NIST SP 800-171: Rev 2 vs Rev 3 and POA&M limits

What NIST SP 800-171 requires, why DoD still requires Revision 2 over Revision 3, and which requirements can never sit on a POA&M.

Published September 26, 20268 min read

A subcontract that will carry controlled unclassified information can sit unsigned while a buyer and a supplier work out which NIST SP 800-171 revision applies and whether an open item still qualifies for a plan of action and milestones. DoD still enforces the older, larger requirement set, and six of its requirements can never be deferred on a POA&M. Settle both before award and the subcontract can be signed on schedule.

What is NIST SP 800-171?

NIST Special Publication 800-171 sets the security requirements a company must meet to protect controlled unclassified information (CUI) on its own systems, and every defense supplier whose work involves covered defense information must meet it under its contract or subcontract. DoD enforces Revision 2, with 110 requirements, as of September 25, 2026, not the newer Revision 3.

What is CUI, and when does it put your company in scope?

Controlled unclassified information is information the government creates or possesses, or a company creates or possesses for the government, that a law, regulation or government-wide policy requires or permits an agency to handle with safeguarding or dissemination controls. 32 CFR 2002.4(h). Your company is in scope once the prime contract carries DFARS 252.204-7012 and your work involves covered defense information.

DFARS 252.204-7012 defines covered defense information as information the government provides or that your systems generate, receive or store while performing the contract, and covered contractor information system as any system that processes, stores or transmits it. DFARS 252.204-7012(a). The clause requires the prime to flow it, without alteration, into any subcontract for operationally critical support or work involving covered defense information, including subcontracts for commercial products or services. DFARS 252.204-7012(m). Check your own subcontract for the clause before assuming you are out of scope. The same rule makes 7012 a flowdown clause on every CUI subcontract.

Does DoD require Revision 2 or Revision 3?

DFARS 252.204-7012(b)(2)(i) requires NIST SP 800-171, and DoD points that requirement at Revision 2, the 110-requirement version NIST published in February 2020. DFARS 252.204-7012(b)(2)(i). NIST finalized Revision 3, with 97 requirements, on May 14, 2024, but DoD has kept the clause tied to Revision 2, most recently under Class Deviation 2026-O0025, Revision 3, signed September 3, 2026.

DoD first tied the clause to Revision 2 with Class Deviation 2024-O0013 on May 2, 2024. Class Deviation 2024-O0013, Revision 1. Under the FAR Overhaul, Class Deviation 2026-O0025 moved the policy to DFARS 240.370 and reissued 252.204-7012 as a deviation clause dated JUN 2026, whose paragraph (b)(2)(i) still names Revision 2. Class Deviation 2026-O0025, Revision 3, cover memo para. (b) and Attachment 1.

Revision 3 restructures the same protection goals into 97 requirements across 17 families, three more than Revision 2's 14. The new families cover planning, system and services acquisition, and supply chain risk management. Revision 3 also leaves some requirements as organization-defined parameters, points where the requiring agency sets the value, or the company must set it if the agency does not. NIST SP 800-171 Revision 3, Section 2. DoD set values for the Revision 3 parameters as policy on April 10, 2025, and four of them are guidance rather than a fixed value. DoD memorandum, Organization-Defined Parameters for NIST SP 800-171 Revision 3, April 10, 2025.

NIST SP 800-171 Revision 2 vs Revision 3

Download image

Matrix comparing NIST SP 800-171 Revision 2 and Revision 3 by row. Columns show publication date, number of security requirements, number of families, organization-defined parameters, and what DoD requires today as of September 25, 2026. Revision 2, published February 2020, has 110 requirements across 14 families and no organization-defined parameters, and is the version DFARS 252.204-7012 requires under Class Deviation 2026-O0025, Revision 3. Revision 3, finalized May 14, 2024, has 97 requirements across 17 families, including three new families for planning, system and services acquisition, and supply chain risk management, plus organization-defined parameters that DoD set values for on April 10, 2025, but Revision 3 is not yet required on any DFARS 252.204-7012 contract.

