NIST SP 800-171 Rev. 3

Why does it matter?

Rev. 3 changes how the requirements are read as well as what they say. Appendix E records that NIST eliminated the distinction between basic and derived requirements, increased specificity to remove ambiguity and clarify the scope of assessments, introduced organization-defined parameters (ODPs), grouped requirements, removed outdated ones, added new ones and gave every requirement a title. The introduction to Sec. 3 ties the paperwork to two requirements: the system security plan of 03.15.02 describes any enduring exceptions to the requirements, while individual, isolated or temporary deficiencies are managed through plans of action and milestones under 03.12.02. Three new families, Planning, System and Services Acquisition and Supply Chain Risk Management, bring supplier obligations into the CUI baseline.

Key benefits include:

• One kind of requirement

The basic and derived split of Rev. 2 is gone; each requirement is a single statement with lettered items, a discussion and references (Sec. 2.2 and Appendix E).

• Organization-defined parameters

Assignment and selection operations let an agency or, where none has done so, the nonfederal organization set values such as review frequencies; once set, the value becomes part of the requirement (Sec. 2.2, footnote 14).

• Alignment with the current catalog

Requirements track the SP 800-53B moderate baseline and SP 800-53 control language, with source controls cited in each requirement's references (Sec. 2.2 and Appendix C).

• Titles and grouping

Identifiers 03.xx.yy with titles and grouped requirements make the set easier to implement and assess (Appendix E).

• Assessment procedures published alongside

SP 800-171A Rev. 3 provides a procedure for every requirement, based on the SP 800-53A procedures, and NIST publishes a change analysis spreadsheet from Rev. 2 to Rev. 3 and a CUI overlay as supplemental material.

How does it work?

A Rev. 3 requirement reads the way SP 800-53 controls do. NIST's own example is 03.13.11 Cryptographic Protection: implement the following types of cryptography when used to protect the confidentiality of CUI, with an assignment for the organization-defined types, a discussion recommending FIPS-validated cryptography, and references to source control SC-13 and FIPS 140-3 (Sec. 2). Discussions are informative, not normative. Table 1 lists the 17 families: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment and Monitoring, System and Communications Protection, System and Information Integrity, Planning, System and Services Acquisition and Supply Chain Risk Management.

Sec. 2.2 gives the method. Starting with the SP 800-53B moderate baseline, NIST eliminated controls or parts of controls that are primarily the responsibility of the Federal Government, not directly related to protecting the confidentiality of CUI, adequately addressed by other related controls, or not applicable. Appendix C shows the result in Tables 3 to 22 using the symbols NCO, FED, ORC, N/A and CUI (Table 2), with ORC and N/A new in this revision. Three SP 800-53 families are left out: PII Processing and Transparency because PII is itself CUI, Program Management because it belongs to no baseline, and Contingency Planning because it addresses availability, with CP-09 and CP-09(08) kept by exception for backup confidentiality.

In use, the requirements are intended for federal agencies to place in contractual vehicles and agreements with nonfederal organizations (Sec. 1.1), which may limit scope by isolating the components that handle CUI in a separate security domain through subnetworks, firewalls and information flow control. Appendix D lists each ODP by requirement, from 03.01.01 account management time periods to 03.17.03 supply chain security requirements (Table 23), and NIST does not set the values itself. Assessments follow SP 800-171A Rev. 3. For the defense industrial base the applicable edition is set by the solicitation under DFARS 252.204-7012(b)(2)(i) and by 32 CFR 170.14 for CMMC, both of which name Rev. 2; no DoD transition date to Rev. 3 is stated in those texts.

Key Elements

• 17 requirement families

The 14 Rev. 2 families plus Planning, System and Services Acquisition and Supply Chain Risk Management (Table 1).

• 97 requirements, 33 withdrawn numbers

Identifiers 03.xx.yy with titles; withdrawn numbers point to the requirement that incorporated them, for example 03.01.17 into 03.01.16 and 03.12.04 into the Planning family's 03.15.02.

• Organization-defined parameters

Table 23 in Appendix D lists every assignment and selection, such as the 03.17.01.b review frequency for the supply chain risk management plan.

• Tailoring criteria

Table 2 symbols NCO, FED, ORC, N/A and CUI applied to the SP 800-53B moderate baseline in Tables 3 to 22 (Appendix C).

• System security plan

Requirement 03.15.02; the plan records enduring exceptions to the requirements for systems with limitations such as control systems or medical devices (Sec. 3 introduction).

• Plan of action and milestones

Requirement 03.12.02 for individual, isolated or temporary deficiencies (Sec. 3 introduction).

• Supply chain risk management plan

Requirement 03.17.01: develop a plan covering research and development, design, manufacturing, acquisition, delivery, integration, operations, maintenance and disposal; review and update it at an organization-defined frequency; protect it from unauthorized disclosure.

• Change log

Appendix E lists the changes from the February 2020 edition as updated January 28, 2021, and Table 24 records publication-level edits; the current release carries no errata.

What does it cover?

Rev. 3 applies to components of nonfederal systems that process, store or transmit CUI or that provide protection for such components, where the nonfederal organization is not collecting or maintaining information or operating a system on behalf of an agency and where no law, regulation or government-wide policy prescribes specific safeguards for the CUI category in the CUI registry (Sec. 1.1). The scope is confidentiality, although footnote 7 notes that the requirements also protect against unauthorized modification. Federal agencies use the requirements in contractual vehicles; nonfederal organizations meet them where an agreement cites this edition, and NIST's small business primer of August 18, 2025 is written for the smaller ones.

What are its objectives?

Sec. 1.1, Sec. 2.1 and Appendix E give Rev. 3 these objectives:

Provide federal agencies with recommended security requirements for protecting the confidentiality of CUI resident in nonfederal systems and organizations (Sec. 1.1).

Maintain a consistent level of protection by complying with FIPS 199 and FIPS 200 and deriving the requirements from SP 800-53 (Sec. 1).

Remove ambiguity and clarify the scope of assessments through more specific requirements and titles (Appendix E).

Give organizations flexibility and specificity through organization-defined parameters that support consistent assessments (Sec. 2.2).

Keep the requirements consistent with the SP 800-53B moderate baseline and SP 800-53 control language (Appendix E).

Let organizations scope the requirements to the components that handle CUI and record exceptions and deficiencies in the system security plan and plans of action (Sec. 1.1 and Sec. 3).

Framework in Context

Rev. 3 replaces NIST SP 800-171 Rev. 2, which DoD continues to cite through DFARS 252.204-7012 and 32 CFR 170.14. Its companion SP 800-171A Rev. 3 holds the assessment procedures, and NIST lists SP 800-172 Rev. 3 and SP 800-172A Rev. 3 as related publications for enhanced requirements. The requirements derive from the SP 800-53B moderate baseline and cite SP 800-53 source controls; Executive Order 13556 and 32 CFR 2002 define CUI and the FIPS 199 moderate floor. NIST's supplemental material includes the Rev. 2 to Rev. 3 change analysis, a CUI overlay, an FAQ and the Rev. 3 dataset on the Cybersecurity and Privacy Reference Tool.

Common Framework Mappings

Because every Rev. 3 requirement cites its SP 800-53 source control and NIST publishes a Rev. 2 to Rev. 3 change analysis, the frameworks below are the ones its records most often line up with.

Mapped frameworks include:

CIS Controls v8.1

CMMC 2.0

DFARS 252.204-7012

ISO 27001:2022

ISO 27002:2022

NIST CSF 2.0

NIST SP 800-172

NIST 800-53 Rev.5