The short answer is Revision 2
If you hold a DoD contract with DFARS 252.204-7012 in it, or you are preparing for CMMC Level 2, the version you are held to is NIST SP 800-171 Revision 2. That remains true even though NIST published Revision 3 in May 2024 and lists it as superseding Revision 2 on its own site.
The two facts sit side by side without conflict. NIST sets the current edition of its publication. DoD decides which edition binds its contractors, and it has said so in writing more than once.
Why the clause alone would have pointed to Revision 3
The text of DFARS 252.204-7012 in the Code of Federal Regulations says the contractor is subject to NIST SP 800-171 "in effect at the time the solicitation is issued or as authorized by the Contracting Officer." Read literally, the May 2024 publication would have moved every new solicitation to Revision 3 overnight.
DoD headed that off. On May 2, 2024, it issued Class Deviation 2024-O0013, under which contractors subject to the clause must comply with Revision 2. A law firm summary from that time described the deviation's purpose as giving industry time for a more deliberate transition, and noted it was unclear when DoD planned to adopt Revision 3.
Where Revision 2 is written down today
Three separate documents hold the line.
- The CMMC rule. 32 CFR 170.2 incorporates by reference "SP 800-171 ... Revision 2, February 2020 (includes updates as of January 28, 2021)," and 32 CFR 170.14 builds Level 2 on it.
- The current class deviation. DoD's Class Deviation 2026-O0025, Revision 3, dated September 3, 2026, carries forward the July 13, 2026 CIO memo, which requires baseline compliance with NIST SP 800-171 Rev 2 in accordance with DFARS 252.204-7012.
- The assessment standard. CMMC assesses with NIST SP 800-171A from June 2018, which is written against Revision 2's numbering.
The CMMC rule names a specific edition by date. Moving CMMC to Revision 3 would take a change to that text.
What changed between the revisions
Revision 3 restructured the catalog. NIST says it updated the requirements to reflect the SP 800-53B moderate baseline, eliminated the distinction between basic and derived requirements, and increased the specificity of the text to remove ambiguity and clarify the scope of assessments.
| Feature | Revision 2 | Revision 3 |
|---|---|---|
| Requirements | 110 | 97 active, with 33 earlier identifiers marked withdrawn |
| Families | 14 | 17, adding Planning, System and Services Acquisition, and Supply Chain Risk Management |
| Numbering | 3.5.3 style | 03.05.03 style |
| Parameters | Fixed wording, with few values to choose | Organization-defined parameters inside many requirements |
| Basic and derived split | Yes, and the DoD scoring text relies on it | Eliminated |
| Policy documents | Policy controls treated as expected without specification | A stated requirement at 03.15.01 |
How the requirements moved
Many Revision 3 entries combine what used to be separate lines. A few examples show the pattern.
Remote access is the clearest case. Requirements 3.1.14 and 3.1.15 in Revision 2 are marked withdrawn in Revision 3 and folded into 03.01.12, Remote Access. Encryption of CUI on mobile devices, 3.1.19, is incorporated into 03.01.18, Access Control for Mobile Devices. Multifactor authentication moves from the split in 3.5.3, local and network access to privileged accounts and network access to non-privileged, to a single statement in 03.05.03: "Implement multi-factor authentication for access to privileged and non-privileged accounts."
The encryption requirement shows why parameters matter. Revision 2's 3.13.11 says "Employ FIPS-validated cryptography." Revision 3's 03.13.11 reads "Implement the following types of cryptography to protect the confidentiality of CUI" and leaves the type as an organization-defined parameter. The requirement's strength now depends on the value someone assigns.
What the three new families ask for
The added families bring in work that many small firms have never written down. Planning holds 03.15.01 Policy and Procedures, 03.15.02 System Security Plan and 03.15.03 Rules of Behavior. Revision 3 withdraws 03.12.04, so the system security plan moves out of the assessment family and into Planning.
System and Services Acquisition covers 03.16.01 Security Engineering Principles, 03.16.02 Unsupported System Components and 03.16.03 External System Services. Supply Chain Risk Management covers 03.17.01 Supply Chain Risk Management Plan, 03.17.02 Acquisition Strategies, Tools, and Methods, and 03.17.03 Supply Chain Requirements and Processes.