Revision	Published	Requirements	Families	Organization-defined parameters	What DoD requires today (2026-09-25)
Revision 2	2020-02 (errata 2021-01-28)	110	14	None	Required under DFARS 252.204-7012, per Class Deviation 2026-O0025, Rev 3
Revision 3	2024-05-14	97	17 (adds Planning, System and Services Acquisition, Supply Chain Risk Management)	DoD set values 2025-04-10 (four as guidance, not a fixed value)	Not required on any DFARS 252.204-7012 contract; no rulemaking or class deviation has adopted it

DoD still requires Revision 2's 110 requirements; Revision 3 is finalized but not yet required under DFARS 252.204-7012.

Keep both requirement sets on file, and work to Revision 2 while it is the version DFARS 252.204-7012 names.

What is a system security plan, and why does it come first?

A system security plan (SSP) names the systems that hold CUI and states how your company implements each NIST SP 800-171 requirement on them. It is one of six requirements that can never sit on a plan of action and milestones (POA&M), so a supplier without a current SSP cannot claim a Conditional Level 2 status. 32 CFR 170.21.

Write the SSP first. It sets the system boundary. The boundary lists the servers, laptops, cloud services and paper files that hold CUI, and every score depends on it. Get the boundary wrong and the score built on top of it is wrong too.

Which requirements can never go on a POA&M?

Under CMMC, a POA&M lets a supplier hold a Conditional Level 2 status while it closes small gaps, limited by 32 CFR 170.21. The score must reach at least 88 of 110, counting open items as unmet. No item carries more than one point, except CUI encryption in place but not FIPS-validated. Six requirements can never appear on the plan.

Which requirements can go on a POA&M

Download image

Table listing the plan of action and milestones eligibility rules under 32 CFR 170.21 for a CMMC Level 2 assessment. Rows cover the overall score threshold of at least 88 of 110, the standard one-point weight limit for any open item, the named exception allowing SC.L2-3.13.11 CUI encryption without FIPS validation despite its three-point weight, the six named requirements that can never be included on a POA&M regardless of weight (AC.L2-3.1.20 External Connections, AC.L2-3.1.22 Control Public Information, CA.L2-3.12.4 System Security Plan, PE.L2-3.10.3 Escort Visitors, PE.L2-3.10.4 Physical Access Logs, and PE.L2-3.10.5 Manage Physical Access), and the 180-day closeout deadline after which a Conditional status expires.

Rule	Detail	On a POA&M?
Overall score	Must be at least 88 of 110 (80%) before any POA&M is considered	Not applicable
Standard requirement	Any Level 2 requirement weighted at 1 point	Yes
Named exception	SC.L2-3.13.11 CUI encryption employed but not FIPS-validated, weighted at 3 points	Yes, despite exceeding 1 point
Named exclusion	AC.L2-3.1.20 External Connections	No, never
Named exclusion	AC.L2-3.1.22 Control Public Information	No, never
Named exclusion	CA.L2-3.12.4 System Security Plan	No, never
Named exclusion	PE.L2-3.10.3 Escort Visitors	No, never
Named exclusion	PE.L2-3.10.4 Physical Access Logs	No, never
Named exclusion	PE.L2-3.10.5 Manage Physical Access	No, never
Closeout	Confirmed by a POA&M closeout assessment within 180 days of the Conditional CMMC Status Date	Status expires if missed

A supplier needs at least an 88-of-110 score and all six never-POA&M requirements met before it can carry other gaps on a POA&M.

The six are the system security plan and five others: two access-control requirements and three physical-protection requirements. They cover controlling connections to and use of external systems, controlling CUI posted or processed on publicly accessible systems, escorting visitors, keeping physical access logs, and controlling physical access devices. 32 CFR 170.21(a)(2); NIST SP 800-171 Rev 2, §§3.1.20, 3.1.22, 3.10.3-3.10.5. Close gaps in these six before assessment, since a gap there blocks a Conditional status outright. CMMC covers the closeout deadline and the affirmation cycle that follows.

How do you scope a system that touches CUI?

