Get ready for NIST 800-171 Rev. 3 before your contracts require it
NIST SP 800-171 Rev. 3 is the May 2024 revision of NIST's security requirements for protecting Controlled Unclassified Information (CUI) in non-federal systems and organisations. It replaces Rev. 2's 110 requirements with 97 requirements in 17 families, aligned with NIST SP 800-53 Rev. 5. It also introduces organisation-defined parameters (ODPs), which let the contracting agency set values such as time periods and frequencies.
Is NIST 800-171 Rev. 3 right for your organisation?
Rev. 3 applies to non-federal organisations, such as defence contractors, research universities and service providers, when a federal agency contract or agreement requires CUI to be protected to this revision. US Department of Defense contracts currently still require Rev. 2 under a 2024 class deviation to DFARS 252.204-7012, so most defence suppliers use Rev. 3 to plan their transition rather than as their contractual baseline today.
It is usually required by customers, partners or schemes rather than by law.
- Issued by
- National Institute of Standards and Technology (NIST)
- Published
- May 2024
- Supersedes
- NIST SP 800-171 Rev. 2 (February 2020, updated January 2021)
- Requirements
- 97 security requirements in 17 families
- Assessment procedures
- NIST SP 800-171A Rev. 3
- Applies to
- Non-federal systems that process, store or transmit CUI
- DoD status
- DFARS 252.204-7012 and CMMC Level 2 currently reference Rev. 2
- Type
- Standard (contractual)
- Region
- United States, US
- In OneClickComply
- Supported today
OneClickComply makes it simple
NIST SP 800-171 Rev. 3 is mapped in OneClickComply's control library and is available on request, so you can work towards it on the same controls you use for Rev. 2, ISO 27001 or SOC 2. Once enabled, automated evidence collection, continuous monitoring and AutoComplete policy generation help you build the system security plan and evidence an assessor expects, with our in-house audit team on hand to interpret requirements and ODPs.
Requirements covered
97 security requirements across 17 families (03.01 Access Control to 03.17 Supply Chain Risk Management), with gaps in the numbering where Rev. 2 requirements were withdrawn or merged.
Manual NIST 800-171 Rev. 3 vs. OneClickComply
- Re-mapping 110 Rev. 2 requirements to 97 Rev. 3 requirements by hand in spreadsheets
- Tracking organisation-defined parameters and proving each one is actually enforced
- Writing new policies for supply chain risk, acquisition and rules of behaviour from scratch
- Screenshotting settings across every tool to evidence the system security plan
- Running Rev. 2 and Rev. 3 programmes side by side with duplicated effort
- Rev. 3 requirements already mapped in the control library, ready to enable on request
- Controls tied to defined parameters and monitored continuously so drift is flagged
- Audit-ready policies generated from your real environment, including the new families
- Evidence collected automatically from connected tools and logged with timestamps
- One control set, so evidence collected once counts towards Rev. 2, Rev. 3 and other frameworks
Everything you need for NIST 800-171 Rev. 3
Rev. 3 requirements mapped to a single control set shared with Rev. 2, ISO 27001 and SOC 2
Automated evidence collection from cloud, identity and device tools for access, logging and configuration requirements
AutoComplete policies covering the new Planning, acquisition and supply chain families
Continuous monitoring with alerts when CUI system controls drift
Vendor risk management to support supply chain risk management requirements 03.17.01 to 03.17.03
Ask an Auditor guidance on organisation-defined parameters and Rev. 2 to Rev. 3 gaps
Three steps to NIST 800-171 Rev. 3 compliance
Connect & scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against NIST 800-171 Rev. 3 and shows you exactly where you stand.
Fix & generate
OneClickFix remediates technical gaps in one click, and AutoComplete generates NIST 800-171 Rev. 3-aligned policies from your real environment.
Monitor & evidence
Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.
NIST SP 800-171 Rev. 3 requirements
All 97 active NIST SP 800-171 Rev. 3 security requirements across 17 families; withdrawn requirement numbers are omitted.
| Reference | Requirement |
|---|---|
| 03.01.01 | Account Management |
| 03.01.02 | Access Enforcement |
| 03.01.03 | Information Flow Enforcement |
| 03.01.04 | Separation of Duties |
| 03.01.05 | Least Privilege |
| 03.01.06 | Least Privilege: Privileged Accounts |
| 03.01.07 | Least Privilege: Privileged Functions |
| 03.01.08 | Unsuccessful Logon Attempts |
| 03.01.09 | System Use Notification |
| 03.01.10 | Device Lock |
| 03.01.11 | Session Termination |
| 03.01.12 | Remote Access |
| 03.01.16 | Wireless Access |
| 03.01.18 | Access Control for Mobile Devices |
| 03.01.20 | Use of External Systems |
| 03.01.22 | Publicly Accessible Content |
| 03.02.01 | Literacy Training and Awareness |
| 03.02.02 | Role-Based Training |
| 03.03.01 | Event Logging |
| 03.03.02 | Audit Record Content |
Always check the official NIST 800-171 Rev. 3 text for the exact wording.
