Current Edition Checked October 24, 2026
Revision 3 is current at NIST, but the Department of Defense still requires Revision 2 under DFARS 252.204-7012 and for CMMC Level 2, through a class deviation.
What It Covers
The security requirements for protecting the confidentiality of Controlled Unclassified Information in contractor systems.
Who It Applies To
Contractors and subcontractors that process, store or transmit CUI, most often under DFARS 252.204-7012.
Key Requirements
- Revision 2: 110 requirements in 14 families, the basis of DoD assessments today.
- Revision 3: 97 requirements in 17 families, with organization-defined parameters.
- A System Security Plan and plans of action for unmet requirements.
- Incident reporting within 72 hours under DFARS 252.204-7012.
What an Auditor Asks to See
- The System Security Plan, mapped to the revision your contract names.
Where Systems Fall Short
- Building to Revision 3 when the contract assesses against Revision 2, or the reverse.
How QES Helps
Through QES’s risk and cybersecurity partner: gap assessments to the revision the contract requires.
Related Standards
Sources. NIST — SP 800-171 Rev. 3 (opens in a new tab); Mondaq — DoD class deviation on NIST SP 800-171 Revision 3 (opens in a new tab). Status checked October 24, 2026. This page summarizes NIST SP 800-171; it does not reproduce or replace it. Buy the standard from its publisher, or read the regulation in its official text, before relying on a detail. Not legal advice.