Scoping sets which systems a supplier assesses against NIST SP 800-171. It covers the systems that process, store or transmit CUI, plus the systems that protect them. Many suppliers keep CUI in an enclave, a separate segment with its own documented boundary, so the assessment covers only those systems.

An external service provider (ESP), a vendor a supplier uses to run IT or security services, falls inside that boundary once CUI or the data protecting CUI is processed, stored or transmitted on its assets. 32 CFR 170.4(b), 170.19(c)(2). CMMC scoping also brings in any security protection asset that provides a security function to a CUI system, assessed against the requirements relevant to what it does. 32 CFR 170.19(c)(1), Table 3. If a supplier stores, processes or transmits CUI in a cloud service, that cloud provider must meet security requirements equivalent to the FedRAMP Moderate baseline. DFARS 252.204-7012(b)(2)(ii)(D).

What must a supplier report within 72 hours?

A supplier must rapidly report a cyber incident affecting a covered contractor information system or covered defense information to DoD within 72 hours of discovering it, through DIBNet. DFARS 252.204-7012(a), (c)(1)(ii), (c)(3). The clock starts at discovery, not confirmation that CUI was exposed, so get the DIBNet reporting path and a DoD-approved medium assurance certificate in place now.

A subcontractor reports directly to DoD too, and passes the incident report number up its chain rather than waiting on the prime. DFARS 252.204-7012(m)(2)(ii).

What should a prime ask suppliers for?

Ask each supplier handling CUI to confirm it has a current system security plan and give its date, and to give its latest Revision 2 self-assessment score and date. The CMMC lesson covers what to collect for status and POA&M closeout, and when to re-check it. Those answers show whether you can release CUI to the supplier.

Collecting these dates from many suppliers is chasing work. Your team can open each request as a task and hand it to Scout Agent, who follows up with the supplier by email and phone, within the permissions your team sets. Track the same dates in your C-SCRM review.

A simple tracker keeps this in one place:

Supplier	SSP exists and its date	SPRS score and date (Rev 2)	CMMC status and date, if any	POA&M closeout deadline	Next re-check
Example supplier	Yes, 2026-06-01	92/110, 2026-06-15	Conditional Level 2 (Self), 2026-06-20	2026-12-17	2027-06-15

What should a small supplier do first?

List every system that stores, processes or transmits CUI, and write the SSP for that boundary before anything else. Self-assess against Revision 2, the requirement set DoD currently enforces, then post the score and affirm it in SPRS. The SSP comes first because every other score depends on its boundary, and it can never sit on a POA&M.

Fix the six requirements that can never sit on a POA&M before you assess, since a gap there blocks a Conditional status outright. Any other one-point requirement can go on a POA&M, provided the assessment score, with those items counted as unmet, is at least 88 of 110. The SPRS lesson covers how the score and affirmation post, and CUI that also touches export-controlled technical data brings export controls into the same review.

Questions teams ask

Does NIST SP 800-171 Revision 3 apply to any DoD contract?

No. DFARS 252.204-7012 still names Revision 2, most recently under Class Deviation 2026-O0025, Revision 3. Check the version your contract's 252.204-7012 names.

What happens once DoD adopts Revision 3?

DoD has set organization-defined parameter values for Revision 3 as policy, but no rulemaking or class deviation has adopted Revision 3 or set a transition date. Watch the DARS FAR Overhaul class deviations page for a new revision of 2026-O0025.

Can a supplier that only handles FCI skip NIST SP 800-171?

Yes, if it holds only FCI. FAR 52.204-21's 15 basic safeguarding requirements apply instead of NIST SP 800-171. Confirm which category your data falls into before scoping either one.

Does a subcontractor need its own SSP, or can it rely on the prime's?

The subcontractor needs its own SSP. It describes the systems the subcontractor controls, and a prime's SSP does not cover a subcontractor's separate network, cloud tenant or facility. Each company in the chain that holds CUI on its own systems needs an SSP that matches its own boundary.

If your team needs to collect SSP dates, SPRS scores and POA&M closeout dates from many suppliers, talk to our team.

This article is general information, not legal or tax advice. Check how the rules apply to your business with your legal or tax advisor.

Sources (12)