NIST SP 800-171 Revision 3
All 97 Revision 3 requirements for protecting CUI in nonfederal systems, in NIST's own 03.xx.xx numbering with the verbatim requirement text and the SP 800-171A evidence lists.
What NIST SP 800-171 Revision 3 is
NIST SP 800-171 defines the security requirements a nonfederal organisation must meet to protect Controlled Unclassified Information (CUI) that it handles for the US government. Revision 3, published in May 2024, restates the requirements in 17 families, numbered 03.01.01 and upward, and removes the 33 Revision 2 requirements that it folded into others or retired as no longer needed. The result is 97 requirements.
Revision 3 also introduces organisation-defined parameters: places where the requirement says a value, such as a time period or a frequency, is for the organisation to decide and record. Three families are new to 800-171 in Revision 3: Planning, System and Services Acquisition, and Supply Chain Risk Management. They sit alongside the familiar fourteen, one of which is renamed Security Assessment and Monitoring.
The companion publication, SP 800-171A, defines how each requirement is assessed. NIST publishes the Revision 3 assessment procedures in the same machine-readable catalog as the requirements, and the evidence lines on each row here are taken from them. Where that catalog leaves out the examine list for a requirement (03.01.22 and 03.14.03), the list is copied from the published SP 800-171A Revision 3 document instead.
Who it applies to
- Contractors and subcontractors whose contracts or agreements impose SP 800-171, including those preparing ahead of a move from Revision 2.
- Universities, research organisations and other nonfederal entities that handle CUI under an agreement that cites 800-171.
- Anyone planning a transition from Revision 2 who wants to see the Revision 3 text, parameters and families beside their current controls.
How it is structured in CMDash
CMDash seeds the 97 Revision 3 requirements in NIST's own 03.xx.xx numbering, exactly as the NIST OSCAL catalog lists them, with the family names as NIST prints them. The 33 withdrawn requirements are not listed.
| Access Control | 16 |
| Awareness and Training | 2 |
| Audit and Accountability | 8 |
| Configuration Management | 10 |
| Identification and Authentication | 8 |
| Incident Response | 5 |
| Maintenance | 3 |
| Media Protection | 7 |
| Personnel Security | 2 |
| Physical Protection | 5 |
| Risk Assessment | 3 |
| Security Assessment and Monitoring | 4 |
| System and Communications Protection | 10 |
| System and Information Integrity | 5 |
| Planning | 3 |
| System and Services Acquisition | 3 |
| Supply Chain Risk Management | 3 |
These counts are the control rows CMDash actually seeds, checked against the seed files by a test on every build.
Scope: Revision 3 numbering, not the CMMC practice IDs: CMMC Level 2 is still defined by the Revision 2 requirements. The 33 requirements Revision 3 withdrew are not listed.
The control text
97 of the 97 seeded controls carry the publisher’s own wording, taken from NIST SP 800-171 Rev 3. It is public-domain content, so CMDash reproduces it rather than paraphrasing — you assess against what the publisher wrote.
What CMDash does for NIST SP 800-171 Revision 3
- Each of the 97 requirements is a tracked row with an owner, a status, reviewer notes and dated evidence, using NIST's verbatim requirement text.
- Organisation-defined parameters appear in square brackets in the requirement text, so it is plain which values your organisation still has to decide and record.
- The evidence lines on each row are the documents NIST lists for an assessor to examine under SP 800-171A, so you collect what an assessment will ask for.
- Gaps export to a POA&M CSV with owner, status and evidence requirements, as for every framework.
- Every control is a tracked row with an owner, a status (not started, in progress, implemented, not applicable, at risk, failing), reviewer notes, and its own evidence requirements — not a checkbox on a spreadsheet.
- Evidence is uploaded against a specific control, dated, and kept on that control, so an assessor can see what was true when.
- Gaps export to a POA&M CSV — every control that is not implemented and not marked out of scope, with owner, status and evidence requirements.
- Policies you author in CMDash link to the controls they govern, so each control row shows which living policies stand behind it.
- A time-boxed, read-only external assessor seat can be scoped to just this framework, with an expiry date you set and a record of every page they opened.
What it shares with your other frameworks
No crosswalk mappings ship for NIST SP 800-171 Revision 3. Evidence you collect against it does not automatically surface on your other frameworks, and that is worth knowing before you plan the work.
Where the evidence comes from
CMDash reads from the security tools you already run and turns what they report into control evidence. These are the integrations whose data lands closest to NIST SP 800-171 Revision 3’s control groups — you decide which control each signal evidences, and CMDash keeps it current from then on.
Where CMDash stops
Published on purpose. A buyer who discovers a limit after signing is a support ticket and a refund conversation; a buyer who reads it here is making an informed decision.
- CMMC Level 2 is still defined by the Revision 2 requirements. CMDash tracks those in the CMMC Level 2 framework with the CMMC practice identifiers; this framework does not replace it, and a Revision 3 status does not feed an SPRS score.
- No crosswalk to CMMC Level 2 or to any other framework is seeded yet, so evidence collected here does not automatically appear against your other frameworks.
- The SP 800-171A assessment objectives are not tracked per requirement for Revision 3. Only the list of documents to examine is carried on each row; the interview and test lists are not.
- Organisation-defined parameter values are yours to set. CMDash does not choose them for you.
Common questions
Should I track Revision 3 or Revision 2?
Track whichever your contract or the CMMC rule cites. CMMC Level 2 is defined against the Revision 2 requirements, so a CMMC assessment is scored on those. Revision 3 is here for contracts that cite it and for planning the transition.
Why are there only 97 requirements when Revision 2 had 110?
Revision 3 withdrew 33 Revision 2 requirements, folding most into others, and added new ones, including the Planning and Supply Chain Risk Management families. NIST publishes 97 for Revision 3, and that is the count seeded.
Does completing this framework make me CMMC compliant?
No. CMMC is assessed against its own scoped practice set, and certification is issued only after an assessment by an authorised assessor. CMDash tracks your evidence; it does not certify.
Also in Government & Defense
Paid plans cap how many frameworks you run at once, never which ones — NIST SP 800-171 Revision 3 is available on every paid plan.
View pricingReady to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.