The Conventional Wisdom
Defense contractors often focus solely on NIST SP 800-171 Revision 2 compliance until the Department of Defense updates CMMC Level 2 to require Revision 3. Since 32 CFR Part 170 still references Revision 2, and CMMC assessments use the Revision 2 baseline, why invest in a standard not yet mandated in your contracts?
This wait-and-see approach seems practical. You're already managing DFARS 252.204-7012 obligations, CMMC self-assessments, and the demands of protecting Controlled Unclassified Information. Adding another compliance initiative before it's required seems premature, especially during the CMMC Phase II suspension.
Why We Disagree
This logic treats compliance as a binary switch you flip when a contract clause appears, ignoring how implementation actually works.
NIST published SP 800-171 Revision 3 in May 2024 and withdrew Revision 2. The Department of Defense issued guidance in April 2025 on implementing organization-defined parameters from Revision 3. These aren't distant possibilities. They're published standards and active policy development. When Revision 3 reaches your contracts, you won't get a grace period to establish new control families, rewrite your System Security Plan, or build evidence repositories from scratch.
Consider what "transition" means. You need to map 110 Revision 2 requirements to a restructured framework that adds three security requirement families (planning, system and services acquisition, and supply chain risk management). It introduces organization-defined parameters requiring governance decisions and changes assessment procedures in SP 800-171A Rev. 3. You must identify which requirements were retained, modified, combined, withdrawn, or replaced. You need to assign control ownership across procurement, legal, engineering, and vendor management teams who weren't involved in your original Revision 2 program.
This isn't a simple documentation refresh. It's a cross-functional implementation effort that takes months, not weeks.
The Evidence
The structural changes in Revision 3 create specific gaps that waiting won't solve:
New control families don't map to existing programs. If you've built your CUI protection around the 14 families in Revision 2, you don't have processes for security planning integration, acquisition security requirements, or supply chain risk management as distinct control domains. You can't retrofit those overnight when a contract requires them.
Organization-defined parameters require decisions you haven't made. ODPs let you set frequencies, thresholds, and time periods based on your risk profile and mission requirements. But someone must decide what those values should be, document the rationale, translate them into technical configurations, and build evidence that proves consistent enforcement. That governance structure doesn't exist in most Revision 2 implementations because Revision 2 didn't require it.
Assessment expectations changed. SP 800-171A Rev. 3 restructured assessment procedures to align with NIST SP 800-53A. Your current evidence collection may not address what assessors will examine under the new methodology. If you're still assembling screenshots and spreadsheets after an assessor requests proof of control operation during a specific date range, you're not ready for the Revision 3 assessment model.
The Department of Defense's April 2025 memo on ODPs signals that implementation planning is underway now, even though the regulatory baseline hasn't shifted. Organizations that wait for the final rule change will face compressed timelines and resource conflicts with ongoing CMMC obligations.
What to Do Instead
Run a controlled dual-track program:
Maintain your Revision 2 baseline. Don't abandon current implementation or halt CMMC Level 2 preparation. Your contracts still require Revision 2 compliance, and CMMC Phase I self-assessment obligations remain active.
Build a detailed crosswalk. Map every Revision 2 requirement to its Revision 3 successor. Document whether each requirement was retained with minor changes, expanded, incorporated into a broader control, withdrawn, or affected by an ODP. NIST published a formal change analysis to support this work. Use it.
Identify new stakeholders now. The planning (PL), system and services acquisition (SA), and supply chain risk management (SR) families will require participation from teams outside your security operations group. Assign control ownership before you start implementation. Procurement needs to understand SA-04 (Acquisition Process). Legal and vendor management need to address SR-01 (Policy and Procedures) and SR-02 (Supply Chain Risk Management Plan). Waiting until a contract requires these controls to discover you don't have the right people in the room is expensive.
Establish ODP governance. Create a process for receiving parameter assignments (from contracts or agency direction), analyzing risk to support internal decisions, approving values, documenting rationale, implementing parameters in technical configurations, and periodically reviewing assignments. This governance layer doesn't exist in most Revision 2 programs because it wasn't required. Build it now while you have time to test it.
Update evidence collection. Your System Security Plan, Plans of Action and Milestones, and evidence repositories were built for Revision 2 assessment procedures. Review what SP 800-171A Rev. 3 expects assessors to examine. Can you produce auditor-ready records that show a control operated during a specific date range? Can you demonstrate consistent enforcement of an ODP value across policy, configuration, and operation? If not, your evidence model needs work.
When the Conventional Wisdom IS Right
You shouldn't convert your entire program to Revision 3 tomorrow. Your contracts still reference Revision 2, and CMMC Level 2 assessments continue to use the Revision 2 baseline. Abandoning your current implementation to chase a standard that isn't yet mandated would create real compliance gaps.
The wait-and-see approach also makes sense if you're not handling CUI, aren't subject to DFARS 252.204-7012, and don't expect CMMC obligations in future contracts. If Revision 3 won't affect your business, don't build a program around it.
But if you're a prime or subcontractor with active CUI obligations and CMMC in your pipeline, waiting until Revision 3 appears in a contract means you'll implement under pressure, with incomplete analysis, and without time to build the governance and evidence infrastructure the standard expects. The CMMC Phase II suspension isn't a signal to slow down. It's a window to prepare for a broader standard before it becomes a contract requirement.