None of these binds you yet under DoD contracts. The unsupported component item is worth acting on anyway, since an old server that no longer gets patches is a problem under the flaw remediation requirement you already have.
Organization-defined parameters leave blanks to fill
Those blanks are why a firm cannot simply read Revision 3 and start building. Someone has to assign each value, and until DoD adopts Revision 3 and says which values it expects, any number your firm picks is a guess about an obligation that does not yet exist.
Treat the parameters as a preview. They show where the requirements are heading, and they are useful when you make a purchase that needs to last. They do not change what your next assessment will measure.
What to build to now
Build to Revision 2, score against Revision 2, and write your system security plan in Revision 2's numbering. An assessor working from NIST SP 800-171A will ask about 3.5.3, and a plan organized around 03.05.03 makes that person do a translation you should have done yourself.
The current assessment standard measures Revision 2, and a plan written to anything else is a plan written for a different test.
The current assessment standard measures Revision 2, and a plan written to anything else is a plan written for a different test.
How to avoid rework later
A few small habits make a future transition much cheaper.
- Add a Revision 3 identifier as one extra column in your requirements tracker, and leave the Revision 2 structure intact
- Write procedures around the action performed, so a renumbered requirement still points at the right procedure
- Record the actual values you use today, such as session timeouts and review frequencies, since many will become parameters
- Start a basic supplier inventory now, because supply chain risk management becomes its own family in Revision 3
- Prefer tools whose settings can be exported, so proving a new parameter means rerunning a report
- Decline to pay extra for a "Revision 3 ready" label until DoD adopts the revision
What this means for your score and your affirmation
Your SPRS score is calculated against the Revision 2 requirements and their point values, with a maximum of 110. The annual affirmation attests to the CMMC security requirements for your level, and Level 2 is defined by Revision 2. Everything you post should be consistent with that.
Be careful with the phrase "Revision 3 compliant" in a proposal or on a website. It is a claim about a standard nobody has assessed you against, and it can make an evaluator wonder whether you understand what you are bound to.
Mistakes to avoid while the revisions overlap
- Rewriting a working system security plan into Revision 3 numbering before anyone asks for it
- Filling in Revision 3 parameters as if they were current requirements, when no DoD contract measures them today
- Assuming a tool's Revision 3 mapping covers your Revision 2 assessment objectives
- Letting a consultant score you against the wrong catalog, which produces a number that does not match the 110-point method
A firm starting from nothing has one advantage here: it can build the Revision 2 program with Revision 3 in view from the first day. Write the procedures in plain actions, keep the tracker with both identifiers, and spend the money where both revisions agree, on access control, multifactor authentication, logging, patching and incident response.
What a contract could say, and what could change
The clause language leaves room for what is "authorized by the Contracting Officer," and DoD can give specific direction in a given contract. Read your actual clauses. If a solicitation names a revision, that document governs for that award, and it deserves a written question to the contracting officer if it seems to conflict with the class deviation.
Work for civilian agencies may run on different terms. The analysis here covers DoD contracts and CMMC.
The CMMC program is under review. DoD suspended Phase 2 on July 13, 2026, and opened a 60-day review by a CMMC Reform Task Force. As of early November 2026, no restart date has been announced, and nothing published moves CMMC or the 7012 clause to Revision 3. A change that large would arrive through a rule or a class deviation you can read, so watch those two places and leave the rumors alone.
Frequently asked questions
No. NIST's status for its own publication does not set your contract obligation. DoD's class deviation and the CMMC rule hold contractors to Revision 2.
Implement Revision 2. Track Revision 3 in a single added column so you can see the differences, and leave the build for the day DoD adopts it.
The published scoring method in 32 CFR 170.24 is written against Revision 2's requirements and its total of 110 points. No Revision 3 scoring method applies to CMMC today.
Yes for DoD work. Paragraph (m) of DFARS 252.204-7012 flows the clause down without alteration where the subcontract involves covered defense information, and the same deviation applies.