NIST 800-171 Rev. 3 FAQs
What is NIST SP 800-171 Rev. 3?
NIST SP 800-171 Rev. 3 is the third revision of NIST's security requirements for protecting Controlled Unclassified Information in non-federal systems and organisations, published in May 2024. It contains 97 requirements in 17 families, aligned with NIST SP 800-53 Rev. 5 and its moderate baseline. It is intended for federal agencies to apply through contracts and agreements with the organisations that handle their CUI.
What changed between NIST 800-171 Rev. 2 and Rev. 3?
Rev. 3 cuts the requirement count from 110 to 97 by withdrawing, merging and rewriting requirements, and renumbers them in a 03.xx.xx format. It adds three families: Planning, System and Services Acquisition, and Supply Chain Risk Management. It also introduces organisation-defined parameters, removes the separate basic and derived requirement split, and makes requirements more specific so they are easier to assess consistently.
Do DoD contractors have to comply with Rev. 3 now?
Not yet for most DoD contracts. In May 2024 the Department of Defense issued class deviation 2024-O0013, which keeps DFARS 252.204-7012 tied to NIST SP 800-171 Rev. 2, and CMMC Level 2 assessments are also based on Rev. 2. DoD has published Rev. 3 organisation-defined parameter values to support a future transition, so contractors should check each contract and plan ahead.
What are organisation-defined parameters in Rev. 3?
Organisation-defined parameters (ODPs) are placeholders within Rev. 3 requirements, such as time periods, frequencies or event types, whose values are set by the organisation or specified by the federal agency in the contract. For example, a requirement may call for a review at an organisation-defined frequency. Agencies can fix ODP values so all contractors meet the same standard, which DoD did with guidance released in April 2025.
How do you comply with NIST SP 800-171 Rev. 3?
Compliance starts by scoping the systems that process, store or transmit CUI, then assessing each of the 97 requirements and recording the results in a system security plan. Gaps go into a plan of action and milestones. Organisations then implement controls, set organisation-defined parameter values, collect evidence and use the NIST SP 800-171A Rev. 3 assessment procedures to test that each requirement is met.
How does NIST 800-171 Rev. 3 relate to ISO 27001 and SOC 2?
There is significant overlap but no equivalence. ISO 27001 and SOC 2 cover many of the same areas, such as access control, logging, incident response and supplier management, so existing evidence can often be reused. However, Rev. 3 has CUI-specific requirements, such as CUI media marking, CUI-focused scoping and agency-defined parameter values, so an ISO 27001 certificate or SOC 2 report does not demonstrate Rev. 3 compliance by itself.
How long does it take to implement NIST 800-171 Rev. 3?
It depends on the size of your CUI environment and how mature your controls already are. Organisations already compliant with Rev. 2 mainly need a gap analysis against the rewritten and new requirements, especially supply chain risk management and planning, plus ODP values. Organisations starting from scratch face a larger programme covering all 17 families, so timelines vary considerably.
Does OneClickComply support NIST SP 800-171 Rev. 3?
NIST SP 800-171 Rev. 3 is mapped in OneClickComply's control library and is available on request rather than enabled for everyone by default. Because controls are shared across frameworks, evidence you collect for Rev. 2, ISO 27001 or SOC 2 can count towards Rev. 3. OneClickComply helps you prepare and evidence your controls but does not certify compliance or replace a formal assessment.
Related standards
All standards- NIST SP 800-53 Rev. 5Standard · US
- NIST SP 800-53 Rev. 4Standard · US
- NIST SP 800-53B Privacy BaselineStandard · US
- NIST SP 800-171 Rev. 2Standard · US
- NIST SP 800-53B Low BaselineStandard · US
- NIST SP 800-53B Moderate BaselineStandard · US
- NIST SP 800-53B High BaselineStandard · US
- NIST SP 800-172Standard · US
Get NIST 800-171 Rev. 3 ready, not stressed
Automate controls, gather evidence continuously and stay audit-ready, all on one platform.