NIST 800-171 · 2026-04-14 · Confidence: Medium
NIST 800-171 Rev. 3 transition: what defense contractors should plan for
Summary
NIST 800-171 Rev. 3 introduces restructured control families and tighter expectations around organization-defined parameters (ODPs). CMMC Level 2 currently maps to Rev. 2.
What this means
Do not rewrite your SSP against Rev. 3 today. But when you build new policies, write them in language that survives the Rev. 3 transition.