Home › CMMC FAQs › CMMC Model
CMMC Model — Official DoD FAQ

Can Department Contractors Implement NIST SP 800-171 Revision 3?

💼
Need a Rev 2 to Rev 3 gap analysis? Jun Cyber can help ensure you're covered for both.
Schedule Free Consultation
Official DoD Answer
Source Source: DoD CIO CMMC FAQs v5 (B-Q4)

Yes. Companies can implement Revision 3 but must use the Department's Organization-Defined Parameters (ODPs) defined in the April 2025 memorandum. Because CMMC assessments will be conducted against Revision 2 until the class deviation is withdrawn, defense industrial base companies must ensure any identified gaps between Revision 2 and Revision 3 are addressed.

In-Depth Analysis

Implementing Rev 3 While Being Assessed on Rev 2

The DoD gives you the green light to implement NIST SP 800-171 Rev 3 — but with important caveats that could affect your assessment outcome.

The DoD's Organization-Defined Parameters

If you choose to implement Rev 3, you must use the DoD's specific ODPs from the April 2025 memorandum. These ODPs define the DoD's expectations for flexible parameters in Rev 3 controls, ensuring consistency across the defense industrial base.

Critical Warning: Mind the Gaps

Rev 3 restructured and, in some cases, consolidated controls from Rev 2. This means:

  • Some Rev 2 requirements may not have direct 1:1 mappings in Rev 3
  • If you implement only Rev 3, you could inadvertently miss Rev 2 requirements that your assessment will be based on
  • You must perform a gap analysis between Rev 2 and Rev 3 to ensure full coverage

Recommended Approach

Ensure full Rev 2 compliance first, then layer Rev 3 enhancements on top. This way, you're assessment-ready for today's requirements while future-proofing your security posture. Many organizations are using the NIST crosswalk document to map between revisions.

Have More Questions?

ChatCMMC can answer detailed questions about CMMC compliance, NIST 800-171, assessment preparation, and more — with source citations when available from selected official DoD and NIST sources.

Ask ChatCMMC →

CMMC Readiness Assessment

Find out where your organization stands and what steps you need to take. Jun Cyber's CMMC experts can help you interpret the requirements.

By submitting, you agree to be contacted by Jun Cyber. No spam, ever.

Related Questions

You Might Also Want to Know

CMMC Model

Will CMMC Update to Use NIST SP 800-171 Revision 3?

→ CMMC Model

What Is the Relationship Between NIST SP 800-171 and CMMC?

→ CMMC Model

How Will My Organization Know What CMMC Level Is Required for a Contract?

→
Jun Cyber

Ready to Start Your CMMC Journey?

Jun Cyber helps defense contractors prepare for applicable CMMC requirements. From scoping and gap assessments to documentation, remediation, and C3PAO assessment readiness — Jun Cyber provides hands-on compliance support.

📅 Schedule a Consultation Learn About CMMC Select →