIST SP 800-171A Revision 3. Revision 3 aligns nonfederal requirements more closely with the modern federal baseline in NIST SP 800-53 Revision 5.

Revision 3 establishes 97 security requirements across 17 families and includes 88 organization-defined parameters. Those parameters require organizations or responsible authorities to define specific implementation details where the standard allows choices. The revision is a substantial framework update, but publication of a new NIST standard does not itself revise the clauses governing a particular DoD procurement. Under DoD Class Deviation 2024-O0013, Revision 2 remains the applicable baseline for DFARS 252.204-7012 and CMMC Level 2 until acquisition regulations are updated.

This distinction has direct procurement consequences. A contractor should not assume that a solicitation, contract, or assessment has shifted to Revision 3 solely because NIST published the update. The controlling requirement depends on applicable contract clauses and acquisition documents. Procurement teams can reduce ambiguity by explicitly stating the required revision in solicitations and related documents; bidders, subcontractors, and assessors can then align security plans, evidence, and compliance estimates to the correct baseline.

Organizations may still use Revision 3 to understand the updated framework and plan for potential future changes, while keeping that work distinct from their current contractual obligations. This is especially relevant for entities with multiple customer types: defense contractors subject to DFARS, universities and laboratories working on sponsored research, civilian federal contractors, and commercial cloud or managed service providers may encounter different contract terms. NIST SP 800-171 is a set of security requirements, not a grant program, so the procurement impact is compliance scope, assessment planning, and the cost and timing of security implementation rather than new funding.

• NIST SP 800-171 Revision 3 contains 97 security requirements organized across 17 families, with 88 organization-defined parameters.
• NIST published Revision 3 on May 14, 2024, alongside NIST SP 800-171A Revision 3, its companion assessment guide.
• DoD Class Deviation 2024-O0013 keeps Revision 2 as the applicable baseline for DFARS 252.204-7012 and CMMC Level 2 until acquisition regulations are updated.
• Publication of Revision 3 alone does not change the requirements in a specific defense solicitation or contract.
• Contractors should check each solicitation and contract’s clauses and stated cybersecurity baseline before revising policies, assessment plans, or compliance investments.
• Acquisition teams should name the applicable NIST SP 800-171 revision in procurement documents to reduce bidder uncertainty and misaligned assessments.
• Organizations handling CUI can use Revision 3 for framework awareness and forward planning while distinguishing it from their current Revision 2 obligations where those apply.
• Potentially affected organizations include defense contractors and subcontractors, research universities, laboratories, civilian federal contractors, and commercial cloud or managed service providers handling covered data.
• NIST SP 800-171 prescribes technical, physical, and administrative safeguards; it does not provide financial grants.