NIST 800-171 Revision 3 Is on the Way: What Small Defense Contractors Can Do Now

If your company handles Controlled Unclassified Information (CUI) on a Department of Defense (DoD) contract, the standard for your systems is National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171. Defense contracting has been built around Revision 2 of that publication, which lists 110 requirements. In June 2026, a proposed federal rule pointed to Revision 3 instead.

On June 23, 2026, the Federal Acquisition Regulatory Council published that proposal in the Federal Register as Federal Acquisition Regulation (FAR) Case 2026-001. Its new clause, FAR 52.240-7, tells contractors with systems that handle CUI to "Comply with the security requirements of NIST SP 800-171 Revision 3" and to apply parameter values that DoD publishes. Comments closed on July 23, 2026. This post explains which revision applies to a small defense contractor today, what changed in Revision 3, and what work holds up under either one.

Which revision applies to you today

NIST finalized Revision 3 in May 2024, and its publication page states that it supersedes Revision 2. That does not change what your contract says. The Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012 ties a covered system to the NIST publication "in effect at the time the solicitation is issued or as authorized by the Contracting Officer." The contract language decides which revision you owe, and an older solicitation can carry an older revision.

If you are a subcontractor, the same clause says your prime contractor includes it in subcontracts that involve covered defense information. The revision comes from that chain of contract language, so ask your prime which revision your subcontract names, and which solicitation it came from.

On the defense side, the proposal says its parameter values align with values that DoD will codify through its own rulemaking in Title 32, part 170, of the Code of Federal Regulations, the regulation that created the Cybersecurity Maturity Model Certification (CMMC) program. The law firm Wiley reads that as a sign that DoD would make the same shift to Revision 3 in a separate rulemaking. We found no date for that shift in the sources we reviewed. Until DoD acts, the Revision 2 work behind a Supplier Performance Risk System (SPRS) score and CMMC readiness stays your working baseline, and our post on the CMMC Phase 2 pause explains why the duties you already carry did not move.

What the proposed rule asks of contractors

The clause is a proposal, and the text can change before any final rule. As of this writing, the sources we reviewed describe it only as proposed. Here is what it would ask:

• Revision 3 for systems that handle CUI. For a critical program or high-value asset, an agency may add selected enhanced requirements from NIST SP 800-172.
• One set of parameter values. Many Revision 3 requirements contain blanks, such as a review frequency or a time period. The proposal ties those blanks to standard values so contractors follow one requirement across agencies.
• A 72-hour clock. CUI incidents would be reported "within 72 hours of discovery" to the DoD reporting portal for defense contracts and to the Cybersecurity and Infrastructure Security Agency (CISA) for the rest. DFARS 252.204-7012 already defines a rapid report as one made within 72 hours of discovery, so defense contractors know this clock.
• Cloud providers. A cloud service that stores, processes, or transmits CUI would need to meet requirements equivalent to the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline.
• Gaps disclosed in the offer. An offeror that does not meet every requirement would name the gaps and attach a plan of action and milestones, and the system security plan would be available to the Government on request.
• A narrower boundary for some endpoints. The proposal lists as out of scope an endpoint hosting a virtual desktop infrastructure client that is configured to prevent any processing, storage, or transmission of CUI beyond the keyboard, video, and mouse. If adopted as written, that could help a small firm shrink its boundary.

What changed between Revision 2 and Revision 3

Revision 2 lists 110 requirements in 14 families. Revision 3 lists 97 requirements in 17 families. A smaller number is not a lighter load. NIST's own change log says Revision 3 "Increased the specificity of security requirements to remove ambiguity, improve the effectiveness of implementation, and clarify the scope of assessments." Precise requirements leave less room for a vague answer. NIST also removed the split between basic and derived requirements, dropped outdated and redundant ones, grouped related requirements, and added new ones. Five changes matter most to a small contractor:

• Three new families. Planning, System and Services Acquisition, and Supply Chain Risk Management join the original list.
• Blanks to fill. Where an agency sets no value for a parameter, NIST says the contractor assigns one. Write down the values you choose, and the reason, so an assessor can see them.
• A fuller system security plan. Revision 2 asked for a plan too (requirement 3.12.4). Revision 3 folds it into requirement 03.15.02 and spells out what the plan covers: system components, information types, threats, the operating environment and its dependencies, an overview of the requirements, safeguards in place or planned, and the people responsible.
• Unsupported components. Requirement 03.16.02 says to replace components when the developer, vendor, or manufacturer no longer supports them, and to provide options for risk mitigation or alternative support for any that cannot be replaced. Our post on Windows 10 reaching end of support shows why that matters in practice.
• A supply chain plan. Requirement 03.17.01 asks for a plan to manage supply chain risk across the life of a system, from design and acquisition through operation and disposal. The vendor questions in our post on federal supply chain exclusion orders are a practical way to start.

Work that holds up under either revision

None of this requires waiting for a final rule. The steps below serve Revision 2 today and give you a head start on Revision 3. They may reduce rework later, although no one can promise how a final rule will read.

1. Read your clauses. For each defense contract and subcontract, record the DFARS 252.204-7012 date and the revision it names. The free Contract Clause Checker shows how to find the cybersecurity clauses in a contract.
2. Draw the boundary first. NIST states that "Appropriately scoping requirements is an important factor in determining protection-related investment decisions and managing security risks for nonfederal organizations." List the laptops, servers, cloud services, and printers that touch CUI, and consider isolating them in a separate security domain. Fewer components in scope can mean fewer requirements to implement and to prove.
3. Write the system security plan to the Revision 3 outline. Use the list above. A plan built that way also answers the Revision 2 requirement.
4. Inventory unsupported hardware and software. Note the support end date for each item that touches CUI, and decide whether to replace it or isolate it.
5. List your outside providers. One page is enough: the information technology provider, cloud storage, email, and backup, each with what it touches, who answers for it, and whether it can show FedRAMP Moderate equivalence if it holds CUI.
6. Rehearse the 72-hour clock. Decide who can declare an incident, who files the report, and where the reporting contact details are kept.
7. Keep the Revision 2 evidence current. Your score, your plan, and your records are what a prime or a government reviewer can ask to see today.

For small firms in San Diego County that support Navy and Marine Corps programs through a prime contractor, the practical first move is a short email asking the prime which revision the subcontract names. The boundary and plan work can start the same week.

This post is general information, not legal advice. Confirm which revision applies to a specific contract with your contracting officer, your prime contractor, or counsel. If you want help mapping Revision 2 work to Revision 3, see our CMMC assessment page.

Sources

• Federal Acquisition Regulation: Revolutionary Federal Acquisition Regulation Overhaul Parts 1, 2, 4, 33, 39, 40, and 53; Proposed Rule (FAR Case 2026-001), Federal Acquisition Regulatory Council, Federal Register, June 23, 2026
• NIST SP 800-171 Revision 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, National Institute of Standards and Technology, May 2024
• DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, Acquisition.gov
• FAR Council Proposes Revised CUI Framework as Part of Revolutionary FAR Overhaul, Wiley Rein LLP, July 2, 2026