Frameworks · Americas
NIST SP 800-171 Rev. 3
NIST Special Publication 800-171 sets the requirements for protecting Controlled Unclassified Information in nonfederal systems and organisations. Revision 3, published in May 2024, has 97 requirements across 17 families. It adds Planning, System and Services Acquisition, and Supply Chain Risk Management to the earlier 14. Revision 2, with 110 requirements, remains the edition the CMMC rule assesses against.
Who it applies to
It applies to contractors and suppliers that handle Controlled Unclassified Information for US federal agencies, most visibly defence contractors under DFARS. It also applies to any organisation whose federal customer asks it to demonstrate CUI protection.
Main requirements
Access & identification
This area covers access control, identification and authentication, and awareness and training.
Protection
This area covers configuration management, media and physical protection, system and communications protection, and system and information integrity.
Assurance
This area covers audit and accountability, assessment, monitoring, incident response, maintenance and personnel security.
Revision 3 additions
Revision 3 adds planning, system and services acquisition, and supply chain risk management.
How xmodo supports it
- 1
Revision 3 and Revision 2 run as separate editions. CMMC assesses against Revision 2 while customers increasingly ask for Revision 3, so the version manager shows what changed and migrates evidence.
- 2
Each requirement has an owner and evidence. xmodo generates the system security plan and plan of action from the status of your controls.
- 3
Requirements map to NIST SP 800-53 Rev. 5, ISO/IEC 27001 and CMMC 2.0, so one implementation serves each.
Related frameworks
NIST SP 800-171 Rev. 3 shares requirements with the frameworks below. Controls you already run for any of them count towards NIST SP 800-171 Rev. 3 as well.
Frequently asked questions
Which revision do we need?
A CMMC assessment needs Revision 2, as the CMMC rule specifies. A customer that cites the current NIST publication needs Revision 3. xmodo runs both editions on one control set and shows the differences between them.